Cloud Computing Lectures Cloud Security 1/17/2012
Why security is important for cloud computing? Multi Tenancy, that is same infrastructure, platform, Service is shared among vendors. It is accessed over internet Data is stored in cloud Greater attack surface
Evaluate risks What resources to be put in cloud ( Data, Service, Application) How sensitive is the resource? Risk associated with the deployment model. Where will be the data and functionality What service model? Evaluation of data access methods, particular to the cloud provider
6 Questions a CIO should ask How does your vendor plan on securing your data? Need to understand how your provider s physical security, personnel, access controls and architecture work together to build a secure environment Do they secure the transactional data as well as the data at rest? do they truly provide end-to-end encryption with security in place while the data is at rest or in storage. Also, cloud security should go beyond data encryption to include encryption key management, Does the vendor follows secure development principles? What are the vendor s security certifications, audits and compliance mandates? How does your vendor detect a compromise or intrusion? What are their disaster recovery plans and how does data security figure into those plans?
What is Golden system image? Concept similar to LKGC An image taken, through a snapshot feature Machine Images Application and Data Image Network Interfaces, firewall, switch Allows to check with the current image for any threat or vulnerability Generally a cloud provider mentions in a page what kind of certification and accreditation it has
The security boundary Security boundary - End of provider responsibility - Start of customer responsibility - Any security mechanism below is provider s responsibility - Any security mechanism above is customer s responsibility. - As we go down the service stack the ownership of security gets transferred from customer to provider
The security boundary
Security Mapping ( What I need, what CP gives ) - It s about identifying various needs of your deployment Security Features Compliance Auditing Other Requirements - Then checking which functions are covered by cloud provider, how many of them can be covered on premise - Basically gives an idea of the security coverage A security control model covers security related to Application Data Management Network Physical Hardware It also includes compliance.
Securing Data Sending, retrieving data to and from cloud is the single largest Security concern. WAN traffic can be intercepted Mechanisms Access Control Auditing Authentication Authorization
Brokerage cloud storage access Data can be anywhere, on premise, data center, cloud ( Same province, country, Continent or somewhere outside. Can not Firewall like Client Server Approach is creating layered access with a proxy in between Proxy allow some rule, based on client identify Multiple encryption keys can be used
Brokerage cloud storage access 1. Client Data Request Client 6. Data Response 2. Apply rules, restate request Proxy 5. Storage data Relay Broker 3 Modified Data Request Cloud Storage 4 Storage data Reply
Storage location and tenancy Cloud providers mention in contract, where data stored. To dos: Check cloud provide under local privacy law Method of segregation in case of multi tenancy Check who has privileged access? What type of encryption? Recoverability? Tested by security experts? Plans for disaster recovery? Multisite etc Encryption : Many providers like Microsoft, Amazon allows having multiple keys, allowing to create multiple zones. Key management needs to be dealt seriously Keys should have a defined life cycle.
Auditing & Compliance Auditing about logging and inspect event and activities. Verifying that the processes meet relevant regulation, or standard Issues in cloud, many sections may be applicable only to provider, they might not be willing, the terms and condition not covered in SLA. Few things to be understood Which regulations? Which apply to provider, where is the demarcation? How cloud provider will support? How to provide data to regulator, to provide information necessary, irrespective of responsibility
Auditing & Compliance Burden is with client, rather than provider, so if risky avoid. Need to check for data security and no compromise on integrity. Situations complicate with multi country possibilities Few steps Contract reviewed by legal staff Right-to-audit clause in SLA Review cloud service provider Scope of applicable regulations Evaluate steps need to comply to regulation Adjust procedure Collect and maintain evidence Check with provider, if they can give audit statement.
Identity Management Identity management is a primary mechanism for controlling access to data in the cloud preventing unauthorized access maintaining user roles Complying with regulation Cloud computing requires the following That you establish an identity That the identity be authenticated That the authentication is portable That authentication provide access to cloud resources
Identity protocol standard OpenID is the standard associated with creating an identity and having a third party authenticate the use of that digital identity. It is key to creating Single Signon (SSO) system. Let s say that you re visiting a new web site that supports OpenID. When signing in, you will see a form that looks something like: After you submit the login form, your browser takes you from the web site you are visiting to your OpenID provider s web site. At this point, your provider checks to see if you are who you say you are. Now you ve proven to your provider that you really are who you say you are. Next, your provider wants to make sure that you want to log into the requesting web site and that you are willing to share information with it.