Cloud computing-security-issues
Download as PPT, PDF3 likes3,987 views
This document discusses security issues related to cloud computing. It defines cloud computing and outlines the essential characteristics, service models, and deployment models. It also addresses key security concerns including governance, legal issues, compliance, information lifecycle management, and risks associated with loss of control over data and applications in the cloud. The document emphasizes that security responsibilities are shared between cloud providers and users, and both parties need to understand their roles.
Cloud computing-security-issues
- 2. Something Old, Something New 2 New: Cloud describes the use of a collection of services, applications, information, and infrastructure comprised of pools of compute, network, information and storage resources. These components can be rapidly orchestrated, provisioned, implemented and decommissioned, and scaled up or down providing for an on- demand utility-like model of allocations and consumption
- 3. Cloud Computing Parts 3 NIST defines cloud computing by: 5 essential characteristics 3 cloud service models 4 cloud deployment models
- 4. Essential Characteristics 4 On-demand service Get computing capabilities as needed automatically Broad Network Access Services available over the net using desktop, laptop, PDA, mobile phone
- 5. Essential Characteristics 5 Resource pooling Provider resources pooled to server multiple clients Rapid Elasticity Ability to quickly scale in/out service Measured service control, optimize services based on metering
- 6. Cloud Service Models 6 Software as a Service (SaaS) We use the provider apps User doesn’t manage or control the network, servers, OS, storage or applications Platformas a Service (PaaS) User deploys their apps on the cloud Controls their apps User doesn’t manage servers, IS, storage
- 7. Cloud Service Models 7 Infrastructure as a Service (IaaS) Consumers get access to the infrastructure to deploy their stuff User doesn’t manage or control the infrastructure User manages or controls the OS, storage, apps, selected network components
- 8. Deployment Models 8 Public Cloud infrastructure is available to the general public, owned by org selling cloud services Private Cloud infrastructure for single org only, may be managed by the org or a 3rd party, on or off premise
- 9. Deployment Models 9 Community Cloud infrastructure is shared by several organizations that have the same shared concerns, managed by organization or 3rd party Hybrid Consists of tow or more clouds bound by standard or proprietary technology
- 10. What, When, How to Move to the Cloud10 Identify the asset(s) for cloud deployment Data Applications/Functions/Process Evaluate the asset Determine how important the data or function is to the org
- 11. Evaluate the Asset 11 How would we be harmed if the asset became widely public & widely distributed? An employee of our cloud provider accessed the asset? The process of function were manipulated by an outsider? The process or function failed to provide expected results? The info/data was unexpectedly changed? The asset were unavailable for a period of time?
- 12. Map Asset to Models 12 4 Cloud Models Public Private, internal, on premise Private, external Community Hybrid Which cloud model addresses your security concerns?
- 13. Map Data Flow 13 Map the data flow between your organization, cloud service, customers, other nodes Essential to understand whether & HOW data can move in/out of the cloud Sketch it for each of the models Know your risk tolerance!
- 14. Cloud Domains 14 Service contracts should address these 13 domains Architectural Framework Governance, Enterprise Risk Mgt Legal, e-Discovery Compliance & Audit Information Lifecycle Mgt Portability & Interoperability
- 15. Cloud Domains 15 Security, Business Continuity, Disaster Recovery Data Center Operations Incident Response Issues Application Security Encryption & Key Mgt Identity & Access Mgt Virtualization
- 16. Security Stack 16 IaaS: entire infrastructure from facilities to HW PaaS: application, Middleware, database, messaging supported by IaaS SaaS: self contained operating environment: content, presentation, apps, mgt
- 17. Security Stack Concerns 17 Lower down the stack the cloud vendor provides, the more security issues the consumer has to address or provide Who do you trust?
- 18. Key Takeaways 18 SaaS Service levels, security, governance, compliance, liability expectations of the service & provider are contractually defined PaaS, IaaS Customer sysadmins manage the same with provider handling platform, infrastructure security
- 19. Sample Clouds 19 From “Security Guidance for Critical Areas of Focus in Cloud Computing v2.1, p.18
- 21. Security Pitfalls 21 How cloud services are provided confused with where they are provided Well demarcated networksecurity borderis not fixed Cloud computing implies loss of control
- 22. Overall Security Concerns 22 Gracefully lose control while maintaining accountability even if operational responsibility falls upon 3rd parties Provider, user security duties differ greatly between cloud models
- 23. Governance 23 Identify, implement process, controls to maintain effective governance, risk mgt, compliance Provider security governance should be assessed for sufficiency, maturity, consistency with user ITSEC process
- 24. 3rd Party Governance 24 Request clear docs on how facility & services are assessed Require defn of what provider considers critical services, info Perform full contract, terms of use due diligence to determine roles, accountability
- 25. Legal, e-Discovery 25 Functional: which functions & services in the Cloud have legal implications for both parties Jurisdictional: which governments administer laws and regs impacting services, stakeholders, data assets Contractual: terms & conditions
- 26. Legal, e-Discovery 26 Both parties must understand each other’s roles Litigation hold, Discovery searches Expert testimony Provider must save primary and secondary (logs) data Where is the data stored? laws for cross border data flows
- 27. Legal, e-Discovery 27 Plan for unexpected contract termination and orderly return or secure disposal of assets You should ensure you retain ownership of your data in its original form
- 28. Compliance & Audit 28 Hard to maintain with your sec/reg requirements, harder to demonstrate to auditors Right to Audit clause Analyze compliance scope Regulatory impact on data security Evidence requirements are met Do Provider have SAS 70 Type II, ISO 27001/2 audit statements?
- 29. Info Lifecycle Mgt 29 Data security (CIA) Data Location All copies, backups stored only at location allowed by contract, SLA and/or regulation Compliant storage (EU mandate) for storing e- health records
- 30. Portability, Interoperability 30 When you have to switch cloud providers Contract price increase Provider bankruptcy Provider service shutdown Decrease in service quality Business dispute
- 31. Security, BC, DS 31 Centralization of data = greater insider threat from within the provider Require onsite inspections of provider facilities Disaster recover, Business continuity, etc
- 32. Data Center Ops 32 How does provider do: On-demand self service Broad network access Resource pooling Rapid elasticity Measured service
- 33. Incident Response 33 Cloud apps aren’t always designed with data integrity, security in mind Provider keep app, firewall, IDS logs? Provider deliver snapshots of your virtual environment? Sensitive data must be encrypted for data breach regs
- 34. Application Security 34 Different trust boundaries for IaaS, PaaS, Saas Provider web application security? Secure inter-host communication channel
- 35. Encryption, Key Mgt 35 Encrypt data in transit, at rest, backup media Secure key store Protect encryption keys Ensure encryption is based on industry/govt standards. NO proprietary standard Limit access to key stores Key backup & recoverability Test these procedures
- 36. ID, Access Mgt 36 Determine how provider handles: Provisioning, deprovisioning Authentication Federation Authorization, user profile mgt
- 37. Virtualization 37 What type of virtualization is used by the provider? What 3rd party security technology augments the virtual OS? Which controls protect admin interfaces exposed to users?
- 38. 38
- 39. Summary 39 We already do some sort of cloud computing NFS, Samba shares, SAN, NAS, Web applications Decide on public or private cloud Public cloud implies loss of control
- 40. Reference 40 All material from “Security Guidance for Critical Areas of Focus in Cloud Computing v2.1”, http://www.cloudsecurityalliance.org All figures in this talk taken from this paper NIST Cloud Model: www.csrc.nist.gov/groups/SNS/cloud-computing/index.html Various cloud working groups Open Cloud Computing Interface Working Group, Amazon EC2 API, Sun Open Cloud API, Rackspace API, GoGrid API, DMTF Open Virtualization Format (OVF)