Cloud computing and it's security aspect.

I have had keen interest in Virtualization for quite some time now. With cloud computing coming up virtualization is taken to the next level. My work experience with Virtualization has been rather less (my over all work experience has been 2 years all of in core security architecture development and implementation, virtualization is like few weeks now mostly at home and a server coming up next week :D ).
I’ve been intrigued with how virtualization, if used in the right way can solve so many of security problems (although most would say they give rise to many security concerns too and that’s true in its own way).
I didn’t want to Google this and go over 100’s of pages (not 1000’s yet) of how cloud computing is going to be a security nightmare (I think I read this on Cisco’s web page.) but I want to know it from you (members here) on what they think about how cloud computing will impact security architecture as it stands now or cloud computing and its security aspect as a general topic. You may also put your general questions / comments / opinions about cloud computing.


I will be using material in this thread towards a paper I’m writing on cloud computing. The paper will focus on “security” aspect of cloud computing.

Thank you ALL in advance.

:)

Most of the security threats we've seen have been to the guest OS rather than the virtualization (at least at the bare metal level compared to the hosted level, which has more ties between the OS and the Hypervisor). It'll be interesting to see what new threats are developed for this environment as time goes on.

True MS.. (For some reason I knew you'll be the first to reply.. :) )

Anyway with virtualization comes certain risks that people seem to oversee. I completely agree with the statement that in virtualization risk lies in host OS but with the way virtual servers are put up security appliances need to re-designed or you're opening up holes in your network. I am not getting a very good example to explain this but I hope you get it (sorry though) ..

I'm really excited about my paper (I hope to get it out soon) but right now.. It’s time to head home.. :) (Rain in Mumbai is a killer .. :( )

Well, some things do have to change but the principles are still the same. I know our product is EAL 4+ certified out of the box and the NSA/NIST Guide is out for ESX 3 (http://www.nsa.gov/ia/_files/support/I733-009R-2008.pdf). A lot of the consideration is how networking is configured (separate and isolated are preferred, particularly keeping the service console or other management port separate from network storage -- if any -- and the VMs/Cloud's environment). I'd be curious to read the paper after you've completed it.

Lol.. MS between you and me.. (Actually since I’m saying it here its public) anyway I wanted to write a paper detailing "something" that I’ve found interesting for a long time..Trust me my first choice was how to secure Winxp or something :D

But then I moved to VM's and now this.. I promise by the time I’m done ill have something good to read upon.. Anyway there WILL be some delay.. I'm trying to give GCIH and PMI .. :D

Anyway it’s nice to know that AO isn't completely dead .. :)

Hey I just went over Trend's documents and presentation (sale's oriented) describing how they are using cloud computing for their anti-malware / enterprise grade products..

I really don't like the way they have done this! I mean it's stupid and actually decreases security level provided.. It does decrease the time frame for new malware to be detected but provides much less security too..

Can we discuss this? (PM / IM maybe, please :) )

Byte, Well we have moved over to cloud computing for over two years now and everything is going good so far.

Could you explain the security aspect because as a "Management Hosted Service" with our product such as Managed Office Protection , it makes it relatively easier for the customer as no infrastructure needs to be installed at the premises besides the resident which is light due to "scanning" from the cloud.

Im also very interested in this topic, dont make it a private discussion :(

Ahhhhhh! "Cloud Computing"..............."The Cloud".............it's so trendy, so hip, so "Now!" isn't it?

If I might paraphrase the film "Apocalypse Now"............"I do love the smell of marketing bull$h1t in the morning". :lildevil:

It is so pathetic it almost reminds me of "Sick Sigma"...........but that's another story.............

The trouble with this fantastic "new" development in the IT sector is that I was auditing Corporations that used it, and their providers, over 35 years ago!!!

Basically, all it is is the provision of computing facilities as a service by a remote third party.

I recall one client in Richmond-upon-Thames (England) whose computing services were provided by NASA, in Houston Texas :D

OK the technology has advanced, but the fundamental concept and the security concerns are still pretty much the same.

Primarily, if you don't do it in-house you don't have absolute control. However, given current legislation (certainly over here) you have almost certainly retained liability for regulatory compliance.

It is a different environment these days as there is now a very real external threat to computer systems. Back then most of your threats were internal (and people still robbed banks and post offices for a living:eek:)

The motivation was also financial back then, only it was more a case of cannot afford, or cost justify ownership, whereas it is now more one of cutting the costs of existing service provision.

It will be interesting to see how it fares in Europe, where there is relatively strong employment protection legislation..............particularly given the Global recession? After all, if you move functionality to a third party you are outsourcing.

Interesting, so basically the threat is that you are outsourcing your Apps versus having them in house.

For example with traditional AV product you would have a console on your "server" and then download the updates and distribute where now you will log into a secure website and that will be your console?

Quote:

---

Interesting, so basically the threat is that you are outsourcing your Apps versus having them in house.

---

The main issue is likely to be that you are putting control and security of your data and processing in the hands of a third party (that includes business continuity).

Technically I don't see much difference from the current practice of having corporate data centres in remote locations. To some extent we have already gone in that direction with third parties providing data centre/server farm facilities............this just extends the devolution of control.

I can see problems with the next logical step, though, which is when the service providers try to maximise their profits by taking the actual provision offshore. :eek:

There is also the major issue of employee selection and vetting procedures?

@Cider.. No No .. don’t get me wrong.. I wasn't trying to make the conversation private.. I just wanted to talk to MS about something’s.. :)

Quote:

---

which is light due to "scanning" from the cloud.

---

From my testing of Trend's product, which specifically utilizes cloud for scanning I found this to be foolish.. I for some odd reason didn't agree onto the way the product functioned (it was a single executable scanner [not housecall 7] that trend provided to my company). It relied "completely" on the cloud for its scanning need and scanned only certain areas. Just to confirm I asked the eng's present there is this is how the test product is configured or there are some parameters to it. He clearly mentioned that the scanner picks up information from the cloud and scan’s only area's that are "currently" seeing heavy infection. If we believe him, then it’s easy to conclude that relying on cloud for scanning needs is stupid.

If we don't believe him (i don't) then still instead of relying on cloud "completely" for scanning needs / def's i think we can use cloud to transfer information fast about spreading risks and other such needs.. The way trend has developed its product and I’m also talking of house call right now is actually going to provide less protection overall. If anyone gets time to check new version of housecall you will find that it scans only system folders + few others to find risks. This is inefficient use of cloud architecture plus companies / individuals using this product will be exposed to more risks overall.

My point of conversation here is mainly that cloud architecture and its current use with respect to security risks being created and destroyed depending on its deployment / use and architecture overall.

Btw, I also feel either i've not understood use of cloud architecture by AV vendors or I do not understand the reply to the post.

The way Trend portrayed it is a global information sharing center. Like if I find a file which is bad it will be told to everyone using trend.. like a broadcast.. am i going wrong here ?

No No,

That is basically it however you say it relies on the cloud for everything. Incorrect from my side. You will have a resident antivirus signature file which only disinfects maybe 1 million malware / virus's / spyware or whatever but having access to the cloud we have access to 30 Million ...

Also if a suspicious file is detected through behavioral analysis and deep code scan , the MD5 of that file will reference the cloud and then it will be autogenerated and put it if it pertained as goodware or badware.

I understand your point where it relies totoally on the cloud... Ho do you infect the company? Kill their internet and then plug in the USB and off you go - no protection. There has to be protection from the cloud + a resident sig file + strong enough heuristic scanners to eat up suspicious files ...

but in the sense of "outsourcing" your companies AV or whatever app can be outsourced to a hosted service, could also have issues.

What the AV vendors are doing is something firewall vendors started years back.. Where rules you create are sent back to the vendor and he decides to either roll them out to all his customers or if he finds them malicious he doesn't do anything..

This is basically what I’m talking about :

http://www.agnitum.com/support/improvenet/technical.php

.. If AV vendors use the cloud to pass on information fast to everyone else, its good idea. Using information from the cloud to protect customers will definitely be good but I think for one vendor "trend" they're going the wrong way as of now to an extent.

Speaking of cloud to provide service like Amazon or Google.. What are your thoughts ? How will privacy laws affect data being given out submitted in the cloud affect current situations?

The thread is actually alive ! :D :)



EDIT : I was going over how trend is planning to roll out its AV in coming months which will utilize cloud architecture .. I had a question will all these machines sending information to the cloud, wouldn't the processing be over whelming ? I mean so many files, so many MD5's (I think they should have SHA1 or above, but whatever) wouldn't it be an information overflow ?

Quote:

---

wouldn't it be an information overflow ?

---

Well as I understand it from Panda Managed Office Protection, only the suspicious files, caught by beahvioral or deep code scan will submit their md5 so it wont be every file ...

The resident has a resident signature to deal with most threats internally, never leaving the network to access the cloud.

I would also like the response towards google and so on about doing this sort of thing ...

Quote:

---

Originally Posted by ByTeWrangler

Hey I just went over Trend's documents and presentation (sale's oriented) describing how they are using cloud computing for their anti-malware / enterprise grade products..

I really don't like the way they have done this! I mean it's stupid and actually decreases security level provided.. It does decrease the time frame for new malware to be detected but provides much less security too..

Can we discuss this? (PM / IM maybe, please :) )

---

I'd be interested in discussing it but if it's ok, can we get into the in-depth discussion next week after Monday morning? I'm in the process of studying for my VCP 4 Beta exam (it's rather lengthy) and want to pass it on first go but I know it'll be longer than the regular exam. :)

ALL THE BEST FOR YOUR EXAM'S !

YOU WILL PASS I'M SURE !

:)

Funny things clouds...........they are woolly, fuzzy, and obscure your vision. But, every one of them has a silver lining, or so the saying goes.

At least that seems to be the hope of Google, Microsoft, IBM, Sun Microsystems and everyone else who seems to be trying to jump on this "cloud computing" bandwagon............or will it be a gravy train?.............they wish! :D

There is no such thing as "The Cloud" other than in the imaginations of marketing drones and media hacks.

It already has a name as it happens.............it is called "The Internet" ;)

So, given that we are really talking about "Internet Computing", I would suggest that these are a few of the areas where security needs to be considered:

1. Everything is a service so who is responsible for controlling and securing it?
2. Who audits their stewardship of these responsibilities?
3. Who hires and vets the staff?
4. Who ensures regulatory compliance and how?
5. Location of data.
6. Encryption and secure data transfer.
7. Access control; both physical and remote.
8. Disaster recovery
9. Business continuity.
10. Forensics

;)

It might be useful to look at stuff on e-commerce security, as a lot of the issues will be similar.

P.S. Good Luck MsM!

http://www.youtube.com/watch?v=QJncFirhjPg

Possibly the best video out there explaining Cloud Computing. I always compared it with virtualization but it’s not exactly the same. Anyway A MUST WATCH VIDEO.

Thanks, ill get someone to download and ill preview it later.

Byte's original post: I don't think it's going to be a nightmare but rather we're going to have to change the way we think about things. In the end we still have to adhere to the same principles as before -- CIA -- to ensure corporate protection. I think CISCO is using a little FUDing here to drive some market share towards them. If we break it down..

1. We have to ensure security of the physical datacenter. This should already exist as a standard. Even when that physical datacenter (aka infrastructure in the video provided) is spread across multiple areas, there is always a physical component that needs to be looked after.

2. The application or virtual servers that run on the infrastructure still need protections. Either host based firewalls or networks for them to go out on. And either host based or network based virus protection (virus walls?). The scanning you mentioned, where one part of the cloud is heavily scanned while others are not is likely an indication of an outbreak (think viruses that affect humans -- recent swine flu outbreak shutdown many locations and nearly stopped all border traffic for Mexico for a while and CDC + others visited -- same principle).

3. Separation of networks. VLANs and good virtual switch design can ensure that an environment is kept sound. Firewalls, regular audits and monitoring are all things that should be done on a regular basis.

Quote:

---

Originally Posted by nihil

The main issue is likely to be that you are putting control and security of your data and processing in the hands of a third party (that includes business continuity).

---

You do that already when you purchase anything from anyone today. I buy software from MS, Apple, etc. and I'm putting control and security into their hands (aka, I'm trusting them to build good, ethical software that won't phone home). If I go to a consultant to provide security audits for a company, then I'm trusting them to do a good job and be ethical -- whether they are 2 feet in front of me or 6000 miles away.

It is a question of trust in general. The internet, as a whole, has had this degraded over the last 15+ years or so. While not a true computing cloud (there's no control over which resources run and which don't during peak and non-peak times) it's a kind of cloud that has let trust erode from it's membership.

Quote:

---

I can see problems with the next logical step, though, which is when the service providers try to maximise their profits by taking the actual provision offshore. :eek:

There is also the major issue of employee selection and vetting procedures?

---

The issue you're referring to, Nihil, really isn't cloud computing itself but rather who runs it and is it internal, external or both? A question of trust from the sounds of it. Running off shore in itself isn't an issue. It's how it's managed off shore and how are things verified off shore that is the issue. We're a global society now. For smaller organizations it makes no sense to run their own external cloud unless there is a reason for them to do so (e.g., legal requirements, health policy requirements, etc.). They can use existing environments or the precursor to cloud -- standard virtualization (whether host or hypervisor model).

There is a mythos that outsourcing to India and other locales automatically means that data is compromised but keeping it in the UK, USA or other "industrialized nation" means it's secure. Bullshit. There are just as many unethical administrators here in the industrial world as there is elsewhere. If I do not vet who I outsource to, regardless of their physical location, I do a disservice to myself, my company and, in some cases, may be breaking the law by not ensuring that standards are met.

If offshoring is a concern, then house the cloud yourself. Run your own cold/warm/hot site at your own physical location (75 miles away or whatever to account for major natural disasters). Use standard scanners (traditional AV on the servers -- physical and virtual) and standard firewalls. It will mean more work for you and less play time but at least it's not outsourced.

Like any other form of outsourcing, vet the company. Get them to provide a security report from a reputable and responsible firm. And if possible, get your own 3rd party do an independent audit. Visit the site they host and ask about their procedures for things like hiring, auditing of systems and people, etc.

If you just go ahead into the cloud and don't ask questions, well.. Caveat emptor, eh?

Quote:

---

Originally Posted by ByTeWrangler

http://www.youtube.com/watch?v=QJncFirhjPg

Possibly the best video out there explaining Cloud Computing. I always compared it with virtualization but it’s not exactly the same. Anyway A MUST WATCH VIDEO.

---

That's a pretty good basic description. The key is, of course, the ability to access resources on demand and then disable (shutdown) those resources when not in demand (it always makes me think of a modified Beowulf cluster).

Traditional virtualization (e.g. VI3, Xen, Hyper-V) are the basic infrastructure needed to get to cloud computing. vSphere is closer to cloud than traditional virtualization. The ability to power off physical servers, VMs, etc. when resource utilization is low is on of the main features. The one thing that, IMO, is still holding us back is the fact the VM is still -- technically -- reliant on a single machine for it's "four food groups" (cpu, memory, network, disk). That may go soon, too, however, with the advent of FT for VMs (which I really like as a concept and for it's purpose).


Ultimately, one of the things I've noticed is that a lot of people look at cloud and they go "oooh!! Magic!!! It's so scary!!" <insert Gabriel Iglesias voice here> It's not. It's just changing some parts of how we do computing from a strict physical compartmentalization to a virtual compartmentalization to a cloud compartmentalization. We're not at the point of the neural networks (aka Star Trek) but we're moving towards it, baby-step by baby-step.

You might like to read this:

http://news.xinhuanet.com/english/20...t_11717437.htm

Yes, it is all about trust and competence..............governments, banking systems, retail systems.................

:rolleyes:

And this:

http://www.capecodonline.com/apps/pb.../BIZ/907160307

And this:

http://www.infosecurity-magazine.com...urity-failure/

Quoth the Raven: "Nevermore"

:lildevil:

Quote:

---

Originally Posted by nihil

You might like to read this:

http://news.xinhuanet.com/english/20...t_11717437.htm

Yes, it is all about trust and competence..............governments, banking systems, retail systems.................

:rolleyes:

And this:

http://www.capecodonline.com/apps/pb.../BIZ/907160307

And this:

http://www.infosecurity-magazine.com...urity-failure/

Quoth the Raven: "Nevermore"

:lildevil:

---

In each one of those it was due to the user having a simple password (I mean, come on.. PASSWORD?!). Regardless of whether it's cloud or not, once I have a way in, I can get in. The cloud is to allow application/application servers to run anywhere on hardware. How I secure that underneath and on top is still standard security. Good passwords, different passwords for different applications/environments, only open what needs to be open, limit access internal (I've been mentioning internal vs external cloud for a reason).

For some they may never feel comfortable with the cloud becauase.. well, it's "magic".

I don't think it's necessarily evil nor do I think it's insecure. I think one needs to look at a grandeur scheme of things than a single location. And that perhaps is the biggest challenge.

Wouldn't it be less secure than having the same data being hosted in your facility ?

:shocked:
Btw, MsM you've given me enough material for half of my paper.. :) maybe more .. Would it be okay if I use it.. Ill send a copy before releasing and upon your conformation ill release it..?

*THANKS A LOT THOUGH* :D


PS: How was your exam ?

Quote:

---

For some they may never feel comfortable with the cloud becauase.. well, it's "magic".

---

Not really, I think for "magic" you should read "bullshit".

As I pointed out earlier, the whole concept dates back to the early 1970's (I am not old enough to go back further than that:halo:)

The marketing hype surrounding "the cloud" is quite likely to kill the whole thing...............people will think that it is supposed to be magic.........that they don't understand it, and therefore will not want to know.

It may sound prosaic but I would go for the commonsense line:

"This has been around for years as a concept.....you are familiar with third party vendors, contractors, packages, outsourcing, thin clients and the rest. New technology has provided a new opportunity for improved service at substantially reduced costs..............blah, blah................"

In a way, it is very similar to the age old business decision of "make or buy?"

EDIT:

Hi ByTe~,

This may be of interest if you take regulatory compliance and other legal aspects to be part of "security"

http://news.cnet.com/8301-19413_3-10286028-240.html

Basically, current legislation and case precedents are based on current IT models. This could have serious legal implications if your IT is distributed and in the hands of third parties.

I distinctly recall that incident a while back when the FBI raided a co-location facility and seized everything.......................



Here is a recent article that might be of interest. Apparently Los Angeles are looking at using Google Apps:

http://www.dailynews.com/news/ci_12864208

Quote:

---

Originally Posted by ByTeWrangler

Wouldn't it be less secure than having the same data being hosted in your facility ?

:shocked:
Btw, MsM you've given me enough material for half of my paper.. :) maybe more .. Would it be okay if I use it.. Ill send a copy before releasing and upon your conformation ill release it..?

*THANKS A LOT THOUGH* :D


PS: How was your exam ?

---

LOL. It is something IT is going to have to discuss. I would bet, based on discussions here, that you'll find a "religious split": 50% will say it's secure while the other 50% will say otherwise. LOL

As for the exam, still waiting. It's a beta exam so they take a look at the results and any really bad questions are yanked. It was pretty tough for what is to be an intro exam, far more than previous VCP exams. Eh. Wait and see.

I honestly find cloud computing good for current state where everyone is not in the best of conditions to buy new hardware and host data but want freedom to have really powerful (or lot of powerful) server grade hardware under them. It will help people set up business with low capital expenditure, to this extent I am sure cloud computing is beneficial.

However, since you're turning to someone for service lot of "problems" will arise. I have, at least in India seen that SLA's are hardly met and the condition is so bad that people don't even bother to take legal actions when SLA's are not met. I wonder if a company from India will start giving cloud services, then it’s time to unplug the machine and go to sleep!

Anyway the idea is good but like most new (Nihil would kill me for calling it new) idea's there are still sides we don't know about.

I think its better to wait before completing this discussion. :)


Anyway, MsM and Nihil thank you VERY MUCH FOR YOUR INPUTS.

Well,

Looking at it from my personal viewpoint:

Quote:

---

Wouldn't it be less secure than having the same data being hosted in your facility ?

---

I can think of quite a few instances where it would probably be far more secure. Basically small operations where they don't have the resources or expertise.

Whilst remote computing operations make very tempting targets, they are of sufficient scale to implement a very high level of security.

Strange as it may seem, I know of quite a few sites that run their payroll through a third party provider, so they are prepared to embrace the concept.

I don't like the term "cloud computing" and the hip, chic, mysterious connotations that it has. To put it bluntly, a lot of the people I deal with eyes would glaze over when you started talking about "clouds" :D

Tell them it is an up-to-date, internet based implementation of well established business processes, and they are happy! I am not against the concept.

As for the remote aspect, there are obviously potential geopolitical and legal issues, but I really don't see those as insurmountable in the longer term. If the rules say that this must be hosted in the US or in the EU then so be it. That doesn't detract from the concept, it just dictates some aspects of the implementation.

Also there is the question of reliability of your connection, but I would say that over here that is probably as good as, if not better than, quite a few local networks and WANs.:eek: Just make sure you take it into account with your business continuity plan?

Quote:

---

Nihil would kill me for calling it new

---

Not really :D The concept is well tried, only this particular implementation is new.

Quote:

---

I wonder if a company from India will start giving cloud services, then it’s time to unplug the machine and go to sleep!

---

Not if the price is right! ;)

* BUMP * to the thread.. There is a nice paper out on "Information Leakage in Cloud Computing".. Some more food for thought..

http://cseweb.ucsd.edu/~hovav/dist/cloudsec.pdf

I haven't gone read it completely yet but i'm going to do that now.. I'll update once i'm done..

Have a great week .. :)

Thanks Byte, Got it down and will give it a read through.

You could just ask twitter about the security of cloud computing

http://www.cnn.com/2009/TECH/07/16/t...ack/index.html





(note.. the cloud wasn't the real problem, it was morons with access that use poor passwords and are susceptible to social engineering).