Welcome!

@BigDataExpo Authors: Liz McMillan, Yeshim Deniz, PagerDuty Blog, William Schmarzo, Carl J. Levine

Related Topics: @CloudExpo, Microservices Expo

@CloudExpo: Article

How to Develop an Effective Security Strategy to Play in the Public Cloud

Develop an effective security strategy with the right blend of technology and processes

Look all around and you can easily see that there is no shortage of press regarding the promises of cloud computing. Cloud evangelists have touted cloud computing as the next big thing, a game changer - a disruptive technology that will spark innovation and revolutionize the way businesses acquire and deliver IT services. The staggering volume of these sales pitches is to be expected, considering that cloud computing is at or near the peak of its hype cycle, but as with any new technology or model, reality will eventually set in and the public relations blitz will fade. As people continue to define cloud computing and debate its pros and cons, one thing is certain - one of the biggest obstacles to widespread cloud computing adoption will be security.

This article will deal with the security approach for the public cloud as opposed to a private, hybrid, or community cloud. The public cloud, as defined by the National Institute of Standards and Technology (NIST), is cloud infrastructure that is made available to the general public or a large industry group and is owned by an organization selling cloud services. An example of a public cloud implementation would be an application that is hosted in Amazon EC2. Anyone with a simple credit card would be able to deploy a software application in this type of environment.

Cloud Computing Styles
There are three major styles of cloud computing: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). IaaS is delivery of the computing infrastructure as a fully outsourced service versus an in-house, capital investment-sourced model. The consumer rents processing, storage, networking components, etc. With PaaS, consumers are given everything they need to develop, test, and deploy applications to the cloud. Finally, SaaS provides the consumer with the capability to use a cloud provider's applications running on a cloud infrastructure. The software application is accessed through a thin client interface such as a standard web browser. While many of the recommendations presented are applicable across all three cloud styles, the security approach described in this article is most applicable to IaaS.

Benefits of the Cloud
Before we dive into the security approach for the public cloud, let's briefly examine the potential benefits. Once you cut through all the hype, a closer look at the benefits of moving to the cloud reveals a strong business case. The cloud offers a pay-as-you-go model that is highly reliable and scalable, and gives you tremendous flexibility and agility to boot. The McKinsey study, "Clearing the Air on Cloud Computing," states that the average server utilization in a data center is 10 percent. Anyone who has ever run a data center knows how enormously difficult it is to achieve high reliability, efficiency, and scalability.

In the cloud, enterprises can greatly reduce their capital costs and no longer have to worry about allocating time and resources to maintaining infrastructure, and patching servers and software. As a result, IT personnel can work more efficiently which in turn, can breed more innovation and help enterprises enter new markets. In the cloud, applications are accessible anywhere and at any time so employees now have more mobility. The cloud provides nearly infinite computing power and storage to enterprises and users at a mere fraction of what it would cost to actually purchase and maintain these resources. This is a huge advantage for technology startups that have limited capital. The case for moving to the cloud becomes even stronger when you consider how the troubled economy is putting pressure on businesses to cut costs.

Although surveys differ on what percentage of companies will adopt cloud computing in the next 12-24 months, enterprises are already taking cloud computing seriously. In fact, according to a recent Forrester study, one out of four large companies plans to use a cloud provider soon, or has already employed one. Furthermore, Intel predicts that by 2012, an estimated 20 to 25 percent of its server chips will be dedicated toward cloud computing data centers.

Cloud Computing in the Private and Public Sectors
Anyone who has ever logged onto Facebook, Twitter, or Gmail or purchased an item from Amazon.com has either knowingly or unknowingly used a cloud-based application. There are numerous other examples of cloud computing implementations in the private sector, but it is also important to note that the public sector does not trail far behind.

Vivek Kundra, the federal CIO, is a big supporter of cloud computing. Under Kundra's leadership, the federal government has moved quickly on major cloud computing initiatives such as the General Services Administration (GSA) Storefront, an online store that will soon allow government agencies to easily procure cloud computing services. NIST has already released a working definition of cloud computing and is currently developing a Special Publication on cloud computing security.

In the defense sector, the Defense Information Systems Agency (DISA) has led the way with private cloud implementations such as Rapid Access Computing Environment (RACE) and Forge.mil. RACE gives DISA customers the ability to rent a basic computing environment. Customers purchase an environment on a monthly basis so the costs and risks of acquiring and sustaining a computing environment are significantly reduced. Forge.mil is essentially a mirror of SourceForge.net and allows developers to store and manage code for open source software projects.

Cloud Computing Security Risks
If the benefits are so clear, why isn't everyone adopting cloud computing right now? Research and polling indicate that the main obstacle is security. It probably comes as no surprise that the vast majority of surveys reveal security to be the number one concern of IT executives and CIOs who are considering cloud computing. Security within the cloud has received substantial press coverage, including publication of the Gartner top seven security risks associated with cloud computing, in a report entitled, "Assessing the Security Risks of Cloud Computing."

Earlier this year, a flaw in Google Docs led to the inadvertent sharing of some users' private documents with other users on the Internet without the owners' permission. There have been other highly publicized breaches and future incidents are inevitable.

Does this mean that the security risks of cloud computing outweigh its potential benefits?

Absolutely not, but customers must perform due diligence and practice due care. In addition to selecting a vendor that can comply with organizational security requirements, customers need to carefully plan and develop a defense-in-depth strategy that mitigates the security risks of cloud computing and addresses all layers of the cloud architecture.

Cloud Computing Security Approach
Given the highly distributed and federated nature of the cloud computing model and the constant threat of new attacks, the network-based perimeter defense strategy is clearly no longer adequate or relevant. Customers will now have to protect all the layers of the cloud architecture. To ensure the confidentiality, integrity, and availability of customer data, the security strategy for the cloud must address the following:

  • Physical and environmental security
  • Hypervisor security
  • Operating system security
  • The web tier
  • The application tier
  • The database tier
  • Network security
  • Auditing

The design of this approach is best accomplished through the use of defense-in-depth principles, but the traditional defense-in-depth approach will have to be expanded beyond on-premise security controls to distributed and federated ones that are agile enough to be implemented in many different types of cloud architectures.

Physical and Environmental Security
The first line of defense in an effective cloud security strategy is physical and environmental security. Data stored in the cloud can be just as secure, if not more, than data stored in customer data centers as reputable and well-established cloud providers will typically have greater dedicated resources and security solutions at their disposal than any single enterprise. Security mechanisms, ranging from robust authentication and access controls to disaster recovery, and their associated costs are distributed across multiple enterprises, resulting in capabilities that are usually too expensive to employ or manage for many enterprises.

Cloud providers also have the advantage of possessing many years of experience in designing and operating world class, large-scale data centers and because they have to win and maintain the confidence of their customers to maintain their business, they are highly motivated to avoid a security breach. However, none of this implies that enterprises should blindly accept any cloud provider's claims.

In addition to addressing personnel security issues, enterprises need to perform due diligence by looking for certifications and accreditations such as WebTrust/SysTrust, Statement on Accounting Standard 70 (SAS 70) and International Organization for Standardization (ISO), and verifying compliance with Sarbanes-Oxley (SOX), Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA), and the Payment Card Industry Data Security Standard (PCI DSS).

If you think that these certifications do not matter, think again. According to Verizon's "2009 Data Breach Investigations Report," 81 percent of the researched companies were not PCI compliant prior to being breached.

Hypervisor Security
When choosing a cloud provider, it is important to consider hypervisor security. In a public cloud, the customer is renting servers and the computing tasks are now being executed within the cloud provider's infrastructure. These virtual servers (or virtual machines) are actually guest instances running on a cloud provider's hypervisors. The hypervisor (also known as a virtual machine monitor) is software that controls the guest instances running on it. Anyone who exploits the hypervisor has all the proverbial keys to the kingdom and can modify or delete the customer data residing on the guest instances.

Customers will not have much control over the types of hypervisors their vendors will use, but it is important that they understand what security mechanisms and features are in place to secure the hypervisor layer. Proper implementation is crucial to hypervisor security as misconfiguration is one of the biggest security risks. Enterprises should understand hypervisor best practices and verify that cloud providers are incorporating them into their hypervisor solutions.

Operating System Security
In a virtualized environment, each operating system installed on an individual virtual machine (VM) needs to be hardened. Good operating system security boils down to three sets of practices:

  1. Server hardening
  2. Patch management
  3. Access control

Well-known hardening guides such as the DISA Security Technical Implementation Guides (STIGs) and Center for Internet Security (CIS) benchmarks can be used to effectively lock down operating system images.

By installing anti-virus software, and hardening and patching servers, the administrator protects instances against malware, keeps operating system patches current, removes all unused and unnecessary services, and ensures that only trusted parties may establish a connection to the operating system. Once an operating system image has been properly configured and hardened, the administrator can then develop a minimum security baseline and provision new, secure virtual machine images on demand. Fortunately, there are tools that can automatically assess and lock down systems.

Web Security
The defense-in-depth strategy must also secure the web tier. Administrators must prevent unauthorized users from gaining access to web resources. The first step is to protect web resources. If an unauthenticated user attempts to gain access to a protected web resource, the web container will automatically try to authenticate the user. Cloud customers should implement client certificate authentication mechanisms such as HTTPS for web resources.

Administrators can apply a wide range of best practices to secure web servers. A wise approach is to organize the safeguards you would like to implement and the settings that need to be configured into categories. Categories allow you to systematically walk through the hardening process using a checklist so that administrators can focus on individual categories and understand all the specific steps that are required to apply a particular countermeasure.

Most web server best practice guides incorporate the following:

  • Patches and updates
  • The lockdown of unnecessary ports
  • Protocols, and services
  • Account management
  • The proper securing of files and directories
  • The removal of all unnecessary file shares
  • Auditing and logging
  • The application of security policy settings
  • Application Security

Web applications are vulnerable to many different kinds of attacks (e.g., network eavesdropping, unauthorized access, and malware). To prevent eavesdropping, administrators can utilize strong authentication mechanisms (e.g., SSL with digital certificates) and secure communication channels (encrypting all traffic between the client, the application, and the database server).

Unauthorized access can be prevented by implementing firewall policies that block all traffic except authorized communication ports, disabling all unused services, limiting and periodically reviewing user membership to predefined administrative groups, restricting user access to administrative accounts created during product installation, practicing the principle of least privilege when granting permissions to new administration groups or roles, and restricting directory and file access. To mitigate the risks posed by malware, administrators should promptly apply the latest software patches, disable unused functionality, and run processes with least privileged accounts to reduce the scope of damage in the event of a compromise.

Of course, the best way to protect the application tier is to design and build secure web applications. Until recently, organizations merely talked about developing secure web applications, but the steady rise in the number and sophistication of cyber attacks over the years has forced IT professionals to move beyond mere talk. Fortunately, some real progress is being made. For example, (ISC)2 introduced a new certification last year called the Certified Secure Software Lifecycle Professional (CSSLP).

The CSSLP certification is designed to help developers understand government standards and best practices for secure software development so that security is considered and implemented throughout the entire software lifecycle. More and more security professionals are leveraging tools such as web application scanners to detect vulnerabilities and weak configuration settings. Most of the more established automated security tools offer a selection of security engines and vulnerability tests ranging from the OWASP Top 10 and ISO 27002 to HIPAA and SOX. Users can select modules or let automatic crawlers map a site's tree structure, and apply all of the selected policies' attacks from thousands of security checks.

Data Security
One of the biggest cloud computing concerns is data confidentiality. Data stored in the cloud has different privacy implications than data stored in an in-house data center. These are some questions that must be considered before storing data in the cloud:

  • What is the provider's privacy policy?
  • What are the terms of service?
  • Who owns the data? Who has access to the data?
  • How does the provider deal with subpoenas for customer data?
  • How many copies of the customer's data are kept and are they stored in different locations?
  • What are the provider's data and media sanitization methods?
  • When data is removed from the cloud, does the provider retain rights to customer information?
  • How is data isolated and separated from other customers' data?
  • Where is the data processed?
  • How does the provider protect customer data?

Many of the data confidentiality obstacles can be overcome by utilizing existing technologies and solutions. While it is important to encrypt network traffic, it is just as important to encrypt data at rest. It is wise to assume that all data in the cloud can be compromised. This means that network traffic, storage, and file systems must all be encrypted. Some other best practices for database security include using roles to simplify security administration, encapsulating privileges into stored procedures, using row-level access control to enforce security policies at a row level of granularity, and building web applications so that the application users are the database users.

Network Security
A network-based perimeter defense alone is not effective for the cloud, but network security is still a vital piece of the defense-in-depth strategy. Most cloud providers utilize VLANs to provide traffic isolation channels and will offer some level of protection against the most common types of external attacks such as distributed denial of service, man-in-the-middle attacks, IP spoofing, port scanning, and packet sniffing, but it is the enterprise's responsibility to implement additional layers of security.

Virtualization brings with it a host of new threat vectors that cannot be secured with traditional security tools and methods. An owner of one VM instance may launch attacks against adjacent VMs or hackers may try to install a rogue hypervisor that can take complete control of a server. To prevent these types of attacks, enterprises need to deploy virtual firewalls and virtual IDS/IPS solutions.

These security tools are designed to protect each VM instance and can even secure live migrations of VM instances. Some VM security solutions offer protection against SQL injection attacks, cross-site scripting, and other web application vulnerabilities and can monitor unauthorized or unexpected changes to operating system files and application files.

Auditing
The importance of audit event logging has never been greater as the threat of cybercrime continues to increase. Auditing takes on even more importance in the cloud due to the dynamic nature of virtual machines. A good auditing solution for the cloud will collect and integrate real-time information from all the major systems in a cloud environment and enable the customer to detect intrusions, data leaks, misuse, or insider threats. A robust, centralized auditing solution provides a clear and comprehensive picture of the customer's changing cloud environment and enables IT professionals to spot trends and quickly assess and resolve security incidents. Ensuring that a continuous monitoring solution is implemented that includes these capabilities in a scalable nature is essential to maintaining an effective security presence within the cloud.

Final Thoughts
Utilizing cloud computing brings with it many advantages that can improve application deployment, scalability, and flexibility while leveraging cost savings. While there are multiple concerns, security in the cloud does not present radically new challenges. With cloud computing, we have the convergence of virtualization, SOA, and distributed computing - concepts that have been around for some time. This does not mean that every application should be deployed to the public cloud. Cloud computing standards and guidelines need more time to mature. For now, more security-sensitive applications should probably remain in-house or move to a private cloud, but enterprises that are considering appropriate applications for the public cloud should know that they can develop an effective security strategy with the right blend of technology and processes that takes into account all layers of the cloud architecture.

Resources

More Stories By Peter Choi

Peter Choi is the cloud computing security lead for Apptis, Inc. He has over 9 years of experience in certification and accreditation, vulnerability management, security auditing, network engineering, and systems administration. Most recently, he spoke about cloud computing security at the 2009 Special Operations Forces Industry Conference and worked with FEMA to demonstrate that a cloud prototype could be certified and accredited.

Comments (2) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
sinosummer 08/12/09 09:24:46 PM EDT

as someone who had never heard about cloud computing before, i found peter choi's article to be both interesting and insightful. i look forward to learning more about this potentially-revolutionary technology.

liangtu 08/11/09 05:34:30 PM EDT

Great overview of some of the technical challenges organizations have to contend with in the cloud. It will be interesting to see how dramatic of an effect the GSA Storefront will have on the way the federal government manages IT services.

@BigDataExpo Stories
The essence of cloud computing is that all consumable IT resources are delivered as services. In his session at 15th Cloud Expo, Yung Chou, Technology Evangelist at Microsoft, demonstrated the concepts and implementations of two important cloud computing deliveries: Infrastructure as a Service (IaaS) and Platform as a Service (PaaS). He discussed from business and technical viewpoints what exactly they are, why we care, how they are different and in what ways, and the strategies for IT to transi...
SYS-CON Events announced today that Outlyer, a monitoring service for DevOps and operations teams, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Outlyer is a monitoring service for DevOps and Operations teams running Cloud, SaaS, Microservices and IoT deployments. Designed for today's dynamic environments that need beyond cloud-scale monitoring, we make monitoring effortless so you ...
My team embarked on building a data lake for our sales and marketing data to better understand customer journeys. This required building a hybrid data pipeline to connect our cloud CRM with the new Hadoop Data Lake. One challenge is that IT was not in a position to provide support until we proved value and marketing did not have the experience, so we embarked on the journey ourselves within the product marketing team for our line of business within Progress. In his session at @BigDataExpo, Sum...
Keeping pace with advancements in software delivery processes and tooling is taxing even for the most proficient organizations. Point tools, platforms, open source and the increasing adoption of private and public cloud services requires strong engineering rigor - all in the face of developer demands to use the tools of choice. As Agile has settled in as a mainstream practice, now DevOps has emerged as the next wave to improve software delivery speed and output. To make DevOps work, organization...
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
Apache Hadoop is emerging as a distributed platform for handling large and fast incoming streams of data. Predictive maintenance, supply chain optimization, and Internet-of-Things analysis are examples where Hadoop provides the scalable storage, processing, and analytics platform to gain meaningful insights from granular data that is typically only valuable from a large-scale, aggregate view. One architecture useful for capturing and analyzing streaming data is the Lambda Architecture, represent...
As organizations realize the scope of the Internet of Things, gaining key insights from Big Data, through the use of advanced analytics, becomes crucial. However, IoT also creates the need for petabyte scale storage of data from millions of devices. A new type of Storage is required which seamlessly integrates robust data analytics with massive scale. These storage systems will act as “smart systems” provide in-place analytics that speed discovery and enable businesses to quickly derive meaningf...
SYS-CON Events announced today that Ocean9will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Ocean9 provides cloud services for Backup, Disaster Recovery (DRaaS) and instant Innovation, and redefines enterprise infrastructure with its cloud native subscription offerings for mission critical SAP workloads.
The taxi industry never saw Uber coming. Startups are a threat to incumbents like never before, and a major enabler for startups is that they are instantly “cloud ready.” If innovation moves at the pace of IT, then your company is in trouble. Why? Because your data center will not keep up with frenetic pace AWS, Microsoft and Google are rolling out new capabilities In his session at 20th Cloud Expo, Don Browning, VP of Cloud Architecture at Turner, will posit that disruption is inevitable for c...
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
SYS-CON Events announced today that Conference Guru has been named “Media Sponsor” of SYS-CON's 20th International Cloud Expo, which will take place on June 6–8, 2017, at the Javits Center in New York City, NY. A valuable conference experience generates new contacts, sales leads, potential strategic partners and potential investors; helps gather competitive intelligence and even provides inspiration for new products and services. Conference Guru works with conference organizers to pass great dea...
SYS-CON Events announced today that Technologic Systems Inc., an embedded systems solutions company, will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Technologic Systems is an embedded systems company with headquarters in Fountain Hills, Arizona. They have been in business for 32 years, helping more than 8,000 OEM customers and building over a hundred COTS products that have never been discontinued. Technologic Systems’ pr...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend @CloudExpo | @ThingsExpo, June 6-8, 2017, at the Javits Center in New York City, NY and October 31 - November 2, 2017, Santa Clara Convention Center, CA. Learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
SYS-CON Events announced today that CA Technologies has been named “Platinum Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business – from apparel to energy – is being rewritten by software. From ...
Deep learning has been very successful in social sciences and specially areas where there is a lot of data. Trading is another field that can be viewed as social science with a lot of data. With the advent of Deep Learning and Big Data technologies for efficient computation, we are finally able to use the same methods in investment management as we would in face recognition or in making chat-bots. In his session at 20th Cloud Expo, Gaurav Chakravorty, co-founder and Head of Strategy Development ...
SYS-CON Events announced today that Loom Systems will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 2015, Loom Systems delivers an advanced AI solution to predict and prevent problems in the digital business. Loom stands alone in the industry as an AI analysis platform requiring no prior math knowledge from operators, leveraging the existing staff to succeed in the digital era. With offices in S...
SYS-CON Events announced today that Interoute, owner-operator of one of Europe's largest networks and a global cloud services platform, has been named “Bronze Sponsor” of SYS-CON's 20th Cloud Expo, which will take place on June 6-8, 2017 at the Javits Center in New York, New York. Interoute is the owner-operator of one of Europe's largest networks and a global cloud services platform which encompasses 12 data centers, 14 virtual data centers and 31 colocation centers, with connections to 195 add...
SYS-CON Events announced today that T-Mobile will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. As America's Un-carrier, T-Mobile US, Inc., is redefining the way consumers and businesses buy wireless services through leading product and service innovation. The Company's advanced nationwide 4G LTE network delivers outstanding wireless experiences to 67.4 million customers who are unwilling to compromise on ...
In his session at @ThingsExpo, Eric Lachapelle, CEO of the Professional Evaluation and Certification Board (PECB), will provide an overview of various initiatives to certifiy the security of connected devices and future trends in ensuring public trust of IoT. Eric Lachapelle is the Chief Executive Officer of the Professional Evaluation and Certification Board (PECB), an international certification body. His role is to help companies and individuals to achieve professional, accredited and worldw...
SYS-CON Events announced today that Juniper Networks (NYSE: JNPR), an industry leader in automated, scalable and secure networks, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Juniper Networks challenges the status quo with products, solutions and services that transform the economics of networking. The company co-innovates with customers and partners to deliver automated, scalable and secure network...