Welcome!

Machine Learning Authors: William Schmarzo, Ed Featherston, Liz McMillan, Elizabeth White, Dan Blacharski

Related Topics: @CloudExpo, Microservices Expo

@CloudExpo: Article

How to Develop an Effective Security Strategy to Play in the Public Cloud

Develop an effective security strategy with the right blend of technology and processes

Look all around and you can easily see that there is no shortage of press regarding the promises of cloud computing. Cloud evangelists have touted cloud computing as the next big thing, a game changer - a disruptive technology that will spark innovation and revolutionize the way businesses acquire and deliver IT services. The staggering volume of these sales pitches is to be expected, considering that cloud computing is at or near the peak of its hype cycle, but as with any new technology or model, reality will eventually set in and the public relations blitz will fade. As people continue to define cloud computing and debate its pros and cons, one thing is certain - one of the biggest obstacles to widespread cloud computing adoption will be security.

This article will deal with the security approach for the public cloud as opposed to a private, hybrid, or community cloud. The public cloud, as defined by the National Institute of Standards and Technology (NIST), is cloud infrastructure that is made available to the general public or a large industry group and is owned by an organization selling cloud services. An example of a public cloud implementation would be an application that is hosted in Amazon EC2. Anyone with a simple credit card would be able to deploy a software application in this type of environment.

Cloud Computing Styles
There are three major styles of cloud computing: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). IaaS is delivery of the computing infrastructure as a fully outsourced service versus an in-house, capital investment-sourced model. The consumer rents processing, storage, networking components, etc. With PaaS, consumers are given everything they need to develop, test, and deploy applications to the cloud. Finally, SaaS provides the consumer with the capability to use a cloud provider's applications running on a cloud infrastructure. The software application is accessed through a thin client interface such as a standard web browser. While many of the recommendations presented are applicable across all three cloud styles, the security approach described in this article is most applicable to IaaS.

Benefits of the Cloud
Before we dive into the security approach for the public cloud, let's briefly examine the potential benefits. Once you cut through all the hype, a closer look at the benefits of moving to the cloud reveals a strong business case. The cloud offers a pay-as-you-go model that is highly reliable and scalable, and gives you tremendous flexibility and agility to boot. The McKinsey study, "Clearing the Air on Cloud Computing," states that the average server utilization in a data center is 10 percent. Anyone who has ever run a data center knows how enormously difficult it is to achieve high reliability, efficiency, and scalability.

In the cloud, enterprises can greatly reduce their capital costs and no longer have to worry about allocating time and resources to maintaining infrastructure, and patching servers and software. As a result, IT personnel can work more efficiently which in turn, can breed more innovation and help enterprises enter new markets. In the cloud, applications are accessible anywhere and at any time so employees now have more mobility. The cloud provides nearly infinite computing power and storage to enterprises and users at a mere fraction of what it would cost to actually purchase and maintain these resources. This is a huge advantage for technology startups that have limited capital. The case for moving to the cloud becomes even stronger when you consider how the troubled economy is putting pressure on businesses to cut costs.

Although surveys differ on what percentage of companies will adopt cloud computing in the next 12-24 months, enterprises are already taking cloud computing seriously. In fact, according to a recent Forrester study, one out of four large companies plans to use a cloud provider soon, or has already employed one. Furthermore, Intel predicts that by 2012, an estimated 20 to 25 percent of its server chips will be dedicated toward cloud computing data centers.

Cloud Computing in the Private and Public Sectors
Anyone who has ever logged onto Facebook, Twitter, or Gmail or purchased an item from Amazon.com has either knowingly or unknowingly used a cloud-based application. There are numerous other examples of cloud computing implementations in the private sector, but it is also important to note that the public sector does not trail far behind.

Vivek Kundra, the federal CIO, is a big supporter of cloud computing. Under Kundra's leadership, the federal government has moved quickly on major cloud computing initiatives such as the General Services Administration (GSA) Storefront, an online store that will soon allow government agencies to easily procure cloud computing services. NIST has already released a working definition of cloud computing and is currently developing a Special Publication on cloud computing security.

In the defense sector, the Defense Information Systems Agency (DISA) has led the way with private cloud implementations such as Rapid Access Computing Environment (RACE) and Forge.mil. RACE gives DISA customers the ability to rent a basic computing environment. Customers purchase an environment on a monthly basis so the costs and risks of acquiring and sustaining a computing environment are significantly reduced. Forge.mil is essentially a mirror of SourceForge.net and allows developers to store and manage code for open source software projects.

Cloud Computing Security Risks
If the benefits are so clear, why isn't everyone adopting cloud computing right now? Research and polling indicate that the main obstacle is security. It probably comes as no surprise that the vast majority of surveys reveal security to be the number one concern of IT executives and CIOs who are considering cloud computing. Security within the cloud has received substantial press coverage, including publication of the Gartner top seven security risks associated with cloud computing, in a report entitled, "Assessing the Security Risks of Cloud Computing."

Earlier this year, a flaw in Google Docs led to the inadvertent sharing of some users' private documents with other users on the Internet without the owners' permission. There have been other highly publicized breaches and future incidents are inevitable.

Does this mean that the security risks of cloud computing outweigh its potential benefits?

Absolutely not, but customers must perform due diligence and practice due care. In addition to selecting a vendor that can comply with organizational security requirements, customers need to carefully plan and develop a defense-in-depth strategy that mitigates the security risks of cloud computing and addresses all layers of the cloud architecture.

Cloud Computing Security Approach
Given the highly distributed and federated nature of the cloud computing model and the constant threat of new attacks, the network-based perimeter defense strategy is clearly no longer adequate or relevant. Customers will now have to protect all the layers of the cloud architecture. To ensure the confidentiality, integrity, and availability of customer data, the security strategy for the cloud must address the following:

  • Physical and environmental security
  • Hypervisor security
  • Operating system security
  • The web tier
  • The application tier
  • The database tier
  • Network security
  • Auditing

The design of this approach is best accomplished through the use of defense-in-depth principles, but the traditional defense-in-depth approach will have to be expanded beyond on-premise security controls to distributed and federated ones that are agile enough to be implemented in many different types of cloud architectures.

Physical and Environmental Security
The first line of defense in an effective cloud security strategy is physical and environmental security. Data stored in the cloud can be just as secure, if not more, than data stored in customer data centers as reputable and well-established cloud providers will typically have greater dedicated resources and security solutions at their disposal than any single enterprise. Security mechanisms, ranging from robust authentication and access controls to disaster recovery, and their associated costs are distributed across multiple enterprises, resulting in capabilities that are usually too expensive to employ or manage for many enterprises.

Cloud providers also have the advantage of possessing many years of experience in designing and operating world class, large-scale data centers and because they have to win and maintain the confidence of their customers to maintain their business, they are highly motivated to avoid a security breach. However, none of this implies that enterprises should blindly accept any cloud provider's claims.

In addition to addressing personnel security issues, enterprises need to perform due diligence by looking for certifications and accreditations such as WebTrust/SysTrust, Statement on Accounting Standard 70 (SAS 70) and International Organization for Standardization (ISO), and verifying compliance with Sarbanes-Oxley (SOX), Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA), and the Payment Card Industry Data Security Standard (PCI DSS).

If you think that these certifications do not matter, think again. According to Verizon's "2009 Data Breach Investigations Report," 81 percent of the researched companies were not PCI compliant prior to being breached.

Hypervisor Security
When choosing a cloud provider, it is important to consider hypervisor security. In a public cloud, the customer is renting servers and the computing tasks are now being executed within the cloud provider's infrastructure. These virtual servers (or virtual machines) are actually guest instances running on a cloud provider's hypervisors. The hypervisor (also known as a virtual machine monitor) is software that controls the guest instances running on it. Anyone who exploits the hypervisor has all the proverbial keys to the kingdom and can modify or delete the customer data residing on the guest instances.

Customers will not have much control over the types of hypervisors their vendors will use, but it is important that they understand what security mechanisms and features are in place to secure the hypervisor layer. Proper implementation is crucial to hypervisor security as misconfiguration is one of the biggest security risks. Enterprises should understand hypervisor best practices and verify that cloud providers are incorporating them into their hypervisor solutions.

Operating System Security
In a virtualized environment, each operating system installed on an individual virtual machine (VM) needs to be hardened. Good operating system security boils down to three sets of practices:

  1. Server hardening
  2. Patch management
  3. Access control

Well-known hardening guides such as the DISA Security Technical Implementation Guides (STIGs) and Center for Internet Security (CIS) benchmarks can be used to effectively lock down operating system images.

By installing anti-virus software, and hardening and patching servers, the administrator protects instances against malware, keeps operating system patches current, removes all unused and unnecessary services, and ensures that only trusted parties may establish a connection to the operating system. Once an operating system image has been properly configured and hardened, the administrator can then develop a minimum security baseline and provision new, secure virtual machine images on demand. Fortunately, there are tools that can automatically assess and lock down systems.

Web Security
The defense-in-depth strategy must also secure the web tier. Administrators must prevent unauthorized users from gaining access to web resources. The first step is to protect web resources. If an unauthenticated user attempts to gain access to a protected web resource, the web container will automatically try to authenticate the user. Cloud customers should implement client certificate authentication mechanisms such as HTTPS for web resources.

Administrators can apply a wide range of best practices to secure web servers. A wise approach is to organize the safeguards you would like to implement and the settings that need to be configured into categories. Categories allow you to systematically walk through the hardening process using a checklist so that administrators can focus on individual categories and understand all the specific steps that are required to apply a particular countermeasure.

Most web server best practice guides incorporate the following:

  • Patches and updates
  • The lockdown of unnecessary ports
  • Protocols, and services
  • Account management
  • The proper securing of files and directories
  • The removal of all unnecessary file shares
  • Auditing and logging
  • The application of security policy settings
  • Application Security

Web applications are vulnerable to many different kinds of attacks (e.g., network eavesdropping, unauthorized access, and malware). To prevent eavesdropping, administrators can utilize strong authentication mechanisms (e.g., SSL with digital certificates) and secure communication channels (encrypting all traffic between the client, the application, and the database server).

Unauthorized access can be prevented by implementing firewall policies that block all traffic except authorized communication ports, disabling all unused services, limiting and periodically reviewing user membership to predefined administrative groups, restricting user access to administrative accounts created during product installation, practicing the principle of least privilege when granting permissions to new administration groups or roles, and restricting directory and file access. To mitigate the risks posed by malware, administrators should promptly apply the latest software patches, disable unused functionality, and run processes with least privileged accounts to reduce the scope of damage in the event of a compromise.

Of course, the best way to protect the application tier is to design and build secure web applications. Until recently, organizations merely talked about developing secure web applications, but the steady rise in the number and sophistication of cyber attacks over the years has forced IT professionals to move beyond mere talk. Fortunately, some real progress is being made. For example, (ISC)2 introduced a new certification last year called the Certified Secure Software Lifecycle Professional (CSSLP).

The CSSLP certification is designed to help developers understand government standards and best practices for secure software development so that security is considered and implemented throughout the entire software lifecycle. More and more security professionals are leveraging tools such as web application scanners to detect vulnerabilities and weak configuration settings. Most of the more established automated security tools offer a selection of security engines and vulnerability tests ranging from the OWASP Top 10 and ISO 27002 to HIPAA and SOX. Users can select modules or let automatic crawlers map a site's tree structure, and apply all of the selected policies' attacks from thousands of security checks.

Data Security
One of the biggest cloud computing concerns is data confidentiality. Data stored in the cloud has different privacy implications than data stored in an in-house data center. These are some questions that must be considered before storing data in the cloud:

  • What is the provider's privacy policy?
  • What are the terms of service?
  • Who owns the data? Who has access to the data?
  • How does the provider deal with subpoenas for customer data?
  • How many copies of the customer's data are kept and are they stored in different locations?
  • What are the provider's data and media sanitization methods?
  • When data is removed from the cloud, does the provider retain rights to customer information?
  • How is data isolated and separated from other customers' data?
  • Where is the data processed?
  • How does the provider protect customer data?

Many of the data confidentiality obstacles can be overcome by utilizing existing technologies and solutions. While it is important to encrypt network traffic, it is just as important to encrypt data at rest. It is wise to assume that all data in the cloud can be compromised. This means that network traffic, storage, and file systems must all be encrypted. Some other best practices for database security include using roles to simplify security administration, encapsulating privileges into stored procedures, using row-level access control to enforce security policies at a row level of granularity, and building web applications so that the application users are the database users.

Network Security
A network-based perimeter defense alone is not effective for the cloud, but network security is still a vital piece of the defense-in-depth strategy. Most cloud providers utilize VLANs to provide traffic isolation channels and will offer some level of protection against the most common types of external attacks such as distributed denial of service, man-in-the-middle attacks, IP spoofing, port scanning, and packet sniffing, but it is the enterprise's responsibility to implement additional layers of security.

Virtualization brings with it a host of new threat vectors that cannot be secured with traditional security tools and methods. An owner of one VM instance may launch attacks against adjacent VMs or hackers may try to install a rogue hypervisor that can take complete control of a server. To prevent these types of attacks, enterprises need to deploy virtual firewalls and virtual IDS/IPS solutions.

These security tools are designed to protect each VM instance and can even secure live migrations of VM instances. Some VM security solutions offer protection against SQL injection attacks, cross-site scripting, and other web application vulnerabilities and can monitor unauthorized or unexpected changes to operating system files and application files.

Auditing
The importance of audit event logging has never been greater as the threat of cybercrime continues to increase. Auditing takes on even more importance in the cloud due to the dynamic nature of virtual machines. A good auditing solution for the cloud will collect and integrate real-time information from all the major systems in a cloud environment and enable the customer to detect intrusions, data leaks, misuse, or insider threats. A robust, centralized auditing solution provides a clear and comprehensive picture of the customer's changing cloud environment and enables IT professionals to spot trends and quickly assess and resolve security incidents. Ensuring that a continuous monitoring solution is implemented that includes these capabilities in a scalable nature is essential to maintaining an effective security presence within the cloud.

Final Thoughts
Utilizing cloud computing brings with it many advantages that can improve application deployment, scalability, and flexibility while leveraging cost savings. While there are multiple concerns, security in the cloud does not present radically new challenges. With cloud computing, we have the convergence of virtualization, SOA, and distributed computing - concepts that have been around for some time. This does not mean that every application should be deployed to the public cloud. Cloud computing standards and guidelines need more time to mature. For now, more security-sensitive applications should probably remain in-house or move to a private cloud, but enterprises that are considering appropriate applications for the public cloud should know that they can develop an effective security strategy with the right blend of technology and processes that takes into account all layers of the cloud architecture.

Resources

More Stories By Peter Choi

Peter Choi is the cloud computing security lead for Apptis, Inc. He has over 9 years of experience in certification and accreditation, vulnerability management, security auditing, network engineering, and systems administration. Most recently, he spoke about cloud computing security at the 2009 Special Operations Forces Industry Conference and worked with FEMA to demonstrate that a cloud prototype could be certified and accredited.

Comments (2)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@CloudExpo Stories
"Storpool does only block-level storage so we do one thing extremely well. The growth in data is what drives the move to software-defined technologies in general and software-defined storage," explained Boyan Ivanov, CEO and co-founder at StorPool, in this SYS-CON.tv interview at 16th Cloud Expo, held June 9-11, 2015, at the Javits Center in New York City.
Sometimes I write a blog just to formulate and organize a point of view, and I think it’s time that I pull together the bounty of excellent information about Machine Learning. This is a topic with which business leaders must become comfortable, especially tomorrow’s business leaders (tip for my next semester University of San Francisco business students!). Machine learning is a key capability that will help organizations drive optimization and monetization opportunities, and there have been some...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory? In her Day 2 Keynote at @DevOpsSummit at 21st Cloud Expo, Aruna Ravichandran, VP, DevOps Solutions Marketing, CA Technologies, was jo...
As Marc Andreessen says software is eating the world. Everything is rapidly moving toward being software-defined – from our phones and cars through our washing machines to the datacenter. However, there are larger challenges when implementing software defined on a larger scale - when building software defined infrastructure. In his session at 16th Cloud Expo, Boyan Ivanov, CEO of StorPool, provided some practical insights on what, how and why when implementing "software-defined" in the datacent...
Blockchain. A day doesn’t seem to go by without seeing articles and discussions about the technology. According to PwC executive Seamus Cushley, approximately $1.4B has been invested in blockchain just last year. In Gartner’s recent hype cycle for emerging technologies, blockchain is approaching the peak. It is considered by Gartner as one of the ‘Key platform-enabling technologies to track.’ While there is a lot of ‘hype vs reality’ discussions going on, there is no arguing that blockchain is b...
Blockchain is a shared, secure record of exchange that establishes trust, accountability and transparency across business networks. Supported by the Linux Foundation's open source, open-standards based Hyperledger Project, Blockchain has the potential to improve regulatory compliance, reduce cost as well as advance trade. Are you curious about how Blockchain is built for business? In her session at 21st Cloud Expo, René Bostic, Technical VP of the IBM Cloud Unit in North America, discussed the b...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You’re looking at private cloud solutions based on hyperconverged infrastructure, but you’re concerned with the limits inherent in those technologies.
Is advanced scheduling in Kubernetes achievable?Yes, however, how do you properly accommodate every real-life scenario that a Kubernetes user might encounter? How do you leverage advanced scheduling techniques to shape and describe each scenario in easy-to-use rules and configurations? In his session at @DevOpsSummit at 21st Cloud Expo, Oleg Chunikhin, CTO at Kublr, answered these questions and demonstrated techniques for implementing advanced scheduling. For example, using spot instances and co...
The use of containers by developers -- and now increasingly IT operators -- has grown from infatuation to deep and abiding love. But as with any long-term affair, the honeymoon soon leads to needing to live well together ... and maybe even getting some relationship help along the way. And so it goes with container orchestration and automation solutions, which are rapidly emerging as the means to maintain the bliss between rapid container adoption and broad container use among multiple cloud host...
The cloud era has reached the stage where it is no longer a question of whether a company should migrate, but when. Enterprises have embraced the outsourcing of where their various applications are stored and who manages them, saving significant investment along the way. Plus, the cloud has become a defining competitive edge. Companies that fail to successfully adapt risk failure. The media, of course, continues to extol the virtues of the cloud, including how easy it is to get there. Migrating...
Imagine if you will, a retail floor so densely packed with sensors that they can pick up the movements of insects scurrying across a store aisle. Or a component of a piece of factory equipment so well-instrumented that its digital twin provides resolution down to the micrometer.
The need for greater agility and scalability necessitated the digital transformation in the form of following equation: monolithic to microservices to serverless architecture (FaaS). To keep up with the cut-throat competition, the organisations need to update their technology stack to make software development their differentiating factor. Thus microservices architecture emerged as a potential method to provide development teams with greater flexibility and other advantages, such as the abili...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settle...
Product connectivity goes hand and hand these days with increased use of personal data. New IoT devices are becoming more personalized than ever before. In his session at 22nd Cloud Expo | DXWorld Expo, Nicolas Fierro, CEO of MIMIR Blockchain Solutions, will discuss how in order to protect your data and privacy, IoT applications need to embrace Blockchain technology for a new level of product security never before seen - or needed.
Leading companies, from the Global Fortune 500 to the smallest companies, are adopting hybrid cloud as the path to business advantage. Hybrid cloud depends on cloud services and on-premises infrastructure working in unison. Successful implementations require new levels of data mobility, enabled by an automated and seamless flow across on-premises and cloud resources. In his general session at 21st Cloud Expo, Greg Tevis, an IBM Storage Software Technical Strategist and Customer Solution Architec...
Nordstrom is transforming the way that they do business and the cloud is the key to enabling speed and hyper personalized customer experiences. In his session at 21st Cloud Expo, Ken Schow, VP of Engineering at Nordstrom, discussed some of the key learnings and common pitfalls of large enterprises moving to the cloud. This includes strategies around choosing a cloud provider(s), architecture, and lessons learned. In addition, he covered some of the best practices for structured team migration an...
In his general session at 21st Cloud Expo, Greg Dumas, Calligo’s Vice President and G.M. of US operations, discussed the new Global Data Protection Regulation and how Calligo can help business stay compliant in digitally globalized world. Greg Dumas is Calligo's Vice President and G.M. of US operations. Calligo is an established service provider that provides an innovative platform for trusted cloud solutions. Calligo’s customers are typically most concerned about GDPR compliance, application p...
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, discussed how from store operations and ...
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intelligence and B...