Cloud Computing and Attacks

Transcription

1 Cloud Computing and Attacks Joseph Spring School of Computer Science 7COM Distributed Systems Security 1

2 Areas for Discussion Cloud Computing Attacks Firewalls 2

3 Cloud Computing A Cloud is a large pool of easily accessible virtualised resources (such as hardware, development platforms and/or services). These resources can be dynamically reconfigured to adjust to variable load (scale), allowing for optimum resource utilisation. The pool of resources is typically exploited by a pay per use model in which guarantees are offered by the infrastructure provider by means of customised service level agreements (Vaquero et al, 2009) 3

4 Cloud Computing Characteristics Cloud Computing is said to have the following characteristics: Resource Pooling The providers resources are pooled and shared between multiple customers Broad Network Access These resources are accessible through standard network protocols over the network Rapid Elasticity In a matter of minutes resources may be provisioned tpo scale out and released to scale in Measured Service The provider measures and generally charges for usage of CPU, memeory, disk, network bandwidth. Or other resources On Demand Self Service Resources may be provisioned via automated mechanisms (Booth, Soknacki and Somayaji, 2013) 4

5 Cloud Computing Characteristics Characteristics also include: Shared Infrastructure Cloud environment uses an effective software model that allows sharing of physical services, storage and networking capabilities among users. Cloud infrastructure optimises available infrastructure across multiple users Network Access Cloud services are accessed over a network from a wide range of devices such as PC s, laptops and mobile devices by using standard API s Handle Metering Cloud service providers store information of their clients for managing and optimising the service and to provide reporting and billing information. Customers are charged according to their use (Malik and Nazir, 2012) 5

6 Service Models SAAS Software as a Service Application service or Software as a Service delivers software over the internet, simplifying support and maintenance. Provider installs and operates application software on a cloud infrastructure. Clients may access the software using service specific client software or a generic web browser interface SAAS providers are often consumers of IAAS Example: Dropbox, Netflix, Google Search engine, Facebook, (Booth, Soknacki and Somayaji, 2013) 6

7 Service Models PAAS Platform as a Service Consumer has access to computational platforms including operating systems, programming language execution environments, databases, web servers, Combined services mainly used by developers who use platform to run and test software solutions on a cloud infrastructure without overhead of maintaining underlying software or hardware Examples: Google App Engine, Amazon Web Services Elastic Beanstalk,.. (Booth, Soknacki and Somayaji, 2013) 7

8 Service Models IAAS Infrastructure as a Service The most basic service model for delivering cloud capabilities Consumer is given access to processing, storage, networks, and other resources necessary to run and/or deploy arbitrary software in a form that is close to having on demand access to an arbitrary number of network connected servers. An arbitrary number of virtual servers are multiplexed onto the providers fixed number of physical hosts, generally using virtual machines (VM s) running on hypervisors (A hypervisor or virtual machine monitor (VMM) is a piece of computer software, firmware or hardware that creates and runs virtual machines.). Wiki 8

9 Service Models IAAS Infrastructure as a Service Examples: Amazon s Elastic Compute Cloud (EC2) service, in which consumer has access to EC2 instance (a VM) for a period of time to be used as a resource for consumers wishes Amazons S3 Service in which consumer is given access to low latency data storage that is accessible from any location via the internet (Booth, Soknacki and Somayaji, 2013) 9

10 Cloud Computing Models Public Cloud Intended for the general public where resources, web applications, web services are provided over the internet Where any user can obtain services from the cloud Public organisations assist in providing the required infrastructure (Qaiser 2012) 10

11 Cloud Computing Models Private Cloud Used by organisations internally. Intended for single organisations Anyone within the organisation can access data, services and web applications Users outside of the organisation cannot access the private cloud Infrastructure and corporate data managed and maintained by the organisation itself (Qaiser 2012) 11

12 Cloud Computing Models (Qaiser 2012) Hybrid Cloud A combination of two or more clouds (public, private and community) An environment in which multiple internal or external suppliers of cloud services are used Reported as being used by many organisations e.g. IBM, Junipers Network (2009) Community Cloud A mixture of one or more public, private or hybrid clouds shared by many organisations within a specific community for a single purpose security with common security, compliance objectives 12

13 A Selection of Network Attacks Denial Of Service Man in the Middle Network Sniffing Port Scanning SQL Injection Attack Cross Site Scripting (Qaiser 2012) 13

14 Cloud Computing A Selection of Attacks Denial of Service (Jamil and Zaki, 2011) Breach of Confidentiality Booth, (Soknacki and Somayaji, 2013) Authentication Attack Browser Security (Jamil and Zaki, 2011) Cloud Malware Injection Attack (Jamil and Zaki, 2011) Side Channel Attack XML Signature Element Wrapping (Jamil and Zaki, 2011) Data Protection (Soknacki and Somayaji, 2013) Incomplete Data Deletion Lock in Insider Attack 14

15 References Booth G., Soknacki A. and Somayaji A., Cloud Security: Attacks and Current Defences, 8 th Annual Symposium on Information Assurance, (Asia 13) June 4-5, 2013, Albany, NY. Coulouris, Dollimore, Kindberg & Blair: Distributed Systems Concepts and Design, Addison Wesley, 2012 Jamil D., and Zaki H., Security Issues in Cloud Computing and Countermeasures, International Journal of Science and Technology, 3, (4), pp , Mel P., Grance T., The NIST definition of Cloud Computing, NIST Special Publication, , September 2011 Malik A., Nazir M., Security Framework for Cloud Computing Environment: A Review, Journal of Emerging Trends in Computing and Information Sciences, 3, (3), March 2012 Qaiser S., Cloud Computing: Network/Security Threats and Countermeasures, Interdisciplinary Journal of Contemporary Research in Business, 3, (9), pp Silberschatz, Galvin & Gagne: Operating System Concepts, Wiley, 2012 Stallings: Cryptography and Network Security, Prentice Hall, 2014 Tanenbaum & van Steen: Distributed Systems, Prentice Hall, 2014 Vacquero L. M., Rodero-Merino L., Caceres J., Lindner M., A Break in the Clouds: Towards a Cloud Definition, ACM SIGCOMM Comput Commun, 39, (1), pp