Information Security Advisor

Transcription

1 Information Security Advisor June 2015 The Cloud is Not Yours What It Is (and Isn t). Where It Is (and Isn t). And Why YOU Should Care. + What the Cloud Looks Like + Delete Doesn t Always Mean Delete + Your Questions Answered! Good security comes from timely response. Report security incidents immediately!

2 The Cloud is Not Yours We hear the term used a lot but many still don t truly understand what is meant by the cloud. A simple explanation: the cloud is someone else s computer. It s not yours. And that is exactly why there is so much debate about security in the cloud. Let s say you took your most sensitive personal files from your computer, laptop or device, and copied them all to your friend s computer. Now, your friend has access to all of your files. Even though you can access them whenever you want to, you have essentially lost control of those files. Do you totally, absolutely trust your friend to protect your personal information? Does your friend care about your data s security or your privacy as much as you do? If the data gets leaked, would you be harmed in any way? Would your friend? This situation comes down to trust and how much trust you have in your friend. It s similar with the cloud. Do you (and can you) trust it with YOUR STUFF? Cloud computing is often far more secure than traditional computing because companies like Google and Amazon can attract and retain cyber security personnel of a higher quality than many governmental agencies. - Vivek Kundra Executive Vice President, Security and Pop Culture: A Cloud Nightmare Last year a movie came out starring Cameron Diaz and Jason Segel in which a couple loans some personal idevices to family and friends, like the very generous people that they are. But then they decide to make a very private video of themselves on their ipad at home. Afterwards, instead of deleting the video, Segel s character accidentally syncs the video to the rest of their devices - which have all been loaned out. See where this is headed? What a nightmare! At one point in the movie, Segel s character laments, It went up to the cloud! No one understands the cloud! Take some time to understand the cloud because it can be a fantastic tool. However, if you don t know how it works or don t know what it s syncing to, you should learn where your data is and what s happening to it. It s also a good idea not to enable auto sync. As the user, you want to maintain as much control as possible over your devices and any data storage you use. Don t give the cloud permission to have a mind of its own. Be in control. For more examples of security lessons found in pop culture: But What IS the Cloud? We ve heard it on TV, in the news, in movies and it appears to have become part of our everyday lives. The cloud. But what is the cloud, really? In reality, the cloud is hundreds of thousands of massive global data centers (computers/ servers). When you make a call or send a text. The cloud. When you use SalesForce or BaseCamp. The cloud. Shopping on Amazon, Etsy, Groupon. The cloud. Learning languages with DuoLingo. The cloud. Using Adobe, Microsoft, Skype. The cloud. Backing up your mobile device. The cloud. Watching Netflix, Hulu or YouTube. The cloud. Note-taking in Evernote or OneNote. The cloud. Twitter. Facebook. Weibo. VKontakte. The cloud. Online classes and e-learning. The cloud.

3 What Does the Cloud Look Like? The media s poor interpretation of the cloud can be very misleading. The cloud is not your friend s computer. It s not a giant hard drive in the sky. A) Google data center with 417,600 servers. B) Inside an Amazon data center. C) Bahnhof s data center in Sweden. D) Inside a Facebook data center. Just remember that the cloud is no cloud at all. It s actually a very physical, tangible thing. And while it s not magical, it IS immeasurable in size and scope! The cloud is made up of millions of data centers around the world. Many of them are built in colder climates to keep power costs low and maintain a greener footprint. The largest ones are operated by Google, Amazon, IBM, Rackspace, Apple and Microsoft, to name but a few of the big guys. The numbers are staggering. To make the cloud useful, the millions of data centers must be connected to billions of people and tens of billions of computers, phones, devices and the internet of things! Billions! So how is it all connected? 300 superhigh bandwidth submarine (underwater) cables make up the nearly 600,000 mile long backbone and foundation of the internet. These cables move an estimated 95% of the world s data traffic a truly unimaginable amount every single second. Between 2009 and 2014, global undersea communications have increased almost 8 times. That s an 800% increase, and there is no end in sight. A C B D This map from shows the backbone of the internet, a global infrastructure of underwater cables. For a larger, fullresolution version of this map, check out: FAST FACTS > Cloud is only rocket science if you re NASA and using the cloud for rocket science. Else, for the rest of us, it s an awesome platform upon which we leverage various opportunities to improve the way in which we think about and implement the practices and technology needed to secure the things that matter most to us. - Chris Hoff, Security Strategist & founding member of Cloud Security Alliance > In a survey of 930 IT professionals, 82% reported using a multi-cloud strategy, relying on both public and private clouds. > Enterprises predict they will increase spending on CLOUD COMPUTING in 2015 by 42%

4 Two Types of Clouds The Private Cloud Many organizations have their own data center or private cloud. It could be located in one campus or it could be distributed to accommodate multiple sites, especially if those sites are separated by great distances. servers, intranet features such as SharePoint, and custom business applications are often maintained by the company itself. Generally, but not always, companies want to protect their crown jewels with their own staff on their own premises. This way they have complete control over the security of the data in storage AND control over what s coming in and going out. Technically, it doesn t matter where a data center is (within reason). However, with security, privacy and compliance issues at hand, the data center should offer comparable levels of security for when the data is in transit and at rest or being stored. Even with a private cloud facility, high levels of physical security must be maintained. Some facilities use badges for access; others employ mantraps for higher levels of physical control. A mantrap is a physical security access control made up of 2 doors. The first set of doors must close before the second can open. The Public Cloud Everything that isn t privately controlled by an individual organization is the public cloud. Everything. Google Drive, Amazon, Dropbox, Flickr, icloud, OneDrive. These are ALL public clouds. Many company services, like SalesForce, offer both types of cloud accounts. One account that allows the company to retain control over the data by allowing it to host both the software and the services in their private cloud, and another where the service itself provides cloud storage and access. Microsoft, Adobe, Dropbox and thousands of other companies provide not only software services, but also the data center or the company s piece of a public cloud. This can make things easier, especially for smaller companies who don t have IT departments and don t want the expense and complexity of building their own costly private cloud or data center. There are certainly a number of security concerns regarding the cloud. Many experts worry about companies and users lack of control over their own data. In many ways, once we upload files to the cloud, we re sort of helpless in the sense that we ve lost some basic control over that data. For a moment, let s strip away the technobabble and look at the cloud from a different viewpoint. The cloud is where we work and play. Facebook, YouTube, LinkedIn and all social media platforms are in the cloud. The cloud is where we, personally or professionally, collaborate with millions of people in over 200 countries. The cloud has knocked down barriers to finding and sharing common interests for business, for education and entertainment. The cloud has made the world smaller. The internet of things is merging our home appliances with our mobile appliances think smart cars and smart fridges! and combining our personal security services and family safety through the public cloud. It offers a wonderful world of convenience and collaboration. But remember that the cloud isn t magic. It s people trusting businesses with data, so we all need to maintain a heightened sense of security awareness when dealing with cloud-based applications and services.

5 Q A & I m nervous to put trust in all of these social media sites and cloud services such as Gmail, Flickr & Dropbox. Can I trust the cloud? Is it actually secure? 100% security does not exist, period. It never will. All we can do is be aware of the risks, potential weaknesses, and repercussions. From that we must make informed decisions and behave in a secure manner. Use common sense and think before acting. There s an old joke that goes like this: The only secure computer is one that is turned off, plugged into nothing at all, entombed in concrete and dumped into an ocean. Then maybe the data is secure. Should I be worried about the number of data breaches we see in the news? Massive data breaches, involving tens of millions of records and exposing highly sensitive personal data make the cloud seem to be the most unsecure place you could ever store anything. This interactive chart (A) is a brief history of the biggest data breaches to date. Does this mean you can t trust the cloud? Caution is the operative word here, but when you do business with any large company, your data (or some portion of it) is stored in the cloud. Their cloud. So there is always an element of risk. Some people (B) think 2015 is the year the cloud will burst! (A) (B) Interactive Data Breach Chart The Year the Cloud Bursts There are so many acronyms out there nowadays, I can t keep them all straight. What are SaaS and NaaS? The cloud, of course! So is PaaS and IaaS. The common theme with all of these acronyms is aas. It means as a Service and they are all based in the cloud. NaaS = Network as a Service (such as a VPN) SaaS = Software as a Service (such as Google Apps or Cisco WebEx) PaaS = Platform as a Service (such as Google App Engine) IaaS = Infrastructure as a Service (such as Amazon Web Services)

6 Delete Doesn t Always Mean Delete We must remember that everything on the internet is forever. Even if you delete embarrassing or risqué photos from your phone or tablet, they are still around somewhere. When you back up your mobile devices, the data gets automatically copied onto a company s servers - perhaps in the US, perhaps in Iceland, maybe somewhere else in Europe. You just don t always know where your data is being stored. Deleting a file in the cloud does not always mean that file is deleted permanently. A copy of it probably still resides on a server somewhere. First of all, with workrelated computing and communications, know and follow all company policies when using your devices and the cloud. And with your personal devices and interactions with the internet, before you take that picture, do a few things: Remember last year s celebrity photo leak? Mary Elizabeth Winstead, one of the actresses who had her private photos leaked said, Knowing those photos were deleted long ago, I can only imagine the creepy effort that went into this. Creepiness aside, the real question is: were the photos actually gone? She may have deleted them from her device, but they were still backed up on a server somewhere in the cloud. Know your device settings. If you want everything backed up, fine; but be aware that there is a risk involved. Know your options. Third-party software can help you backup locally instead of the cloud, so make an informed choice. When in doubt, ask. The cloud can be confusing, even to the most computer savvy users. Cloud is about how you do computing, not where you do computing. - Paul Maritz, Pivotal CEO Final Cloud Advice Keep in mind: entering an American Social Security Number or any National Health or Identification Number is, in many cases, not required. WHEN IN DOUBT, ASK! The privacy laws are more stringent in Canada, the EU and other countries than in the US. Make sure you know the rules for the country you live in. IF YOU SUSPECT A DATA BREACH, REPORT IT IMMEDIATELY! Here at work, if you suspect that any of our sensitive information, from customer to employee data, has been compromised, stop what you are doing and report it. KNOW HOW TO REPORT A POTENTIAL SECURITY INCIDENT! DON T DELAY! If your details are part of a breach, do some research and know your rights. Make sure you know whether your mobile files are being synced automatically. (We recommend turning this off!) Give out as little information as you can. Telling too much is a security event waiting to happen. Keep your secrets a secret. Stay alert to breaches by being security aware. Pick a couple of security media feeds to monitor and stay informed.