Cloud Computing TODAY S TOPICS WHAT IS CLOUD COMPUTING? ICAC Webinar Cloud Computing September 4, What Cloud Computing is and How it Works

Transcription

1 Cloud Computing TODAY S TOPICS What Cloud Computing is and How it Works Security & Privacy Issues Investigative Challenges WHAT IS CLOUD COMPUTING? Cloud computing refers to software or processes offered over the Internet as opposed to the user s computer Popular examples: Photo sharing File backup 1

2 WHY CLOUD COMPUTING? The name comes from the use of a cloud-shaped symbol as an abstract diagram for the process WHAT IS NOT CLOUD COMPUTING? Files stored internally on your computer Accessing a simple HTML website CLOUD COMPUTING BENEFITS Reduced Cost Device and Location Independence Easier Maintenance 2

3 EXAMPLE OF BENEFIT If not in the cloud, every business and individual would have to install their own server software on their computer Out-sourcing services like Frees up internal resources Cheaper for one company to handle millions than for each company to do their own Allows pooling and sharing of resources automatic deployment of new security techniques THE BIG PICTURE For many businesses, governments, and individuals, the use of cloud computing just makes sense AND It is growing in popularity, which makes it important to learn and understand However, a downside exists Security and privacy issues Data release to a third party CLASSIFICATIONS Deployment Models Public Community Hybrid Private Service Models Infrastructure Platform Software Many others 3

4 DEPLOYMENT MODELS Many models for the cloud exist Public Available to general public Often free Access exclusively via the Internet Private Solely for one individual organization May operate internally or by a third party Keeps others out of the system, but lacks the benefits of shared resources DEPLOYMENT MODELS Community Not open to public, but shared by several related organizations with common needs Costs shared over fewer users than public clouds, but can be more secure Hybrid Combine public, community, and/or private clouds Utilizes internal and external resources PUBLIC MODEL 4

5 PRIVATE MODEL COMMUNITY MODEL HYBRID MODEL 5

6 SERVICE MODELS Software as a Service (SaaS) Programs accessed in the cloud and maintained there Examples: Microsoft Office 360, Google Apps, QuickBooks, , Games Cloudtweaks.com SERVICE MODELS Platform as a Service (PaaS) The cloud provides an environment for an organization to work Examples: Operating Systems, Web Server SERVICE MODELS Infrastructure as a Service (IaaS) Enhances security, capacity, memory, or similar without requiring user to physically buy newer, larger, more powerful computers Examples Firewalls Intensive data processing File storage 6

7 SERVICE MODELS Many newer models, including: Storage as a service (STaaS) Security as a service (SECaaS) Data as a service (DaaS) Desktop as a service (DaaS) API as a service (APIaaS) SERVICE MODELS To think of it a different way, cloud computing has two categories of shared resources: Software Hardware SOFTWARE AS A SERVICE EXAMPLE Business in Tokyo Installed on Google s Servers Individual in New York 7

8 PLATFORM AS A SERVICE EXAMPLE Installed on Microsoft s Servers INFRASTRUCTURE AS A SERVICE EXAMPLE WHO HOSTS THE CLOUD? Many companies are competing for your business in the cloud Amazon Web Services was one of the first on the market (doing so in 2002) Hosts everything you ve seen here and more IBM and Cisco also have significant shares of the market 8

9 QUIZ If a person wants to sign up for a Gmail account, which model are they using? A. Hybrid B. Public C. Community D. Private QUIZ Processing power can be acquired through which cloud service model? A. Software as a Service B. Platform as a Service C. Processing as a Service D. Infrastructure as a Service PUBLIC CLOUD SERVICES Many public cloud services are available, often at no cost to the user, including: File storage Photo sharing Password managers Operating systems Mobile phone services 9

10 FILE STORAGE Box Dropbox Google Drive Backup Carbonite Mozy Norton Online Backup FILE STORAGE EXAMPLE: GOOGLE DRIVE Acts like a folder on your computer(s), and allows file access through your online account 5GB of storage free 1 Terabyte (enough for a 3-month long video) available for $50/month Allows file sharing and group editing FILE STORAGE EXAMPLE: GOOGLE DRIVE 10

11 PHOTO SHARING Allows user to sync all photos and videos from their computer and smartphone to their cloud account Files can then be shared with others as you choose Many allow online editing as well, making them both SaaS and IaaS PHOTO SHARING EXAMPLES: Flickr Picasa Web Albums Photobucket Facebook Shutterfly PASSWORD MANAGERS Many services allow users to save all of their passwords in one central account online May allow password sharing with others 11

12 OPERATING SYSTEMS Computers run an entire operating system from a cloud server User never has to install updates Makes installing applications easy and only one copy is needed saves time and storage space Makes it less likely that a computer will get a virus or malware OPERATING SYSTEMS EXAMPLE: JOLICLOUD OPERATING SYSTEMS EXAMPLE: JOLICLOUD Runs entirely within your browser Is open source (= free) All of your files are also accessible on your smartphone or tablet 12

13 EyeOS MOBILE PHONE SYSTEMS Many phone developers have created cloud computing systems for users to share and sync: Contacts Files Calendar Photos and videos Applications Track devices and remote lock/wipe MOBILE PHONE EXAMPLE: icloud 13

14 MICROSOFT SKYDRIVE ORGANIZATIONS IN THE CLOUD All of the preceding examples have both individual and organizational uses Organizations may choose to utilize a common cloud service (such as Google Apps) or may seek to have a service completely customized for their needs QUIZ Which of the following is an example of how a home user may use cloud computing? A. Backup files B. Share photos C. Sync calendar data across devices D. Save their passwords E. All of the above 14

15 Security & Privacy Issues Cloudtweaks.com With the cloud, you don't own anything. You already signed it away the more we transfer everything onto the web, onto the cloud, the less we're going to have control over it. - Steve Wozniak, Apple Co-Founder THE REAL FEAR Theft of confidential or private data For example Attorneys Trade secrets Identity theft 15

16 ALREADY IN THE CLOUD Financial institutions Energy Military Currently moving to a private cloud Projected to reduce cost of May save the Army alone $320 million over a five-year period Nearly every major corporation AUTHENTICATION There are ways to authenticate a user to ensure they are who they say they are Passwords are used for authentication, but there are many other means Location-based / IP Ranges Biometrics Card or token Digital certificate ENCRYPTION Cloud host may encrypt all data May not even have access to the individual files Encryption of communications 16

17 OTHER SECURITY Firewalls Malware/virus protection Log inspection UNAUTHORIZED ACCESS Hacking Cloud may create a larger target while also offering better security Cloud host issues Using the cloud often requires relinquishing physical control over the data it s stored outside of your building Gives the host s employees access to the data. May require special agreement. (Gramm-Leach-Bliley Act, HIPAA) LEGAL ETHICS Many states have ethics opinions dealing with attorneys use of cloud computing Must take reasonable care to ensure confidentiality Evaluate backup strategies Vermont must discuss with client if especially sensitive Alabama - stay abreast of best practices regarding data safeguards 17

18 QUIZ Which is NOT a form of authentication? A. Retina scan B. Firewalls C. Password D. Digital certificate E. IP Ranges Investigative Challenges WHERE IS THE DATA? Suppose you know that someone has a copy of a certain file, and you, the forensics investigator, needs to find it 18

19 WHERE IS THE DATA? INSIDE THE BOX What the computer owner actually has possession of Computer s hard drive and other memory Documents Pictures Outlook s Internet Cache CD s and floppy disks ipods Cell Phones External Hard Drives INSIDE THE BOX What the computer owner actually has possession of 19

20 OUTSIDE THE BOX What is not stored on the owner s computer Online Accounts (Gmail and Yahoo) Internet Shopping Accounts Social Networking Accounts Backups of text messages Cell Site Location Data Subscriber account records Contents of Websites OUTSIDE THE BOX What is not stored on the owner s computer IMPORTANT DISTINCTION Inside the box Likely Fourth Amendment protection Outside the box Generally, no reasonable expectation of privacy Fourth Amendment applicability doubtful Highly debatable, unsettled question, at best Stored Communications Act primary authority 20

21 DISCOVERY Documents under custody, control or possession (Fed. R. Civ. P. 34) Cloud host may or may not have the ability to preserve and collect data Host may keep documents longer than the company normal retains them ENCRYPTION Provides security for the creator of the information but makes an investigation nearly impossible Unless you can compel production of the password Few courts have dealt with the issue, and no pattern has yet to develop QUIZ Where might a person hide an incriminating file? A. Smartphone B. Computer C. account D. Social networking account E. All of the above 21

22 QUIZ Which of the following is NOT considered outside the box? A. Internet cache B. Cell site location data C. Online account D. Shopping account E. Contents of websites CONCLUSION Thank you for attending Put our next webinar on your calendar October 2, 2012 HIDING TRACKS: Proxy Servers and Private Networks To be presented by Priscilla Grantham, Senior Research Counsel Presented by Don Mason Associate/Acting Director, ncjrl.org 22