ICSA Labs Risk and Privacy Cloud Computing Series Part I : Balancing Risks and Benefits of Public Cloud Services for SMBs

Transcription

1 ICSA Labs Risk and Privacy Cloud Computing Series Part I : Balancing Risks and Benefits of Public Cloud Services for SMBs The security challenges cloud computing presents are formidable, including those faced by public clouds whose infrastructure and computational resources are owned and operated by an outside party that delivers services to the general public via a multi-tenant platform. National Institute of Standards and Technology (NIST) Special Publication Balancing the benefits of cloud computing against the security risks and privacy considerations is a challenge facing CIOs and Risk Managers everywhere. Underwriting stress points range from fears surrounding the tremendous aggregation of data and potential claims from a major data breach event, to the loss of control when responding to and managing a security incident. The purpose of this series is to take a closer, and hopefully balanced, look at the risks and benefits of cloud computing. This first article will introduce the topic of cloud computing, provide a glance at the growth of the cloud services market and discuss some of the upsides and downsides of cloud computing as outlined in NIST s Guidelines on Security and Privacy in Public Cloud Computing. The scope of the article will be small and midsize businesses (SMBs) and the public cloud market. We ll discuss large enterprise implementations of cloud in another article. Cloud computing has been defined by NIST as a model for enabling convenient, ondemand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort. The cloud market is divided into three main service categories; Infrastructure as a Service, Platform as a Service and Software as a Service. Infrastructure as a Service (IaaS) providers are the owners of the hardware associated with a public cloud and include providers such as Amazon, Rackspace, and Terremark. Platform as a Service (PaaS) providers are common to the software development environment and provide not only the infrastructure but also the development environment to create applications, and in some cases, host them as well. Examples of PaaS providers are Force.com and Microsoft Azure.

2 Business processing platforms like Paypal are mentioned specifically by some as a sub category of Platform as a Service. The third and largest segment of the industry is Software as a Service. Examples of Software as a Service providers are Salesforce.Com, Microsoft Office 365 and Google Apps. It is estimated that Software as a Service accounts for ~75% of the market today and has the greatest potential for continued growth. NIST describes four different deployment models, as shows in the image above. For the purposes of this article we are focusing on public cloud deployments. In a public cloud the infrastructure is provisioned for open use by the general public. We will discuss the other deployment models in future articles.

3 Forrester s Sizing the Cloud report forecasts that the global market for cloud computing will grow from $40.7 billion in 2011 to more than $241 billion in Market forces responsible for this growth are: A volatile economy that puts a premium on the agility of business processes and IT systems. Over the coming years most economies will remain volatile resulting in CEOs and COOs continuing to focus their companies on core competencies and leaner, more flexible business operations. Demographic changes in the population of most countries will see a Digital Native generation dominate most workforce environments. Members of this generation will gravitate toward technologies that are provided in a flexible, self-service manner. Cloud and mobile services will experience significant growth and adoption with this generation. Company leaders are starting to recognize how technology such as sensors, business intelligence, Social Computing, and mobile can help build new, differentiated products and solutions for their clients. Cloud computing will be a core enabler for many of these new solutions. Current Analysis December 2011 Cloud Adoption Market Study surveyed over 800 large companies in the United States, Europe and Asian markets regarding current adoption and future adoption of cloud computing. The survey states that whether a business is already heavily invested in virtual services or just dabbling in cloud services, there are some universal concerns about migrating to an on-demand environment. Questions about security are top of mind, with 40% of respondents citing it as the number one obstacle in moving to the cloud. The lack of cloud-specific security standards isn t helping the situation as businesses and providers grapple with what protections are adequate to safeguard applications in a virtualized on-demand environment. We will discuss industry standards and best practices for evaluating cloud providers with respect to security and privacy in future posts. While security is a major concern, cloud computing can improve the overall security in some organizations. Many organizations, specifically small and midsize businesses (SMBs), have limited IT and security staff but have a true business need for economies of scale. Improved

4 security also benefits privacy and for many of these SMBs the move to the cloud results in improved security. Below are five areas where SMBs might improve security and privacy by making the transition to cloud computing: 1. Specialization: Cloud service providers (CSPs), due to their significant infrastructure, provide opportunities for the creation of strong, experienced teams that concentrate exclusively on privacy and security issues. Most companies do not have the ability to shed other duties and place the necessary emphasis on managing security and privacy. Interviews conducted with CSPs have shown a level of sophistication in dealing with threats across numerous attack vectors that might be difficult to achieve for SMB organizations with limited IT resources. 2. Infrastructure: Well-designed cloud computing services provide a high level of homogeneity, resulting in stronger platform hardening, automation of security management and controls employed to protect privacy. Additionally, security incident response activities benefit from homogenous environments as do patching and configuration control. It must be noted that a significant danger in a homogenous cloud environment is that a single flaw will be manifested throughout the entire infrastructure. 3. Compliance: Many cloud providers meet standards for operational compliance and certifications, such as HIPAA, ISO 27001, PCI DSS, and FISMA. These standards can be difficult to achieve and bog down IT resources in small organizations. 4. Scalability & Resource Availability: Cloud computing environments that have strong redundancy and disaster recovery capabilities, combined with on-demand resource capacity, can provide greater resilience when faced with increased service demands or distributed denial of service (DDoS) attacks. Attacks can be better contained and information gathered with greater detail while minimizing the impact on production. 5. Mobility & Cloud Storage: The proliferation of tablet and smartphone usage is staggering. Having data properly maintained and processed in a public cloud may present less of a risk to an organization with a mobile workforce than having the data dispersed on laptops, USB drives, and other portable media. The lost laptop is still one of the most common reasons for a data breach.

5 Keeping in mind that every glass that is half-full is also half-empty, let s examine five core concerns that exist with cloud computing. 1. Complexity: A public cloud is more complex than traditional data centers. Cloud services include additional layers that allow customers to self-manage systems and resources. These create a larger attack surface than a traditional data center and a more complex environment to maintain. Additionally, some cloud services are nested and layered within other cloud providers. For example, many Software as a Service implementations are hosted by another Infrastructure as a Service provider. This adds complexity in managing security as well as defining roles and responsibilities in responding to a security incident. 2. Shared Environment: Cloud computing is based on a multi-tenant environment. In a cloud environment multi-tenancy means that multiple clients share infrastructures, applications or databases in order to gain price and performance advantages. The shared environment creates opportunities for attacks from within the cloud (sometimes referred to as side-channel attacks). 3. Public Facing Access: Administrative functions that in traditional data centers are managed via the organization s private intranet are now managed via the public Internet. This creates a large and very attractive attack surface for malicious activities. 4. Loss of Control: Aside from security concerns, loss of control is the second largest barrier in the minds of CIOs to migrating to cloud computing. When a security incident occurs, who handles the discovery and forensic investigation? Who conducts the risk assessment? For businesses handling personal and/or sensitive information these are significant concerns. 5. Reliability: Highly publicized, high impact and recurring incidents of outages are raising concerns to the day to day stability of cloud services. Underwriting risk in today s cloud driven market is challenging. In some cases, companies that make a move to cloud computing are improving their risk profile while others are increasing risk due to larger attack surfaces and the loss of control. Overall, the cloud

6 computing market has been aggressively securing many of the attack surfaces and concerns we mentioned today. Security challenges provide opportunities for technology innovation and many appliances have been developed specifically to harden cloud environments. Cloud providers know that the number one issue they face is security and as a result place (or should) an emphasis on securing their environments. Our next article will focus on security risks for large enterprises implementing private and hybrid cloud environments. About the Author Vinny Sakore is ICSA Labs Program Manager for Cloud Security Services. He is credentialed in privacy and IT through the International Association for Privacy Professionals. About ICSA Labs ICSA Labs, an independent division of Verizon Business, offers third-party testing and certification of security and health IT products, as well as network-connected devices, to measure product compliance, reliability and performance for many of the world s top security vendors. Visit and for more information.