Clouds on the Horizon Cloud Security in Today s DoD Environment. Bill Musson Security Analyst

Transcription

1 Clouds on the Horizon Cloud Security in Today s DoD Environment Bill Musson Security Analyst

2

3 Agenda O Overview of Cloud architectures O Essential characteristics O Cloud service models O Cloud deployment models O Security Issues O Confidentiality O Integrity O Authentication O Availability O Data Remanence O Regulatory Requirements

4 What is the Cloud

5 Cloud Computing Parts O NIST defines cloud computing by: O 5 essential characteristics O 3 cloud service models O 4 cloud deployment models 5

6 Essential Characteristics O On-demand service O Get computing capabilities as needed automatically O Broad Network Access O Services available over the net using desktop, laptop, PDA, mobile phone 6

7 Essential Characteristics O Resource pooling O Provider resources pooled to server multiple clients O Rapid Elasticity O Ability to quickly scale in/out service O Measured service O Control, optimize services based on metering 7

8 Deployment Models Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS)

9 Cloud Service Models O Software as a Service (SaaS) O We use the provider apps O User doesn t manage or control the network, servers, OS, storage or applications O Platform as a Service (PaaS) O User deploys their apps on the cloud O Controls their apps O User doesn t manage servers, IS, storage 9

10 Cloud Service Models O Infrastructure as a Service (IaaS) O Consumers gets access to the infrastructure to deploy their stuff O Doesn t manage or control the infrastructure O Does manage or control the OS, storage, apps, selected network components 10

11 Deployment Models O Public O Cloud infrastructure is available to the general public, owned by org selling cloud services O Private O Cloud infrastructure for single org only, may be managed by the org or a 3 rd party, on or off premise 11

12 Deployment Models O Community O Cloud infrastructure shared by several orgs that have shared concerns, managed by org or 3 rd party O Hybrid O Combo of multiple clouds bound by standard or proprietary technology 12

13 Organizations are still afraid to use clouds 13

14 A Massive Concentration of Resources Also a massive concentration of risk O expected loss from a single breach can be significantly larger O concentration of users represents a concentration of threats O Ultimately, you can outsource responsibility but you can t outsource accountability.

15 Cloud Security Issues O Most security problems stem from: O Loss of control O Lack of trust (mechanisms) O Multi-tenancy O These problems exist mainly in 3 rd party management models O Self-managed clouds still have security issues, but not related to above

16 Loss of Control in the Cloud O Loss of control O Data, applications, resources are located with provider O User identity management is handled by the cloud O User access control rules, security policies and enforcement are managed by the cloud provider O Consumer relies on provider to ensure O Data security and privacy O Resource availability O Monitoring and repairing of services/resources

17 Lack of Trust in the Cloud O Trusting a third party requires taking risks O Defining trust and risk O Opposite sides of the same coin O Defunct third party management schemes O Hard to balance trust and risk

18 Multi-Tenancy O O O O Conflict between tenants opposing goals O Tenants share a pool of resources and have opposing goals How does multi-tenancy deal with conflict of interest? O Can tenants get along together and play nicely? O If they can t, can we isolate them? How to provide separation between tenants? Cloud Computing brings new threats O Multiple independent users share the same physical infrastructure O Thus an attacker can legitimately be in the same physical machine as the target

19 Security Issues O Confidentiality O Fear of loss of control over data O Will the sensitive data stored on a cloud remain confidential? O Will cloud compromises leak confidential client data O Will the cloud provider itself be honest and won t peek into the data? O Integrity O How do I know that the cloud provider is doing the computations correctly? O How do I ensure that the cloud provider really stored my data without tampering with it? 19

20 Security Issues O Availability O Will critical systems go down at the client, if the provider is attacked in a Denial of Service attack? O What happens if cloud provider goes out of business? O Would cloud scale well-enough? O Often-voiced concern O Although cloud providers argue their downtime compares well with cloud user s own data centers 20

21 Security Issues Privacy issues raised via massive data mining Cloud now stores data from a lot of clients, and can run data mining algorithms to get large amounts of information on clients Increased attack surface Entity outside the organization now stores and computes data, and so Attackers can now target the communication link between cloud provider and client Cloud provider employees can be phished 21

22 Security Issues O Auditability and forensics (out of control of data) O Difficult to audit data held outside organization in a cloud O Forensics also made difficult since now clients don t maintain data locally O Legal quagmire and transitive trust issues O Who is responsible for complying with regulations? O If cloud provider subcontracts to third party clouds, will the data still be secure? 22

23 Attacks O Distributed Denial Of Service (DDoS) Attacks O Man in the Middle (MITM) Attacks. O IP Spoofing O Port Scanning O Packet sniffing by other tenants

24 Encryption "One ring to rule them all, one ring to find them, one ring to bring them all and in the darkness bind them."

25 Availability

26 Identity and Access Management O Determine how provider handles: O Provisioning, deprovisioning O Authentication O Federation O Authorization, user profile management 26

27 IdAM O O O O O Organization s trust boundary will become dynamic and will move beyond the control and will extend into the service provider domain. Managing access for diverse user populations (employees, contractors, partners, etc.) Increased demand for authentication O personal, financial, medical data will now be hosted in the cloud O S/W applications hosted in the cloud requires access control Need for higher-assurance authentication O authentication in the cloud may mean authentication outside F/W O Limits of password authentication Need for authentication from mobile devices

28 What Are the Key Privacy Concerns? O Typically mix security and privacy O Some considerations to be aware of: O Storage O Retention O Destruction O Auditing, monitoring and risk management O Privacy breaches O Who is responsible for protecting privacy? 28

29 Storage O Is it commingled with information from other organizations that use the same CSP? O The aggregation of data raises new privacy issues O Some governments may decide to search through data without necessarily notifying the data owner, depending on where the data resides O Whether the cloud provider itself has any right to see and access customer data? O Some services today track user behaviour for a range of purposes, from sending targeted advertising to improving services 29

30 Retention O How long is personal information (that is transferred to the cloud) retained? O Which retention policy governs the data? O Does the organization own the data, or the CSP? O Who enforces the retention policy in the cloud, and how are exceptions to this policy (such as litigation holds) managed? 30

31 Destruction O How does the cloud provider destroy PII at the end of the retention period? O How do organizations ensure that their PII is destroyed by the CSP at the right point and is not available to other cloud users? O Cloud storage providers usually replicate the data across multiple systems and sites increased availability is one of the benefits they provide. O How do you know that the CSP didn t retain additional copies? O Did the CSP really destroy the data, or just make it inaccessible to the organization? O Is the CSP keeping the information longer than necessary so that it can mine the data for its own use? 31

32 Data Remanence O Cloud computing crime poses unique forensics challenges O Over time, O it's expected that clouds will contain more and more evidence of criminal activity O the use of digital evidence in criminal and civil matters will continue to expand. O Cloud providers and customers need to set up their infrastructures to meet these lawful requests or face fines and other legal repercussions.

33 Forensics O Traditional computer forensics must address the following steps: O Collection of media at the crime scene or location where the media was seized O Preservation of that media; and validation, analysis, interpretation, documentation and courtroom presentation of the results of the examination. O Forensic challenges raised by cloud computing are related to control of the evidence, including collection, preservation and validation

34 Auditing and Monitoring O How can organizations monitor their CSP and provide assurance to relevant stakeholders that privacy requirements are met when their PII is in the cloud? O Are they regularly audited? O What happens in the event of an incident? O If business-critical processes are migrated to a cloud computing model, internal security processes need to evolve to allow multiple cloud providers to participate in those processes, as needed. O These include processes such as security monitoring, auditing, forensics, incident response, and business continuity 34

35 Governance O DOD Memorandum July 2012 (draft) O Cloud Computing Strategy O NIST SP O NIST SP O NIST SP O NIST SP security controls O NIST SP a assessment procedures O FedRAMP

36 Reference O Security Guidance for Critical Areas of Focus in Cloud Computing v2.1 O NIST Cloud Model: O Cloud Security Alliance (CSA) O Various cloud working groups O Open Cloud Computing Interface Working Group, Amazon EC2, Splunk, McAfee, Microsoft, and Dell among others 36