Cloud Computing Security ENISA Daniele Catteddu, CISM, CISA DigitPA egovernment e Cloud computing
Agenda Introduction to ENISA ENISA objectives in Cloud computing Reaching the objectives Benefits, risks and recommendations for Info Sec Gov Cloud: resilience and security CAMM
ENISA: Who are we? The European Network & Information Security Agency (ENISA) was formed in 2004. The Agency is a Centre of Expertise that supports the Commission and the EU Member States in the area of information security. We facilitate the exchange of information between EU institutions, the public sector and the private sector. 3
Activities The Agency s principal activities are as follows: Advising and assisting the Commission and the Member States on information security. Collecting and analysing data on security practices in Europe and emerging risks. Promoting risk assessment and risk management methods. Awareness-raising and co-operation between different actors in the information security field.
Focus ENISA assists Member States and the Commission in global issues that affect the European Community as a whole. ENISA contribute to the harmonization of appropriate technical and organizational security measures by providing expert advice. This is an advisory role and the focus is on prevention and preparedness. ENISA does NOT have any operational responsibilities either within the EU institutional framework or with respect to Member States. ENISA has no special role in the security process protecting EU institutions.
What is cloud computing ENISA s understanding Highly abstracted hw sw resources Near instant scalability and flexibility Near instantaneous provisioning Shared resources (hardware, database, memory, etc...) Service On demand, usually with a pay as you go billing system Programmatic management (e.g. through Web Services API)
What is cloud computing ENISA s understanding Cloud computing is a new business model It is a way of delivering computing resources Cloud computing is not a new technology. Lots of old hat, put together with some very clever resource distribution algorithms, which you can rent by the hour
ENISA Cloud Computing Objectives Help business and governments to reap the cost benefits of cloud computing. While maintaining service availability, data confidentiality and integrity, privacy, transparency, accountability and responsibility. 8
ENISA Cloud Computing Objectives Creating trust and trustworthiness through promoting best practice and assurance standards 9
ENISA Cloud Computing Objectives Improving transparency 10
ENISA Cloud Computing Objectives Recommending smart investment in R&D 11
Reaching the objectives ENISA Deliverables and Ongoing Activities Cloud Computing: Benefits, Risks and Recommendations for Information security 2009 Assurance framework 2009 Research Recommendations 2009 Gov-Cloud security and resilience analysis (2010) Common Assurance Maturity Model(CAMM) consortium 2010 2011 (proposed) procurement and monitoring guidance for government cloud contracts. 12
Cloud Computing: Benefits, Risks and Recommendations for Information security 13
Highlights from the report 27 experts involved Mainly based on an SMEs requirements 8 security benefits 53 vulnerabilities considered 24 cloud specific risks identified Information Assurance (framework), Legal and Research recommendations 14
Security Benefits 15
Economy of Scale
Economies of scale and Security All kinds of security measures are cheaper when implemented on a larger scale (e.g. filtering, patch management, hardening of virtual machine instances and hypervisors, etc) The same amount of investment in security buys better protection.
Other benefits of scale Multiple locations by default -> redundancy and failure independence Edge networks: content delivered or processed closer to its destination Staff specialization & experience Cloud providers big enough to hire specialists in dealing with specific security threats.
Improved management of updates and defaults Updates can be rolled out much more rapidly across a homogenous platform Default VM images and software modules can be updated with the latest patches and security settings Snapshots of virtual infrastructure (in IaaS) to be taken regularly and compared with a security baseline.
The Risks
Very high value assets Most risks are not new, but they are amplified by resource concentration Trustworthiness of insiders. Hypervisors - hypervisor layer attacks on virtual machines are very attractive. More Data in transit (Without encryption?) Management interfaces big juicy targets
Loss of Governance The client cedes control to the Provider on a number of issues effecting security: External pen testing not permitted. Very limited logs available. Usually no forensics service offered No information on location/jurisdiction of data. Outsource or sub-contract services to third-parties (fourth parties?) SLAs may not offer a commitment to provide the above services, thus leaving a gap in security defences.
Lock in Few tools, procedures or standard formats for data and service portability. Difficult to migrate from one provider to another, or to migrate data and services to or from an in-house IT environment. Potential dependency of service provision on a particular CP.
Compliance Challenges Cloud Provider cannot provide evidence of their own compliance to the relevant requirements Cloud Provider does not permit audit by the Cloud Customer In certain cases, using a cloud implies certain kind of compliance cannot be achieved
Legal and contractual risks Data in multiple jurisdictions, some of which may be risky. Lack of compliance with EU Data Protection Directive Potentially difficult for the customer (data controller) to check the data handling practices of the provider Multiple transfers of data exacerbated the problem Subpoena and e-discovery Confidentiality and Non-disclosure Intellectual Property Risk Allocation and limitation of liability
Isolation failure Storage (e.g. Side channel attacks see http://bit.ly/12h5yh) Memory Virtual machines Entropy pools (http://bit.ly/41siin) Resource use (e.g. Bandwidth)
RESOURCE EXHAUSTION Overbooking Underbooking Caused by: Resource allocation algos Denial of Service Freak events
Key management Key management is (currently) the responsibility of the cloud customer Key provisioning and storage is usually off-cloud One key-pair per machine doesn t scale to multiple account holders/rbac Credential recovery sometimes available through management interface (protected by UN/PWD by) Copies of VM images may contain keys if not wellmanaged
Recommendations 29
Cloud Information Assurance Framework Increasing transparency through a minimum baseline for: comparing cloud offers assessing the risk to go Cloud reducing audit burden for CP and security risks
Cloud Information Assurance Framework An example Network architecture controls Well-defined controls are in place to mitigate DDoS (distributed denial of-service) attacks e.g. o o Defence in depth (traffic throttling, packet black-holing, etc..) Defences are in place against internal (originating from the cloud providers networks) attacks as well as external (originating from the Internet or customer networks) attacks. Measures are specified to isolate resource usage between accounts for virtual machines, physical machines, network, storage (e.g., storage area networks), management networks and management support systems, etc. The architecture supports continued operation from the cloud when the customer is separated from the service provider and vice versa (e.g., there is no critical dependency on the customer LDAP system).
Research recommendations BUILDING TRUST IN THE CLOUD Certification processes and standards for clouds Return on security investments (ROSI) the measures cloud computing can enable to improve the accuracy of ROI for security; Techniques for increasing transparency while maintaining appropriate levels of security: Tagging, e.g., location tagging, data type tagging, policy tagging Privacy preserving data provenance systems, e.g., tracing data end-to-end through systems; End-to-end data confidentiality in the cloud and beyond: Encrypted search (long term) Encrypted processing schemes (long term) Encryption and confidentiality tools for social applications in the cloud Higher assurance clouds, virtual private clouds, etc;
Research recommendations DATA PROTECTION IN LARGE-SCALE CROSS- ORGANIZATIONAL SYSTEMS The following areas require further research with respect to cloud computing: Data destruction and lifecycle management Integrity verification - of backups and archives in the cloud and their version management Incident handling - monitoring and traceability Dispute resolution and rules of evidence International differences in relevant regulations, including data protection and privacy Legal means to facilitate the smooth functioning of multinational cloud infrastructures Automated means to mitigate problems with different jurisdictions...
Governments recommendations Public clouds are (usually) not suitable for critical government applications. Clearly define international differences in DP legislation. Should there be breach notification requirements on cloud providers....
Governments and the Cloud DK UK... Gov Agencies and Public Organizations around the globe are moving non-critical applications towards a "cloud approach". In Europe we have some fast adopters, i.e. Denmark and UK, announcing/planning to move into the cloud. Australia USA In the short-medium term (1 to 3 years) an increasing number of Public Organizations, in EU Member States, will consider/adopt cloud computing. Singapore Japan 35
2010-11 Security and resilience in Gov clouds: achieving an informed decision Government towards the Cloud: impact on service security & resilience ENISA aims to: analyze and evaluate the impact of cloud computing on the resilience and security of GOV services. provide recommendations and good practices for European Members State planning to migrate to cloud computing 36
Security and resilience in Gov clouds: achieving an informed decision 3 scenarios considered: a local healthcare authority implementing the electronic healthcare records and other e- services, a local public administration rolling out new services for the citizens and rationalizing internal IT services, and finally, a Ministry planning the creation of governmental cloud as a business incubator 38
Objectives and scope to guide Public Administrations (PAs) in the definition of their risk profile to evaluate S.W.O.T. of cloud computing to provide good practices to support MSs in elaborating their cloud strategy The main focus is the impact on service resilience and security.
Security and Resilience Security and parameters requirements Business/Operational, Legal and Regulation requirements IT services architectural option and delivery model COMPARATIVE ASSESSMENT (SWOT or RISK ANALYSIS & ASSESSMENT Select IT solution MITIGATE Prepare Request for Proposal (RpF) Select Partner-Provider MITIGATE
Security and Resilience parameters Preparedness Risk Analysis and Assessment Prevention and Detection Patch Management Access Control and Accountability Supply Chain Business continuity Service Delivery Availability and Reliability Scalability and Elasticity Cloud Access Recovery and response Legal and regulatory compliance
Community cloud Strengths Common requirements and constraints and risks More bargaining power as a group (with the cloud provider) Ability to be a walled garden You vett the membership according to their trustworthiness (entry criteria) If based on federation -> edge networks Private cloud Public full transparency and control over legal requirements such as geography. Ability to implement your own practices (e.g. risk analysis and assessment) You can fully monitor all security events, BCP testing auditablilty priority in service resumption strong security and resilience capabilities (e.g. prevention and detection, patch management, availability and reliability, tolerance and elasticity, performance, response and recovery, business continuity and physical security CAVEAT: these strength are directly related with the scale of the provider
Weaknesses Community difficult to agree on security baselines, the client-based common logging formats, etc compared to a private cloud, you are a bigger target. access control and authentication are weakened Private Public no advantage of economies of scale potentially less tolerance to malicious attacks less comprehensive redundancy regime, no geo-redundancy less flexibility lack of control on the access control systems, the lack accountability (audits are not allowed). you need negotiations power to be able to ask the right info the provider. external forensics very difficult geo location constrains as a weakness: data cannot leave the country
Opportunities Community Public common ToR and security policies, standards etc... Potential flexibility of security policies closedness e.g. more strict security Risk Analysis and Assessment, Penetration testing, Real time security monitoring In order for a public cloud to take advantage of these opportunities a the following measure should be in place: 1) full control on asset inventory, 2) detailed physical assets, information and services classification, 3) integration between risk analysis/assessment and real time security monitoring processes, 4) effective screening of employees...
Threats Community Are there also exit criteria? Community might grow too quickly Harder to predict resource usage (than private cloud) Failure of isolation mechanisms (not compared to public) Difficulty of identifying the legal entity Public Lack of legal and regulatory compliance (data retention, forensics, reporting). Attractive target for criminals and Insiders Isolation failure, information leakage, illegal monitoring linkability and accountability in case illegal activities poor requirements definition and asset classification. You might incur in supplementary multiple jurisdiction Change of control (Risk acquisition) Lock in
From To Cloud Information Assurance Framework CAMM: Common Assurance Maturity Model
The Challenge Vision for CAMM: open, accessible, relevant, automated, extensible, modular, integrated Modular: capable of addressing traditional and emerging distributed IT models including outsourcing and the cloud Integrated: enabling understanding of the overall assurance of a complex solution with both outsourced and in-house elements Short-term: help customers in making informed risk decision in migrating from traditional to cloud computing model
CAMM Common Assurance Maturity Model MISSION Provide an objective framework to transparently rate and benchmark the capability of a selected solution to deliver information assurance maturity across the supply chain
Key Objectives Transparency compared to any other existing standard. Easily Accessible for wide audience globally. Suitable for multiple environments, regardless of geography or industry through its modular approach. Trusted as it is a collaborative approach between the key industry organizations, regulators and standardization bodies. Creation of an easy to understand common language that is accessible to both senior management and security professionals. Avoids duplication through the use of existing compliance activities. Integrated by enabling understanding of the overall assurance of a complex solution with both outsourced and in-house elements Help customers in making informed risk decisions in comparing the provision of in-sourced or outsourced models
Conclusions Cloud computing can represent an improvement in security and resilience But transparency is crucial: users must be given a means to assess and compare provider security practices In the current state of the art, migrating critical applications and data to the cloud is still very risky Much more effort is required to achieve security levels required for higher assurance applications in the cloud For once we can build security in by design, let s not miss the chance
The Penultimate Slide Watch out for the results of ENISA s cloud security study out in mid November (http://)
The Final Slide Contact: Daniele Catteddu daniele.catteddu@enisa.europa.eu
Contact Daniele Catteddu - daniele.catteddu@enisa.europa.eu European Network and Information Security Agency Science and Technology Park of Crete (ITE) P.O. Box 1309 71001 Heraklion - Crete Greece