Cloud Security

Cloud Computing: who should use it?

• Cloud computing definitely makes sense if your

own security is weak, missing features, or below
average.
• Ultimately, if
– the cloud provider’s security people are “better”
than yours (and leveraged at least as efficiently),
– the web-services interfaces don’t introduce too
many new vulnerabilities, and
– the cloud provider aims at least as high as you
do, at security goals,
then cloud computing has better security.

From [2] John McDermott, ACSAC 09

 Cloud Security !! A major Concern

• Security concerns arising because both customer data and program are
residing at Provider Premises.

• Security is always a major concern in Open System Architectures

Customer
Data

Customer
Customer
Code

3
 Impact of cloud computing on the
governance structure of IT organizations

4
From [6] Cloud Security and Privacy by Mather and Kumaraswamy
 If cloud computing is so great,
why isn’t everyone doing it?
• The cloud acts as a big black box, nothing
inside the cloud is visible to the clients
• Clients have no idea or control over what
happens inside a cloud
• Even if the cloud provider is honest, it can have
malicious system admins who can tamper with
the VMs and violate confidentiality and integrity
• Clouds are still subject to traditional data
confidentiality, integrity, availability, and privacy
issues, plus some additional attacks
5
Companies are still afraid to use clouds

[Chow09ccsw]
6
 Cloud Security Problems
Most security problems stem from:
 Loss of control
 Lack of trust (mechanisms)
 Multi-tenancy
These problems exist mainly in 3rd party
management models
 Self-managed clouds still have security issues, but
not related to above
 Loss of Control in the Cloud
• Consumer’s loss of control
– Data, applications, resources are located with
provider
– User identity management is handled by the cloud
– User access control rules, security policies and
enforcement are managed by the cloud provider
– Consumer relies on provider to ensure
• Data security and privacy
• Resource availability
• Monitoring and repairing of services/resources
 Lack of Trust in the Cloud
• A brief deviation from the talk
– (But still related)
– Trusting a third party requires taking risks
• Defining trust and risk
– Opposite sides of the same coin (J. Camp)
– People only trust when it pays (Economist’s view)
– Need for trust arises only in risky situations
• Defunct third party management schemes
– Hard to balance trust and risk
– Is the cloud headed toward the same path?
 Multi-tenancy Issues in the Cloud
• Conflict between tenants’ opposing goals
– Tenants share a pool of resources and have opposing goals
• How does multi-tenancy deal with conflict of interest?
– Can tenants get along together and ‘play nicely’ ?
– If they can’t, can we isolate them?
• How to provide separation between tenants?

• Cloud Computing brings new threats

– Multiple independent users share the same physical infrastructure
– Thus an attacker can legitimately be in the same physical machine as
the target
 Data Security Concerns
• Confidentiality
– Fear of loss of control over data
• Will the sensitive data stored on a cloud remain
confidential?
• Will cloud compromises leak confidential client data
– Will the cloud provider itself be honest and won’t
peep into the data?
• Integrity
– How do I know that the cloud provider is doing the
computations correctly?
– How do I ensure that the cloud provider really
stored my data without tampering with it?
From [5] [Link]/~ragib/sp10/cs412

11
 Data Security Concerns (cont.)
• Availability
– Will critical systems go down at the client, if the
provider is attacked in a Denial of Service attack?
– What happens if cloud provider goes out of
business?
– Would cloud scale well-enough?
– Often-voiced concern
• Although cloud providers argue their downtime compares
well with cloud user’s own data centers

From [5] [Link]/~ragib/sp10/cs412

12
 Data Security Concerns (cont.)
• Privacy issues raised via massive data mining
– Cloud now stores data from a lot of clients, and can
run data mining algorithms to get large amounts of
information on clients
• Increased attack surface
– Entity outside the organization now stores and
computes data, and so
– Attackers can now target the communication link
between cloud provider and client
– Cloud provider employees can be phished
From [5] [Link]/~ragib/sp10/cs412

13
 Data Security Concerns (cont.)
• Auditability and forensics (out of control of
data)
– Difficult to audit data held outside organization in a
cloud
– Forensics also made difficult since now clients don’t
maintain data locally
• Legal quagmire and transitive trust issues
– Who is responsible for complying with regulations?
• e.g., SOX, HIPAA, GLBA ?
– If cloud provider subcontracts to third party clouds,
will the data still be secure? From [5] [Link]/~ragib/sp10/cs412
14
 Taxonomy of Fear
Cloud Computing is a security
nightmare and it can't be handled in
traditional ways.
John Chambers
CISCO CEO

• Security is one of the most difficult task to

implement in cloud computing.
– Different forms of attacks in the application side and in
the hardware components
• Attacks with catastrophic effects only needs one
security flaw
([Link]
15
 Threat Model
• A threat model helps in analyzing a security
problem, design mitigation strategies, and
evaluate solutions
•Steps:
– Identify attackers, assets, threats and other
components
– Rank the threats
– Choose mitigation strategies
– Build solutions based on the strategies

From [5] [Link]/~ragib/sp10/cs412

16
 Threat Model
• Basic components
– Attacker modeling
• Choose what attacker to consider
– insider vs. outsider?
– single vs. collaborator?
• Attacker motivation and capabilities
– Attacker goals
– Vulnerabilities / threats

From [5] [Link]/~ragib/sp10/cs412

17
 What is the issue?
• The core issue here is the levels of trust
– Many cloud computing providers trust their
customers
– Each customer is physically blends its data with
data from anybody else using the cloud while
logically and virtually you have your own space
– The way that the cloud provider implements
security is typically focused on the fact that those
outside of their cloud are evil, and those inside are
good.
• But what if those inside are also evil?
From [5] [Link]/~ragib/sp10/cs412

18
Attacker Capability: Malicious Insiders
• At client
– Learn passwords/authentication information
– Gain control of the VMs
• At cloud provider
– Log client communication
– Can read unencrypted data
– Can possibly peep into VMs, or make copies of VMs
– Can monitor network communication, application patterns
– Why?
• Gain information about client data
• Gain information on client behavior
• Sell the information or use itself

From [5] [Link]/~ragib/sp10/cs412

19
Attacker Capability: Outside attacker
• What?
– Listen to network traffic (passive)
– Insert malicious traffic (active)
– Probe cloud structure (active)
– Launch DoS
• Goal?
– Intrusion
– Network analysis
– Man in the middle
– Cartography From [5] [Link]/~ragib/sp10/cs412

20
 Challenges for the attacker
• How to find out where the target is located?
• How to be co-located with the target in the
same (physical) machine?
• How to gather information about the target?

From [5] [Link]/~ragib/sp10/cs412

21
 Security and Privacy Issues
in Cloud Computing
• Infrastructure Security
• Data Security and Storage
• Identity and Access Management (IAM)
• Privacy

• And more…

From [6] Cloud Security and Privacy by Mather and Kumaraswamy

22
 Infrastructure Security
• Network Level
• Host Level
• Application Level

23
 The Network Level
• Ensuring confidentiality and integrity of your
organization’s data-in-transit to and from your public
cloud provider
• Ensuring proper access control (authentication,
authorization, and auditing) to whatever resources
you are using at your public cloud provider
• Ensuring availability of the Internet-facing resources in
a public cloud that are being used by your
organization, or have been assigned to your
organization by your public cloud providers
• Replacing the established model of network zones
and tiers with domains
From [6] Cloud Security and Privacy by Mather and Kumaraswamy

24
 The Network Level - Mitigation
• Note that network-level risks exist regardless of
what aspects of “cloud computing” services are
being used
• The primary determination of risk level is
therefore not which *aaS is being used,
• But rather whether your organization intends to
use or is using a public, private, or hybrid
cloud.

From [6] Cloud Security and Privacy by Mather and Kumaraswamy

25
 Host Security
Securing a cloud host or virtual machine is similar
in several ways to securing a traditional, physical
server.
Cloud hosts additionally require more security
due to sharing with unknown tenants, competitors
and hackers.
For Saas and Paas environments, security for the
hosts is the responcibility of the provider.
For IaaS , the user has complete access to host
operating and privileged accounts.
For Iaas Security is users responcibility.
 Host Security for SaaS
Different ways to get assurance of the degree of security
implemented by the SaaS provider:
Customer can ask for detailed security status after signing a
Non-Disclosure Agreement (NDA) with the provider.
Customer can ask if the provider has security assessment
report such as SAS 70 or SysTrust report
Customer can also ask for security certifications such as ISO
27002
SaaS provider are not obligated to give customers details of the
environment but will give a high level SLA for the service
availability or for the type of data backups and disaster
recovery.
 Host Security for PaaS
The access,control and amount of information customers can
get for servers in a Paas environment is similar to that as SaaS.
Paas provides an environment to develop products, customers
do have access to libraries and kernel level parameters.
The server is shared by other developers, customers don't have
root or administrator level privileges.
Like SaaS the host administration in PaaS is the reponsibility of
cloud provider.
It is the users responsibility, as customer and cosumer to own
the risk of maintaining data in the cloud provider has instituted.
Utilization API to access the Host
Abstrction Layer and OS
Paas Users

APIs

Host Abstraction Layer

Operating Syestem
Hypervisor

Public Cloud IT Infrasrtucture

 Host Security for IaaS
 Each Iaas Provider offer the OS a user can install. However users should create their
own OS image to be installed on virtual servers.
 Every time a user installs an OS on a virtual host, it is important to customize the host
to run services required by the application on the host.
 Block ports that are not used such as FTP(20 and 21), telnet(port 23) and
NetBIOS(port 139), SMTP(port 25).
 Install host based IPS and IDS services to monitor and analyze the OS and log files .
It records the object attributes and creates a check-sum database for later
comparison.
 Enable event logging for all security and user activities to a dedicated server.
 Setup automated alerts for malicious events. Review log files regularly for security
breaches.
 Protect the encryption keys. Keep the keys separate from the cloud where the data is
stored
 User are required to type passwords for sudo access to gain root-level rights for Unix
hosts.
 Enforce strong passwords for users.
 The Application Level
• DoS
• EDoS(Economic Denial of Sustainability)
– An attack against the billing model that underlies the
cost of providing a service with the goal of bankrupting
the service itself.
• End user security
• Who is responsible for Web application security in the
cloud?
• SaaS/PaaS/IaaS application security
• Customer-deployed application security
From [6] Cloud Security and Privacy by Mather and Kumaraswamy

32
 Data Security and Storage
• Several aspects of data security, including:
– Data-in-transit
• Confidentiality + integrity using secured protocol
• Confidentiality with non-secured protocol and encryption
– Data-at-rest
• Generally, not encrypted , since data is commingled with
other users’ data
• Encryption if it is not associated with applications?
– But how about indexing and searching?
– Then homomorphic encryption vs. predicate encryption?
– Processing of data, including multi-tenancy
• For any application to process data, not encrypted
From [6] Cloud Security and Privacy by Mather and Kumaraswamy
33
Data Security and Storage (cont.)
– Data lineage
• Knowing when and where the data was located within
cloud is important for audit/compliance purposes
• e.g., Amazon AWS
– Store <d1, t1, [Link]>
– Process <d2, t2, [Link]>
– Restore <d3, t3, [Link]>
– Data provenance
• Computational accuracy (as well as data integrity)
• E.g., financial calculation: sum ((((2*3)*4)/6) -2) = $2.00 ?
– Correct : assuming US dollar
– How about dollars of different countries?
– Correct exchange rate?

From [6] Cloud Security and Privacy by Mather and Kumaraswamy

34
 Data Security and Storage
•Data remanence(residual representation of digital data)
– Inadvertent(unintentional )disclosure of sensitive information is
possible
•Data security mitigation?
– Do not place any sensitive data in a public cloud
– Encrypted data is placed into the cloud
•Provider data and its security: storage
– To the extent that quantities of data from many companies are
centralized, this collection can become an attractive target for
criminals
– Moreover, the physical security of the data center and the
trustworthiness of system administrators take on new importance.

From [6] Cloud Security and Privacy by Mather and Kumaraswamy

35
 Cloud Data Management Interface
 A new standard to protect data is the Cloud Data Management Interface
(CDMI)

 CDMI allows users to tag the data with special metadata.

 The metadata can be used to code services that must be provided such
as encryption, backup, de-duplication, replication, compression,
archiving etc.

 These services incresace the value of user data existing in the cloud.

 CDMI enables interoperable cloud storage implementations from various

cloud service providers and storage vendors.
 Cloud Storage Gateways CSGs
• To address the performance and security issues in public
clouds, consumer organizations can use CSGs.

• The CSG is an appliance residing in the consumers’ premises

and provides data protection by encrypting, compressing, and
archiving data sets before moving the data to a clouds.

• A CSG could be in the form of a hardware appliance with a

cache that can be installed within your corporate office or
datacenter.
 The CSG

CSG Vendor Cloud

storage
Provider A
VPN to Public Cloud
•Initial
Configuration •Read-ahesd
Credentials data and
•Call-home metadata
•Billing •Deduplicated, Cloud
•Compressed, storage
•Encrypted, Provider B
•Incremental
Updates
CSG With
Cache
Corporate Office
Cloud
Users
 Cloud Storage Gateways CSGs
• A CSG at the corporate office intercepts and manages all the I/O
between the users and the cloud storage providers.

• A CSG could be a downloadable software program that can be

installed on a server at the customer location.

• CSGs have a local cache to store data temporarily.

• Users can download a CSG software and configure a local

storage device as the cache.

• CSGs eliminate the issue of vendor lock-in, because they

support various formats and facilitate data backup.
 Cloud Storage Gateways CSGs

•The CSG provides data protection in 4 steps

1. The CSG cache accelerates I/O rates and enables a convenient

replication procedure.

2. Files that are to be copied to the cloud are first stored in the CSG
cache.

3. After a certain pre-set time interval, the cache data is pushed to

the cloud.

4. Data that is read from the cloud is copied to the cache.

 Cloud Storage Gateways CSGs

•To improve performance, the CSG caches data as well as

metadata.
•The CSG you select must provide the following features.
•Caching Algorithms
•Intelligent Pre-fetching Algorithms
•Caching Time Periods
•Synchronous snapshots
•Data Replication Process
•End-to-end Encryption
•Secure Channels
•Data Compression
•CSG Tuning Parameters
 Cloud Firewall
•A cloud firewall is a network firewall appliance,
explicitly built to work with other cloud-based security
solutions.
•It serves the same purposes as traditional firewalls,
but it is different from a traditional firewall on the
following three aspects:
•1. Scalability
•2. Availability
•3. Extensibility
 Virtual Firewall
•A VF is a network firewall service running entirely within a virtualized
environment.
•Like a physical firewall, it provides the usual packet filtering and monitoring.

•Virtual firewalls provide an easy way to decrease investment expenses by

consolidating multiple logical firewalls onto a single platform.
•Depending on point of deployment virtual firewalls can operate in two different
modes:

•Bridge mode : act as a physical firewall that works with a physical or virtual
switch to intercept network traffic destined for other network segment.

•Hypervisor mode: The firewall service resides in the virtualization hypervisor,

where it can capture, monitor, and filter all the virtual machines and logical
resources.
 Why IAM?
• Organization’s trust boundary will become dynamic and will move beyond
the control and will extend into the service provider domain.
• Managing access for diverse user populations (employees, contractors,
partners, etc.)
• Increased demand for authentication
– personal, financial, medical data will now be hosted in the cloud
– S/W applications hosted in the cloud requires access control
• Need for higher-assurance authentication
– authentication in the cloud may mean authentication outside F/W
– Limits of password authentication
• Need for authentication from mobile devices

From [6] Cloud Security and Privacy by Mather and Kumaraswamy

44
 What is Privacy?
• The concept of privacy varies widely among (and sometimes within)
countries, cultures, and jurisdictions.
• It is shaped by public expectations and legal interpretations; as such,
a concise definition is elusive if not impossible.
• Privacy rights or obligations are related to the collection, use,
disclosure, storage, and destruction of personal data (or Personally
Identifiable Information—PII).
• At the end of the day, privacy is about the accountability of
organizations to data subjects, as well as the transparency to an
organization’s practice around personal information.

From [6] Cloud Security and Privacy by Mather and Kumaraswamy 45

What is the data life cycle?

• Personal information should be

managed as part of the data used by
the organization
• Protection of personal information
should consider the impact of the
cloud on each phase

From [6] Cloud Security and Privacy by Mather and Kumaraswamy 46

 What Are the Key Privacy
Concerns?
• Typically mix security and privacy
• Some considerations to be aware of:
– Storage
– Retention
– Destruction
– Auditing, monitoring and risk management
– Privacy breaches
– Who is responsible for protecting privacy?

From [6] Cloud Security and Privacy by Mather and Kumaraswamy 47

 Summary
•The most important asset that users have in the cloud is data.
Users need to use proper techniques to improve the following:
– Data confidentiality
– Service availability
– Data integrity
•Major Data related tasks and resulting challenges arise from the
following:
– Data redundancy
– Raplication and disaster recovery
– Backups
– Location
– Reliability
– Fragmentation
– Integration with in-house applications or with other cloud
services
– Data transformation for interoperability
– Migration
 Summary
•Symmetric and asymmetric encryption algorithms and keys must be used to
protect in-flight and at-rest data
•Users need to make sure that the encryption keys are long and the algorithm
is strong enough to prevent others from understanding pattern and
deciphering the keys.
•Cloud providers must use different keys for different customers.
•Likewise, consumers must use separate keys for separate data sets.
•Cloud data security guidelines include implementing the following:
– Security programs
– Data protection mechanism
– Identity management system to access data in the cloud
– Vulnerability and intrusion management programs
– Compliance and audit management programs
•Besides data confidentiality and security, cloud services must always be
available for users around the world.
•Data or application downtime involves hard, soft, and lost opportunity costs
for the cloud users. It has an SLA penalty cost for the provider.
 Summary
•Data Integrity refers to maintaining and assuring the accuracy and
consistency of data over its entire lifecycle.
•Encrypted data must not be intercepted or modified in-transit or at-rest by
unauthorized parties. Any change if done, must be detected by the
application or users.
•Data integrity issues can be detected using DIF or using error detection and
correction programs.

•CSGs are appliances that intercept data travelling between your internal
corporate network and the public clouds.
•CSGs protect and encrypt internal corporate [Link] perform cashing,
compression, back up etc to improve availability.

•A cloud firewall is a software program or hardware appliance that exists in

between internal network and public clouds.
•A virtual firewall is a network firewall service running in a virtual
environment. It provides packet monitoring and filtering. It can be installed in
a virtual machine or within hypervisor.