Security in the Cloud

Three major cloud computing service provider models:

• Software-as-a-Service: is a model of software
deployment in which an application is licensed for
use as a service provided to customers on demand.
• Platform-as-a-Service:is an outgrowth of the SaaS
application delivery model. With the PaaS model, all
of the facilities required to support the complete life
cycle of building and delivering web applications and
servicesare available to developers, IT managers, and
end users entirely from the Internet, without
software downloads or installation. PaaS is also
sometimes known as “cloudware.”
• Infrastructure-as-a-Service:is the delivery of
computer infrastructure (typically a platform
virtualization environment) as a service. These
“virtual infrastructure stacks” are an example
of the everything-as-a-service trend and share
many of the common characteristics.
• Inspired by the IT industry’s move toward
SaaS, in which software is not purchased but
rented as a service from providers, IT-as-a-
Service (ITaaS) is being proposed to take this
concept further, to bring the service model
right to your IT infrastructure.
• Another service
• Anything-as-a-Service (XaaS), which is also a
subset of cloud computing. XaaS broadly
encompasses a process of activating reusable
software components over the network. The
most common and successful example is
Software-as-a-Service.
 Cloud Security Challenges - Overview
• Cloud computing presents new security
challenges due to:
• - Shared infrastructure and multi-tenancy risks
• - Loss of physical control over IT resources
• - Compliance complexities with global
regulations
• - Increasing cyber threats targeting cloud
services
 Loss of Control Over Infrastructure
• • In traditional IT, organizations had full control over
security.
• • Cloud shifts infrastructure management to service
providers.
• • Challenges:
• - Data residency concerns (where is my data stored?)
• - Security responsibility shared between provider and
customer.
• • Solution:
• - Strong contractual SLAs on security and compliance.
• - Implement security monitoring tools to retain visibility.
 Shared Resources & Multi-Tenancy Risks

• • Cloud environments operate on shared physical

servers.
• • Risks:
• - Cross-tenant data leakage due to misconfigurations.
• - Potential hypervisor vulnerabilities allowing VM
escapes.
• • Best practices:
• - Strong tenant isolation using hardware-level
security.
• - Regular security audits and access control reviews.
 Encryption & Data Protection
• • Data in transit and at rest must be secured
with encryption.
• • Challenges:
• - Who controls encryption keys? (Provider vs.
Customer)
• - Managing encryption performance overhead.
• • Recommended strategies:
• - Use end-to-end encryption to maintain full
control.
• - Implement Key Management Systems (KMS)
with strict policies.
 SaaS Security Risks
• • SaaS applications store customer data on external
servers.
• • Major risks:
• - Unauthorized access due to weak authentication.
• - Vendor lock-in limiting security flexibility.
• - Compliance concerns due to data jurisdiction.
• • Best practices:
• - Multi-Factor Authentication (MFA) enforcement.
• - Vendor assessment for compliance certifications.
 Regulatory Compliance in SaaS
• • Cloud users must adhere to legal and industry security
standards.
• • Key regulations:
• - GDPR: Data privacy regulations in the EU.
• - HIPAA: Health Insurance Portability and Accountability
[Link] industry data protection.
• - PCI DSS: Payment security requirements.
• • Solution:
• - Choose SaaS vendors with certified compliance audits.
 Software-as-a-Service (SaaS) Security
• SaaS introduces unique security concerns and
best practices.
Software-as-a-Service Security
 seven security issues:
• [Link] user access
• Inquire about who has specialized access to data,
and about the hiring and management of such
administrators.
• [Link] compliance
• Make sure that the vendor is willing to undergo
external audits and/or security certifications.
• [Link] location
• Does the provider allow for any control over the
location of data?
• [Link] segregation
• Make sure that encryption is available at all stages, and
that these encryption schemes were designed and tested
by experienced professionals.
• [Link]
• Find out what will happen to data in the case of a disaster.
Do they offer complete restoration? If so, how long would
that take?
• [Link] support
• Does the vendor have the ability to investigate any
inappropriate or illegal activity?
• [Link]-term viability
• What will happen to data if the company goes out of
business? How will data be returned, and in what format?
• SaaS providers will need to incorporate and
enhance security practices used by the
managed service providers and develop new
ones as the cloud computing environment
evolves.
• The baseline security practices for the SaaS
environment as currently formulated are
discussed in the following sections.
1. Security Management (People)
2. Security Governance
3. Risk Management
4. Risk Assessment
5. Security Portfolio Management
6. Security Awareness
7. Education and Training
8. Policies, Standards, and Guidelines
9. Secure Software Development Life Cycle
(SecSDLC)
10. Security Monitoring and Incident Response
11. Third-Party Risk Management
12. Requests for Information and Sales Support
13. Business Continuity Plan
14. Forensics
15. Security Architecture Design
16. Vulnerability Assessment
17. Password Assurance Testing
18. Logging for Compliance and Security
Investigations
19. Security Images
20. Data Privacy
21. Data Governance
22. Data Security
23. Application Security
24. Virtual Machine Security
25. Identity Access Management (IAM)
26. Change Management
27. Physical Security
28. Business Continuity and Disaster Recovery
29. The Business Continuity Plan
1. Security Management (People)
• One of the most important actions for a security team is
to develop a formal charter for the security organization
and program.
• This will foster a shared vision among the team of what
security leadership is driving toward and expects, and will
also foster “ownership” in the success of the collective
team.
• The charter should be aligned with the strategic plan of
the organization or company the security team works for.
2. Security Governance
• Lack of proper governance and management
of duties can also result in potential security
risks being left unaddressed and opportunities
to improve the business being missed because
the security team is not focused on the key
security functions and activities that are
critical to the business.
• 3. Risk Management
• Effective risk management entails
identification of technology assets;
identification of data and its links to business
processes, applications, and data stores; and
assignment of ownership and custodial
responsibilities.
• 4. Risk Assessment
• Security risk assessment is critical to helping the
information security organization make informed decisions
when balancing the dueling priorities of business utility
and protection of assets.
• Lack of attention to completing formalized risk
assessments can contribute to an increase in information
security audit findings, can jeopardize certification goals,
and can lead to inefficient and ineffective selection of
security controls that may not adequately mitigate
information security risks to an acceptable level.
[Link] Portfolio Management
• Portfolio and project management capabilities
can be enhanced by developing methodology,
tools, and processes to support the expected
complexity of projects that include both
traditional business practices and cloud
computing practices.
• 6. Security Awareness
• Not providing proper awareness and training to the
people who may need them can expose the company
to a variety of security risks for which people, rather
than system or application vulnerabilities, are the
threats and points of entry.
• Social engineering attacks, lower reporting of and
slower responses to potential security incidents, and
inadvertent customer data leaks are all possible and
probable risks that may be triggered by lack of an
effective security awareness program.
• 7. Education and Training
• Programs should be developed that provide a baseline for
providing fundamental security and risk management skills and
knowledge to the security team and their internal partners.

8. Policies, Standards, and Guidelines

• Policies should be developed, documented, and implemented,
along with documentation for supporting standards and
guidelines.
• To maintain relevancy, these policies, standards, and guidelines
should be reviewed at regular intervals (at least annually) or
when significant changes occur in the business or IT
environment.
• 9. Secure Software Development Life Cycle
(SecSDLC)
• The SDLC consists of six phases, and there are steps
unique to the SecSLDC in each phase:
• Phase [Link]: Define project processes and
goals, and document them in the program security
policy.
• Phase [Link]: Analyze existing security policies
and programs, analyze current threats and controls,
examine legal issues, and perform risk analysis.
• Phase [Link] design: Develop a security blueprint,
plan incident response actions, plan business responses
to disaster, and
• determine the feasibility of continuing and/or
outsourcing the project.

• Phase [Link] design: Select technologies to support

the security blueprint, develop a definition of a
successful solution, design physical security measures to
support technological solutions, and review and approve
plans.
• Phase [Link]: Buy or develop
security solutions. At the end of this phase,
present a tested package to management for
approval.

• Phase [Link]: Constantly monitor,

test, modify, update, and repair to respond to
changing threats.
[Link] Monitoring and Incident Response
• The organization may thus need to expand its
security monitoring capabilities to include
application- and data-level activities.
• This may also require subject-matter experts in
applications security and the unique aspects of
maintaining privacy in the cloud.
• Without this capability and expertise, a company
may be unable to detect and prevent security threats
and attacks to its customer data and service stability
11. Third-Party Risk Management
• As SaaS moves into cloud computing for the storage
and processing of customer data, there is a higher
expectation that the SaaS will effectively manage the
security risks with third parties.
• Lack of a third-party risk management program may
result in damage to the provider’s reputation, revenue
losses, and legal actions should the provider be found
not to have performed due diligence on its third-party
vendors.
12. Requests for Information and Sales Support
• A structured process and a knowledge base of
frequently requested information will result in
considerable efficiency and the avoidance of
ad-hoc, inefficient, or inconsistent support of
the customer Request for information (RFI) or
request for proposal (RFP).
13. Business Continuity Plan
• The purpose of business continuity (BC)/disaster
recovery (DR) planning is to minimize the impact
of an adverse event on business processes.
• Business continuity and resiliency services help
ensure uninterrupted operations across all layers
of the business, as well as helping businesses
avoid, prepare for, and recover from a disruption
14. Forensics
• Computer forensics is used to retrieve and analyze data.
• The practice of computer forensics means responding
to an event by gathering and preserving data, analyzing
data to reconstruct events, and assessing the state of
an event.
• Network forensics includes recording and analyzing
network events to determine the nature and source of
information abuse, security attacks, and other such
incidents on your network
[Link] Architecture Design
• Technology and design methods should be included,
as well as the security processes necessary to
provide the following services across all technology
layers:
• 1. Authentication
• 2. Authorization
• 3. Availability
• 4. Confidentiality
• 5. Integrity
•
16. Vulnerability Assessment
• Vulnerability assessment classifies network assets to
more efficiently prioritize vulnerability-mitigation
programs, such as patching and system upgrading.
• It measures the effectiveness of risk mitigation by
setting goals of reduced vulnerability exposure and
faster mitigation.
• Vulnerability management should be integrated with
discovery, patch management, and upgrade
management processes to close vulnerabilities before
they can be exploited.
17. Password Assurance Testing
• If the SaaS security team or its customers
want to periodically test password strength by
running password “crackers,” they can use
cloud computing to decrease crack time and
pay only for what they use.
18. Logging for Compliance and Security
Investigations
• When your logs are in the cloud, you can
leverage cloud computing to index those logs
in real-time and get the benefit of instant
search results.
• A true real-time view can be achieved, since
the compute instances can be examined and
scaled as needed based on the logging load
19. Security Images
• Virtualization-based cloud computing provides
the ability to create “Gold image”
• VM secure builds and to clone multiple copies.
• Gold image VMs also provide the ability to
keep security up to date and reduce exposure
by patching offline.
20. Data Privacy
• As with security, privacy controls and
protection must an element of the secure
architecture design.
• Depending on the size of the organization and
the scale of operations, either an individual or
a team should be assigned and given
responsibility for maintaining privacy.
21. Data Governance
The data governance framework should include:
• Data inventory
• Data classification
• Data analysis (business intelligence)
• Data protection
• Data privacy
• Data retention/recovery/discovery
• Data destruction
22. Data Security
• The ultimate challenge in cloud computing is
data-level security, and sensitive data is the
domain of the enterprise, not the cloud
computing provider.
• Security will need to move to the data level so
that enterprises can be sure their data is
protected wherever it goes.
23. Application Security
• Application security is one of the critical success
factors for a world-class SaaS company.
• This is where the security features and
requirements are defined and application
security test results are reviewed.
• Application security processes, secure coding
guidelines, training, and testing scripts and tools
are typically a collaborative effort between the
security and the development teams.
24. Virtual Machine Security
• In the cloud environment, physical servers are
consolidated to multiple virtual machine instances
on virtualized servers.
• Not only can data center security teams replicate
typical security controls for the data center at large
to secure the virtual machines, they can also advise
their customers on how to prepare these machines
for migration to a cloud environment when
appropriate.
25. Identity Access Management (IAM)
• Identity and access management is a critical function
for every organization, and a fundamental
expectation of SaaS customers is that the principle of
least privilege is granted to their data.
• The principle of least privilege states that only the
minimum access necessary to perform an operation
should be granted, and that access should be granted
only for the minimum amount of time necessary.
26. Change Management
• Although it is not directly a security issue,
approving production change requests that do
not meet security requirements or that
introduce a security vulnerability to the
production environment may result in service
disruptions or loss of customer data
27. Physical Security
• For the SaaS provider, physical security is very
important, since it is the first layer in any security
model.
• Data centers must deliver multilevel physical security
because mission-critical Internet operations require the
highest level of security.
• The elements of physical security are also a key
element in ensuring that data center operations and
delivery teams can provide continuous and
authenticated uptime of greater than 99.9999%.
28. Business Continuity and Disaster Recovery
• A growing number of virtualization software
vendors have incorporated the ability to support
live migrations.
• This, plus the decoupling capability, provides a low-
cost means of quickly reallocating computing
resources without any downtime.
• Another benefit of virtualization in business
continuity and disaster recovery is its ability to
deliver on service-level agreements and provide
high-quality service.
29. The Business Continuity Plan
• A business continuity plan should include
planning for non-IT-related aspects such as key
personnel, facilities, crisis communication, and
reputation protection, and it should refer to
the disaster recovery plan for IT related
infrastructure recovery/continuity. T