1 of 37

DATA BACKUPS & �CLOUD COMPUTING

CH 13 InfoSec Handbook

2 of 37

Intro

  • Focusing on the A of the CIA

​

  • Backups are first line of defense for crashed systems, lost data, e-discovery, and recovery efforts after breaches & malware attacks. #AtlantaTooSoon?

​

  • Although backup technologies have shifted over the years, fact remains that backups are still needed.

​

  • Cloud Computing now plays important role in backing up data

​

  • Cloud Computing has also allowed for lower cost & faster deployment of apps

3 of 37

Types of Backups

  • Category 1: Based on time delay between current data and the data on the backups:
    • Online Backups – taken in real-time & provide for high availability. �Server Mirroring & Remote Journaling providing high redundancy.
    • Near-Line Backups – taken at near real time, but are not real time backups such as electronic vaulting.
    • Offline Backups – most common form of backup. Backups are dumped to tape or external disks. Sometimes backups are considered offline when the backups are scheduled to systems while no transactions are taking place. Captures a point in time for reference or known good state.

4 of 37

Types of Backups (cont.)

  • Category 2: Based on what goes into the Backup:
    • Full Backups –
      • Everything gets backed up regardless of the date last modified or when the last backup was completed. �
    • Incremental Backups – only items that have been modified since the last backup, full or incremental. �
    • Differential Backups – only items that have changed since the last Full backup was completed.

​

5 of 37

Incremental vs Differential

6 of 37

Types of Backups (cont.)

  • Category 3: Based on storage of backups:
    • On-site storage – backups are stored on site with data that was backed up.
    • Off-site storage – Alternate location, may or may not be owned by the business.
      • Common offsite storage locations include data vaults, or co-location facilities�
  • Backups may be completed on-site, and then transitioned to off-site location either physically, or automatically via data transfer.

​

7 of 37

Types of Backups (cont.)

  • Category 4: Based on extent of automation of backups�
  • Highly Automated backups – facilitated through online methods of backup, such as RAID levels 1,15, and 51, and Server Mirroring�
  • Scheduled and automated backups - using mechanisms such as tape libraries and network storage devices�
  • Manual backups – Manually specified by calendar

8 of 37

Types of Backups (cont.)

RAID 🡪 Redundant Array of Inexpensive Disks

  • Data stored on array of disks in various RAID Levels

​

Pro Tip: Easy Interview Questions!

9 of 37

Types of Backups (RAID)

RAID 0 🡪 Stripe

​

​

10 of 37

Types of Backups (RAID)

RAID 1 🡪 Mirror

​

​

11 of 37

Types of Backups (RAID)

RAID 4 + 5 🡪 Stripes with Parity

​

​

12 of 37

Types of Backups (RAID)

RAID 1 + 0 🡪 Striping Mirrored Pairs of Disks

​

13 of 37

Types of Backups (RAID Summary)

14 of 37

Other Popular Tolerance Mechanisms

  • Group of servers clustered together for performance & redundancy.
  • In the event a failure, operation continues however perhaps with reduced performance.
  • Performance degradation may not be perceived by end users.

​

15 of 37

Other Popular Tolerance Mechanisms (cont.)

  • Electronic Vaulting – data transferred to alternative system, usually at offsite location via batch job.�
  • Remote Journaling – similar to Electronic Vaulting except is completed online & in real time so remote system can take over in event of failure.
    • Requires high speed link.�
  • Server Mirroring – Similar to mirror disks, but now for entire servers.
    • Requires high speed link between primary and secondary server.

​

16 of 37

Cloud Infrastructure in Backup Strategy

  • Cloud infrastructure provides easy to utilize, low-cost backup option for organizations of all size.�
  • Cost of infrastructure is low and pricing continues to get more and more competitive as new players enter the market. �
  • Cloud Infrastructure can offer backup, as well as Automatic Replication and Disaster Recovery options.

​

17 of 37

Database Backups

  • Most database systems have provisions for various backup options

​

  • Some allow for cold (offline) or hot (online) backup methods. �
  • Each type of backup has it’s own pros and cons�
  • Tip: Backing up the database and its stored data, not regular files or profiles like earlier
    • And test, test, test

​

​

18 of 37

Backup Strategy? Well, it depends …

  • Strategies based on:
    • Systems in use
    • Criticality to business
    • Criticality to system function
    • Criticality of data stored
    • Tolerance for data loss�
  • Some orgs have low to no tolerance for data loss (like financial institutions, e-commerce, reservation booking, city governments) #AtlantaStillTooSoon?�
  • Backups cost money$!
    • Hardware, software, media, personnel and storage.

​

​

19 of 37

Restoration Strategy? Well, it depends also …

  • Restoring from backups may not be effective if there are issues with backup devices.
    • Or not enough time allotted to complete the backup!

​

  • Restoration Strategies are important for checking and ensuring backups are performing to organizational requirements.
    • Read: Compliance & Auditing

​

​

20 of 37

Important Security Considerations

  • Encrypted backups … just do it! �
  • Don’t miss backups�
  • Verify backup completeness & correctness�
  • Protect from physical threats
    • Fire, water, moisture, dust, electromagnetic fields�
  • Safely transferred between hot & cold sites�
  • ALL Media has a end of life!�

​

​

21 of 37

Best Practices w/ Backup & Restore

  • Backups & Restores take LOTS of time, so planning is a thing�
  • Better have policies & procedures handy
    • When things go boom (and they will), you’ll be thankful later!�
  • Test, test, test, test, test, test, … and oh yeah, test again
    • “So we have a backup, just not sure what’s on it or when …”�
  • Inventory backup media
    • “Where’s last week’s backup tape?!”

​

  • Compliance + Auditing
    • “We don’t do backups because we like fines.”

​

​

​

​

22 of 37

Changing gears …

But with all these hardware backup devices & solutions …

​

What about the Cloud?

​

23 of 37

Question

What about is actually Cloud Computing?

​

24 of 37

Enter: The Cloud …

  • Provisioned to use applications, platforms, & infrastructure from a third party, and not your hardware.�
  • Cloud platforms may be access through browsers, smart phones, tablets, & hosts. �
  • Most cloud platforms are pay-as-you-go, or pay for what you use. �
  • Usually cheaper than standing up your own infrastructure to support same operations.�
  • Great for testing and development, as well as production!

​

25 of 37

The Cloud: 101

  • Cloud Service Models
    • Software as a Service (SaaS)
    • Platform as a Service (PaaS)
    • Infrastructure as a Service (IaaS)�
  • Four Deployment Models
    • Private Cloud
    • Public Cloud
    • Community Cloud
    • Hybrid Cloud

26 of 37

Software as a Service (SaaS)

  • Service where by a software vendor is able to offer their software solution to the masses.�
  • Often, this model is less expensive for orgs when compared to requirements of standing up their own servers & infrastructure to support same software in-house.�
  • Some examples of popular SaaS solutions are Salesforce.com, Zoho Office, justcloud.com, and Dropbox

​

27 of 37

Platform as a Service (PaaS)

  • Allows orgs to rent design, development, and testing platforms, software and utilities at significantly less cost and usually on and pay-as-you-go basis.

​

  • Widely available, even to orgs that may not have been able to afford them previously.

​

  • Most popular example: Googles Apps.

​

28 of 37

Infrastructure as a Service (IaaS)

  • IT infrastructure required by nearly all orgs, and usually requires significant investment�
  • Data Centers are heart of many orgs where servers, storage, virtualization, and applications live. �
  • IaaS transitions data center costs to more affordable budget�
  • Consumers of IaaS usually have limited control over networking in IaaS environments.�
  • Examples: AWS, RackSpace, BlueVM, Digital Ocean, Ravello

​

29 of 37

Cloud: Important Benefits

  • Upfront CAPEX vs. Pay as you use OPEX�
  • Elasticity (buzzword for Flexibility)�
  • Reduced specialized resources & maintenance … for you�
  • On-Demand, Self-Service Mode vs. Well-Planned Time-Consuming Ramp Up.�
  • Redundancy and Resilience vs. Single Point of Failure (SPoF)�
  • Cost of Traditional vs. cloud Disaster Recovery & Business Continuity�
  • Ease of use on Cloud Environment … once everything is there

30 of 37

Because orgs have different needs …

Four Deployment Models:

  • Private Cloud
  • Public Cloud
  • Community Cloud
  • Hybrid Cloud

​

31 of 37

Private Clouds

  • Needs driven by unique high security needs�
  • Comes at high CAPEX investment in hardware, network infrastructure, & high bandwidth internet connections.�
  • Additional infrastructure needed to support high-availability via redundancy

32 of 37

Public Clouds

  • Available to everyone�
  • Cheapest option�
  • Cloud providers rely upon huge infrastructure it shares with consumers.�
  • Best for new orgs such as start-ups and smaller orgs
    • Might not otherwise be able to afford such infrastructure and services.�
  • Because of multiple tenants using the same systems, it is often time difficult for public cloud providers to monitor consumers and therefore more difficult to assure high security.

33 of 37

Community Clouds

  • Orgs belonging to particular community
    • Healthcare, government, social services �
  • Maybe managed by one or more participating orgs in Community, or by 3rd party agency.�
  • Collaborative effort of the cloud helps spread costs across entire community.�
  • However, due to the nature of the collaboration, it may be more challenging ensure information security.
    • “Too many cooks in the kitchen”�
  • Cloud infrastructure is only as good as the orgs which directly provides and supports it.

34 of 37

Hybrid Cloud

  • Bet you can’t guess what this is?

35 of 37

Hybrid Cloud

  • You guessed it … a mix of cloud deployment models

​

  • Example: High security requirements and sensitive data may be deployed on Private cloud, while less important apps may use public cloud, and collaborative efforts may utilize Community Cloud.

36 of 37

“Cloud security” … really?

  • Compliance�
  • Lack of Segregation of Duties�
  • Complexity of the Cloud Computing System�
  • Shared Multi-tenant Environment
    • (read: different orgs & their data on same hardware)

​

  • Internet facing applications

​

37 of 37

“Cloud security” … really? (cont.)

  • Cloud apps & data requires lots of trust, faith, privacy and Service Level Agreements (SLAs)
    • Again, you’re running on someone else’s environment�
  • Usual issues … just bigger consequences:
    • Vulnerabilities, threats & attacks
    • Patching & hardening
    • Encryption
    • Logging & Auditing
    • Access Control
    • Physical Security is still a thing!

​

​

​