2 of 53

Cloud Computing

NIST defines cloud computing as follows:

“A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”

There is an increasingly prominent trend in many organizations to move a

substantial portion or even all information technology (IT) operations to an

Internet-connected infrastructure known as enterprise cloud computing. The use

of cloud computing raises a number of security issues, particularly in the area of

database security.

NIST defines cloud computing as follows [MELL11]:

A model for enabling ubiquitous, convenient, on-demand

network access to a shared pool of configurable computing resources (e.g.,

networks, servers, storage, applications, and services) that can be rapidly

provisioned and released with minimal management effort or service provider

interaction. This cloud model promotes availability and is composed of five

essential characteristics, three service models, and four deployment models.

3 of 53

Cloud Computing Elements

The definition refers to various models and characteristics, whose relationship is

illustrated in Figure 5.12 . The essential characteristics of cloud computing include

the following:

• Broad network access: Capabilities are available over the network and

accessed through standard mechanisms that promote use by heterogeneous

thin or thick client platforms (e.g., mobile phones, laptops, and PDAs) as well

as other traditional or cloud-based software services.

Rapid elasticity: Cloud computing gives you the ability to expand and

reduce resources according to your specific service requirement. For

example, you may need a large number of server resources for the duration

of a specific task. You can then release these resources upon completion of

the task.

• Measured service: Cloud systems automatically control and optimize

resource use by leveraging a metering capability at some level of abstraction

appropriate to the type of service (e.g., storage, processing, bandwidth, and

active user accounts). Resource usage can be monitored, controlled, and

reported, providing transparency for both the provider and consumer of the

utilized service.

• On-demand self-service: A consumer can unilaterally provision computing

capabilities, such as server time and network storage, as needed automatically

without requiring human interaction with each service provider. Because

the service is on demand, the resources are not permanent parts of your IT

infrastructure.

• Resource pooling: The provider’s computing resources are pooled to serve

multiple consumers using a multi-tenant model, with different physical and

virtual resources dynamically assigned and reassigned according to consumer

demand. There is a degree of location independence in that the customer

generally has no control or knowledge over the exact location of the provided

resources, but may be able to specify location at a higher level of abstraction

(e.g., country, state, or datacenter). Examples of resources include storage,

processing, memory, network bandwidth, and virtual machines. Even

private clouds tend to pool resources between different parts of the same

organization.

NIST defines three service models , which can be viewed as nested service

alternatives:

• Software as a service (SaaS): The capability provided to the consumer is to use

the provider’s applications running on a cloud infrastructure. The applications

are accessible from various client devices through a thin client interface

such as a Web browser. Instead of obtaining desktop and server licenses for

software products it uses, an enterprise obtains the same functions from the

cloud service. SaaS saves the complexity of software installation, maintenance,

upgrades, and patches.

• Platform as a service (PaaS): The capability provided to the consumer

is to deploy onto the cloud infrastructure consumer-created or acquired

applications created using programming languages and tools supported by the

provider. PaaS often provides middleware-style services such as database and

component services for use by applications.

• Infrastructure as a service (IaaS): The capability provided to the consumer is

to provision processing, storage, networks, and other fundamental computing

resources where the consumer is able to deploy and run arbitrary software,

which can include operating systems and applications.

NIST defines four deployment models :

• Public cloud: The cloud infrastructure is made available to the general

public or a large industry group and is owned by an organization selling

cloud services. Both the infrastructure and control of the cloud is with the

service provider.

• Private cloud: The cloud infrastructure is operated solely for an organization.

It may be managed by the organization or a third party and may exist on

premise or off premise. The cloud provider is responsible only for the

infrastructure and not for the control.

• Community cloud: The cloud infrastructure is shared by several organizations

and supports a specific community that has shared concerns (e.g., mission,

security requirements, policy, and compliance considerations). It may be

managed by the organizations or a third party and may exist on premise or

off premise.

• Hybrid cloud: The cloud infrastructure is a composition of two or more

clouds (private, community, or public) that remain unique entities but

are bound together by standardized or proprietary technology that enables

data and application portability (e.g., cloud bursting for load balancing

between clouds).

4 of 53

NIST defines three service models , which can be viewed as nested service

alternatives (Figure 5.12):

• Software as a service (SaaS): Provides service to customers in the form of

software, specifically application software, running on and accessible in the

cloud. SaaS follows the familiar model of Web services, in this case applied

to cloud resources. SaaS enables the customer to use the cloud provider’s

applications running on the provider’s cloud infrastructure. The applications

are accessible from various client devices through a simple interface such as

a Web browser. Instead of obtaining desktop and server licenses for software

products it uses, an enterprise obtains the same functions from the cloud service.

SaaS saves the complexity of software installation, maintenance, upgrades, and

patches. Examples of services at this level are Gmail, Google’s e-mail service,

and Salesforce.com, which helps firms keep track of their customers.

• Platform as a service (PaaS): Provides service to customers in the form of

a platform on which the customer’s applications can run. PaaS enables the

customer to deploy onto the cloud infrastructure customer-created or

acquired applications. A PaaS cloud provides useful software building blocks,

plus a number of development tools, such as programming languages, runtime

environments, and other tools that assist in deploying new applications

In effect, PaaS is an operating system in the cloud. PaaS is useful for an

organization that wants to develop new or tailored applications while paying

for the needed computing resources only as needed and only for as long as

needed. Google App Engine and the Salesforce1 Platform from Salesforce.

com are examples of PaaS.

• Infrastructure as a service (IaaS): Provides the customer access to the underlying

cloud infrastructure. IaaS provides virtual machines and other abstracted

hardware and operating systems, which may be controlled through a service

application programming interface (API). IaaS offers the customer processing,

storage, networks, and other fundamental computing resources so that

the customer is able to deploy and run arbitrary software, which can include

operating systems and applications. IaaS enables customers to combine basic

computing services, such as number crunching and data storage, to build highly

adaptable computer systems. Examples of IaaS are Amazon Elastic Compute

Cloud (Amazon EC2) and Windows Azure.

5 of 53

NIST Deployment Models

Public cloud

The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services
The cloud provider is responsible both for the cloud infrastructure and for the control of data and operations within the cloud

Private cloud

The cloud infrastructure is operated solely for an organization
It may be managed by the organization or a third party and may exist on premise or off premise
The cloud provider is responsible only for the infrastructure and not for the control

Community cloud

The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns
It may be managed by the organizations or a third party and may exist on premise or off premise

Hybrid cloud

The cloud infrastructure is a composition of two or more clouds that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability

NIST defines four deployment models :

• Public cloud: The cloud infrastructure is made available to the general public

or a large industry group and is owned by an organization selling cloud

services. The cloud provider is responsible both for the cloud infrastructure

and for the control of data and operations within the cloud.

• Private cloud: The cloud infrastructure is operated solely for an organization.

It may be managed by the organization or a third party and may exist on

premise or off premise. The cloud provider is responsible only for the

infrastructure and not for the control.

• Community cloud: The cloud infrastructure is shared by several organizations

and supports a specific community that has shared concerns (e.g., mission,

security requirements, policy, and compliance considerations). It may be

managed by the organizations or a third party and may exist on premise or

off premise.

• Hybrid cloud: The cloud infrastructure is a composition of two or more

clouds (private, community, or public) that remain unique entities but

are bound together by standardized or proprietary technology that enables

data and application portability (e.g., cloud bursting for load balancing

between clouds).

6 of 53

Cloud Computing Context

7 of 53

Cloud Fundamentals

8 of 53

The reference architecture, depicted in Figure 5.14, defines five major actors

in terms of the roles and responsibilities:

• Cloud consumer: A person or organization that maintains a business relationship

with, and uses service from, cloud providers.

• Cloud provider (CP): A person, organization, or entity responsible for making

a service available to interested parties.

• Cloud auditor: A party that can conduct independent assessment of cloud

services, information system operations, performance, and security of the

cloud implementation.

• Cloud broker: An entity that manages the use, performance and delivery of

cloud services, and negotiates relationships between CPs and cloud consumers.

• Cloud carrier: An intermediary that provides connectivity and transport of

cloud services from CPs to cloud consumers.

The roles of the cloud consumer and provider have already been discussed. To

summarize, a cloud provider can provide one or more of the cloud services to meet

IT and business requirements of cloud consumers . For each of the three service

models (SaaS, PaaS, and IaaS), the CP provides the storage and processing facilities

needed to support that service model, together with a cloud interface for cloud

service consumers. For SaaS, the CP deploys, configures, maintains, and updates the

operation of the software applications on a cloud infrastructure so that the services

are provisioned at the expected service levels to cloud consumers. The consumers

of SaaS can be organizations that provide their members with access to software

applications, end users who directly use software applications, or software application

administrators who configure applications for end users.

For PaaS, the CP manages the computing infrastructure for the platform and

runs the cloud software that provides the components of the platform, such as runtime

software execution stack, databases, and other middleware components. Cloud

consumers of PaaS can employ the tools and execution resources provided by CPs to

develop, test, deploy, and manage the applications hosted in a cloud environment.

For IaaS, the CP acquires the physical computing resources underlying the

service, including the servers, networks, storage, and hosting infrastructure. The

IaaS cloud consumer in turn uses these computing resources, such as a virtual computer,

for their fundamental computing needs.

The cloud carrier is a networking facility that provides connectivity and transport

of cloud services between cloud consumers and CPs. Typically, a CP will set up

service level agreements (SLAs) with a cloud carrier to provide services consistent

with the level of SLAs offered to cloud consumers, and may require the cloud carrier

to provide dedicated and secure connections between cloud consumers and CPs.

A cloud broker is useful when cloud services are too complex for a cloud consumer

to easily manage. Three areas of support can be offered by a cloud broker:

• Service intermediation: These are value-added services, such as identity management,

performance reporting, and enhanced security.

• Service aggregation: The broker combines multiple cloud services to meet

consumer needs not specifically addressed by a single CP, or to optimize performance

or minimize cost.

• Service arbitrage: This is similar to service aggregation except that the services

being aggregated are not fixed. Service arbitrage means a broker has the flexibility

to choose services from multiple agencies. The cloud broker, for example, can

use a credit-scoring service to measure and select an agency with the best score.

A cloud auditor can evaluate the services provided by a CP in terms of security

controls, privacy impact, performance, and so on. The auditor is an independent

entity that can assure that the CP conforms to a set of standards.

9 of 53

Cloud Security Risks

The Cloud Security Alliance lists the following as the top cloud specific security threats:

abuse and nefarious use of cloud computing
insecure interfaces and APIs
malicious insiders
shared technology issues
data loss or leakage
account or service hijacking
unknown risk profile

In general terms, security controls in cloud computing are similar to the security

controls in any IT environment. However, because of the operational models and

technologies used to enable cloud service, cloud computing may present risks that

are specific to the cloud environment. The essential concept in this regard is that

the enterprise loses a substantial amount of control over resources, services, and

applications but must maintain accountability for security and privacy policies.

The Cloud Security Alliance [CSA10] lists the following as the top

cloud-specific security threats:

• Abuse and nefarious use of cloud computing: For many cloud providers

(CPs), it is relatively easy to register and begin using cloud services, some

even offering free limited trial periods. This enables attackers to get inside the

cloud to conduct various attacks, such as spamming, malicious code attacks,

and denial of service. PaaS providers have traditionally suffered most from

this kind of attacks; however, recent evidence shows that hackers have begun

to target IaaS vendors as well. The burden is on the CP to protect against such

attacks, but cloud service clients must monitor activity with respect to their

data and resources to detect any malicious behavior.

Insecure interfaces and APIs: CPs expose a set of software interfaces or APIs

that customers use to manage and interact with cloud services. The security

and availability of general cloud services is dependent upon the security of

these basic APIs. From authentication and access control to encryption and

activity monitoring, these interfaces must be designed to protect against both

accidental and malicious attempts to circumvent policy.

• Malicious insiders: Under the cloud computing paradigm, an organization

relinquishes direct control over many aspects of security and, in doing so,

confers an unprecedented level of trust onto the CP. One grave concern is the

risk of malicious insider activity. Cloud architectures necessitate certain roles

that are extremely high-risk. Examples include CP system administrators and

managed security service providers.

• Shared technology issues: IaaS vendors deliver their services in a scalable

way by sharing infrastructure. Often, the underlying components that make

up this infrastructure (CPU caches, GPUs, etc.) were not designed to offer

strong isolation properties for a multi-tenant architecture. CPs typically

approach this risk by the use of isolated virtual machines for individual clients.

This approach is still vulnerable to attack, by both insiders and outsiders, and

so can only be a part of an overall security strategy.

• Data loss or leakage: For many clients, the most devastating impact from a

security breach is the loss or leakage of data. We address this issue in the next

subsection.

• Account or service hijacking: Account and service hijacking, usually with

stolen credentials, remains a top threat. With stolen credentials, attackers

can often access critical areas of deployed cloud computing services, allowing

them to compromise the confidentiality, integrity, and availability of those

services.

• Unknown risk profile: In using cloud infrastructures, the client necessarily

cedes control to the cloud provider on a number of issues that may affect

security. Thus the client must pay attention to and clearly define the roles

and responsibilities involved for managing risks. For example, employees

may deploy applications and data resources at the CP without observing the

normal policies and procedures for privacy, security, and oversight.

Similar lists have been developed by the European Network and Information

Security Agency [ENIS09] and NIST [JANS11].

10 of 53

Data Protection in the Cloud

the threat of data compromise increases in the cloud

risks and challenges that are unique to the cloud

architectural or operational characteristics of the cloud environment

multi-instance model

provides a unique DBMS running on a virtual machine instance for each cloud subscriber

gives the subscriber complete control over administrative tasks related to security

multi-tenant model

provides a predefined environment for the cloud subscriber that is shared with other tenants typically through tagging data with a subscriber identifier

gives the appearance of exclusive use of the instance but relies on the cloud provider to establish and maintain a secure database environment

There are many ways to compromise data. Deletion or alteration of records without

a backup of the original content is an obvious example. Unlinking a record from

a larger context may render it unrecoverable, as can storage on unreliable media.

Loss of an encoding key may result in effective destruction. Finally, unauthorized

parties must be prevented from gaining access to sensitive data.

The threat of data compromise increases in the cloud, due to the number of

and interactions between risks and challenges that are either unique to the cloud or

more dangerous because of the architectural or operational characteristics of the

cloud environment.

Database environments used in cloud computing can vary significantly.

Some providers support a multi-instance model , which provides a unique DBMS

running on a virtual machine instance for each cloud subscriber. This gives the

subscriber complete control over role definition, user authorization, and other

administrative tasks related to security. Other providers support a multi-tenant

model , which provides a predefined environment for the cloud subscriber that

is shared with other tenants, typically through tagging data with a subscriber

identifier. Tagging gives the appearance of exclusive use of the instance, but

relies on the cloud provider to establish and maintain a sound secure database

environment.

Data must be secured while at rest, in transit, and in use, and access to the

data must be controlled. The client can employ encryption to protect data in transit,

though this involves key management responsibilities for the CP. The client can

enforce access control techniques but, again, the CP is involved to some extent

depending on the service model used.

For data at rest, the ideal security measure is for the client to encrypt

the database and only store encrypted data in the cloud, with the CP having no access

to the encryption key. So long as the key remains secure, the CP has no ability to read

the data, although corruption and other denial-of-service attacks remain a risk. The

model depicted in Figure 5.10 works equally well when the data is stored in a cloud.

11 of 53

Cloud Security As A Service

SecaaS

Is a segment of the SaaS offering of a CP

Defined by The Cloud Security Alliance as

the provision of security applications and services via the cloud

either to cloud-based infrastructure and software or from the cloud to the customers’ on-premise systems

The term security as a service has generally meant a package of security services

offered by a service provider that offloads much of the security responsibility

from an enterprise to the security service provider. Among the services typically

provided are authentication, anti-virus, antimalware/spyware, intrusion detection,

and security event management. In the context of cloud computing, cloud security

as a service, designated SecaaS, is a segment of the SaaS offering of a CP.

The Cloud Security Alliance defines SecaaS as the provision of security

applications and services via the cloud either to cloud-based infrastructure and

software or from the cloud to the customers’ on-premise systems (Table 5.4)

[CSA11b]. The Cloud Security Alliance has identified the following SecaaS categories

of service:

• Identity and access management

• Data loss prevention

• Web security

• E-mail security

• Security assessments

• Intrusion management

• Security information and event management

• Encryption

• Business continuity and disaster recovery

• Network security

12 of 53

In this section, we examine these categories with a focus on security of the

cloud-based infrastructure and services (Figure 5.15).

Identity and access management (IAM) includes people, processes, and systems

that are used to manage access to enterprise resources by assuring that the

identity of an entity is verified, and then granting the correct level of access based

on this assured identity. One aspect of identity management is identity provisioning,

which has to do with providing access to identified users and subsequently deprovisioning,

or denying access, to users when the client enterprise designates such users

as no longer having access to enterprise resources in the cloud. Another aspect of

identity management is for the cloud to participate in the federated identity management

scheme (see Chapter 15) used by the client enterprise. Among other

requirements, the cloud service provider (CSP) must be able to exchange identity

attributes with the enterprise’s chosen identity provider.

The access management portion of IAM involves authentication and access

control services. For example, the CSP must be able to authenticate users in a

trustworthy manner. The access control requirements in SPI environments include

establishing trusted user profile and policy information, using it to control access

within the cloud service, and doing this in an auditable way.

Data loss prevention (DLP) is the monitoring, protecting, and verifying the

security of data at rest, in motion, and in use. Much of DLP can be implemented by

the cloud client, such as discussed in Section 16.6. The CSP can also provide DLP

services, such as implementing rules about what functions can be performed on data

in various contexts.

Web security is real-time protection offered either on premise through software/

appliance installation or via the Cloud by proxying or redirecting Web traffic to

the CP. This provides an added layer of protection on top of things like antiviruses

to prevent malware from entering the enterprise via activities such as Web browsing.

In addition to protecting against malware, a cloud-based Web security service might

include usage policy enforcement, data backup, traffic control, and Web access

control.

A CSP may provide a Web-based e-mail service, for which security measures

are needed. E-mail security provides control over inbound and outbound email,

protecting the organization from phishing, malicious attachments, enforcing corporate

polices such as acceptable use and spam prevention. The CSP may also incorporate

digital signatures on all e-mail clients and provide optional e-mail encryption.

Security assessments are third-part audits of cloud services. While this service

is outside the province of the CSP, the CSP can provide tools and access points to

facilitate various assessment activities.

Intrusion management encompasses intrusion detection, prevention, and

response. The core of this service is the implementation of intrusion detection systems

(IDSs) and intrusion prevention systems (IPSs) at entry points to the cloud

and on servers in the cloud. An IDS is a set of automated tools designed to detect

unauthorized access to a host system. We discuss this in Chapter 21. An IPS incor-

porates IDS functionality but also includes mechanisms designed to block traffic

from intruders.

Security information and event management (SIEM) aggregates (via push or

pull mechanisms) log and event data from virtual and real networks, applications,

and systems. This information is then correlated and analyzed to provide real-time

reporting and alerting on information/events that may require intervention or other

type of response. The CSP typically provides an integrated service that can put

together information from a variety of sources both within the cloud and within the

client enterprise network.

Encryption is a pervasive service that can be provided for data at rest in the

cloud, e-mail traffic, client-specific network management information, and identity

information. Encryption services provided by the CSP involve a range of complex

issues, including key management, how to implement virtual private network

(VPN) services in the cloud, application encryption, and data content access.

Business continuity and disaster recovery comprise measures and mechanisms

to ensure operational resiliency in the event of any service interruptions.

This is an area where the CSP, because of economies of scale, can offer obvious

benefits to a cloud service client [WOOD10]. The CSP can provide backup

at multiple locations, with reliable failover and disaster recovery facilities. This

service must include a flexible infrastructure, redundancy of functions and hardware,

monitored operations, geographically distributed data centers, and network

survivability.

Network security consists of security services that allocate access, distribute,

monitor, and protect the underlying resource services. Services include perimeter

and server firewalls and denial-of-service protection. Many of the other services

listed in this section, including intrusion management, identity and access management,

data loss protection, and Web security, also contribute to the network security

service.

13 of 53

Traditional systems security �vs�Cloud Computing Security

Securing a house

Securing a motel

Owner and user are often the same entity

Owner and users are almost invariably distinct entities

Analogy

14 of 53

Traditional systems security �vs�Cloud Computing Security

Securing a house

Securing a motel

Biggest user concerns

Securing perimeter

Checking for intruders

Securing assets

Biggest user concern

Securing room against (the bad guy in next room | hotel owner)

15 of 53

Who is the attacker?

Insider?

Malicious employees at client
Malicious employees at Cloud provider
Cloud provider itself

Outsider?

Intruders
Network attackers?

16 of 53

Attacker Capability: Malicious Insiders

At client

Learn passwords/authentication information
Gain control of the VMs

At cloud provider

Log client communication

17 of 53

Attacker Capability: Cloud Provider

What?

Can read unencrypted data
Can possibly peek into VMs, or make copies of VMs
Can monitor network communication, application patterns

18 of 53

Attacker motivation: Cloud Provider

Why?

Gain information about client data
Gain information on client behavior
Sell the information or use itself

Why not?

Cheaper to be honest?

Why? (again)

Third party clouds?

19 of 53

Attacker Capability: Outside attacker

What?

Listen to network traffic (passive)
Insert malicious traffic (active)
Probe cloud structure (active)
Launch DoS

20 of 53

Novel attacks on clouds

Question: Can you attack a cloud or other users, without violating any law?

Answer: Yes!! By launching side channel attacks, while not violating Acceptable User Policy.

A Side Channel is a passive attack in which attacker gains information about target through indirect observations.

21 of 53

Why Cloud Computing brings new threats?

Traditional system security mostly means keeping bad guys out

The attacker needs to either compromise the auth/access control system, or impersonate existing users

22 of 53

Why Cloud Computing brings new threats?

But clouds allow co-tenancy :

Multiple independent users share the same physical infrastructure

So, an attacker can legitimately be in the same physical machine as the target

23 of 53

Challenges for the attacker

How to find out where the target is located

How to be co-located with the target in the same (physical) machine

How to gather information about the target

24 of 53

25 of 53

Cloud Cartography Strategy

Map the cloud infrastructure to find where the target is located
Use various heuristics to determine co-residency of two VMs
Launch probe VMs trying to be co-resident with target VMs
Exploit cross-VM leakage to gather info about target

26 of 53

Clouds extend the attack surface

An attack surface is a vulnerability in a system that malicious users may utilize

How?

By requiring users to communicate with the cloud over a public / insecure network
By sharing the infrastructure among multiple users

27 of 53

Analyzing Attack Surfaces in Clouds

Figure from: Gruschka et al., Attack Surfaces: A Taxonomy for Attacks on Cloud Services.

Cloud attack surfaces can be modeled using a 3 entity model (user, service, cloud)

28 of 53

Attack Surface: 1

Service interface exposed towards clients

Possible attacks: Common attacks in client-server architectures

E.g., Buffer overflow, SQL injection, privilege escalation

29 of 53

Attack Surface: 2

User exposed to the service

Common attacks

E.g., SSL certificate spoofing, phishing

30 of 53

Attack Surface: 3

Cloud resources/interfaces exposed to service

Attacks run by service on cloud infrastructure

E.g., Resource exhaustion, DoS

31 of 53

Attack Surface: 4

Service interface exposed to cloud

Privacy attack
Data integrity attack
Data confidentiality attack

32 of 53

Attack Surface: 5

Cloud interface exposed to users

Attacks on cloud control

33 of 53

Attack Surface: 6

User exposed to cloud

How much the cloud can learn about a user?

34 of 53

Problems Associated with Cloud Computing

Most security problems stem from:

Loss of control
Lack of trust (mechanisms)
Multi-tenancy

These problems exist mainly in 3^rd party management models

Self-managed clouds still have security issues, but not related to above

35 of 53

Loss of Control in the Cloud

Consumer’s loss of control

Data, applications, resources are located with provider
User identity management is handled by the cloud
User access control rules, security policies and enforcement are managed by the cloud provider
Consumer relies on provider to ensure

Data security and privacy
Resource availability
Monitoring and repairing of services/resources

36 of 53

Lack of Trust in the Cloud

Trusting a third party requires taking risks

Defining trust and risk

Opposite sides of the same coin (J. Camp)
People only trust when it pays (Economist’s view)
Need for trust arises only in risky situations

Defunct third party management schemes

Hard to balance trust and risk
e.g. Key Escrow (Clipper chip)
Is the cloud headed toward the same path?

37 of 53

Multi-tenancy Issues in the Cloud

Conflict between tenants’ opposing goals

Tenants share a pool of resources and have opposing goals

How does multi-tenancy deal with conflict of interest?

Can tenants get along together and ‘play nicely’ ?
If they can’t, can we isolate them?

How to provide separation between tenants?

Cloud Computing brings new threats

Multiple independent users share the same physical infrastructure
Thus an attacker can legitimately be in the same physical machine as the target

38 of 53

Cloud Security Issues

Confidentiality

Fear of loss of control over data

Will the sensitive data stored on a cloud remain confidential?
Will cloud compromises leak confidential client data

Will the cloud provider itself be honest and won’t peek into the data?

Integrity

How do I know that the cloud provider is doing the computations correctly?
How do I ensure that the cloud provider really stored my data without tampering with it?

39 of 53

Cloud Security Issues (cont.)

Availability

Will critical systems go down at the client, if the provider is attacked in a Denial of Service attack?
What happens if cloud provider goes out of business?
Would cloud scale well-enough?
Often-voiced concern

Although cloud providers argue their downtime compares well with cloud user’s own data centers

40 of 53

Cloud Security Issues (cont.)

Privacy issues raised via massive data mining

Cloud now stores data from a lot of clients, and can run data mining algorithms to get large amounts of information on clients

Increased attack surface

Entity outside the organization now stores and computes data, and so
Attackers can now target the communication link between cloud provider and client
Cloud provider employees can be phished

41 of 53

Cloud Security Issues (cont.)

Auditability and forensics (out of control of data)

Difficult to audit data held outside organization in a cloud
Forensics also made difficult since now clients don’t maintain data locally

Legal dilemma and transitive trust issues

Who is responsible for complying with regulations?

e.g., SOX, HIPAA, GLBA ?

If cloud provider subcontracts to third party clouds, will the data still be secure?

42 of 53

Cloud Security Issues (cont.)

Security is one of the most difficult task to implement in cloud computing.

Different forms of attacks in the application side and in the hardware components

Attacks with catastrophic effects only needs one security flaw

Cloud Computing is a security nightmare and it can't be handled in traditional ways.

John Chambers

CISCO CEO

43 of 53

Possible Solutions

44 of 53

Minimize Lack of Trust: Policy Language

Consumers have specific security needs but don’t have a say-so in how they are handled

Currently consumers cannot dictate their requirements to the provider (SLAs are one-sided)

Standard language to convey one’s policies and expectations

Agreed upon and upheld by both parties
Standard language for representing SLAs

Create policy language with the following characteristics:

Machine-understandable (or at least processable),
Easy to combine/merge and compare

These SLAs typically state the high level policies of the provider (e.g. Will maintain uptime of 98%) and do not allow cloud consumers to dictate their requirements to the provider. COI clouds in particular have specific security policy requirements that must be met by the provider, due to the nature of COIs and the missions they are used for. These requirements need to be communicated to the provider and the provider needs to provide some way of stating that the requirements can be met. Cloud consumers and providers need a standard way of representing their security requirements and capabilities. Consumers also need a way to verify that the provided infrastructure and its purported security mechanisms meet the requirements stated in the consumer’s policy (proof of assertions). For example, if the consumer’s policy requires isolation of VMs, the provider can create an assertion statement that says it uses cache separation to support VM isolation.

45 of 53

Minimize Lack of Trust: Certification

Certification

Some form of reputable, independent, comparable assessment and description of security features and assurance

Sarbanes-Oxley, DIACAP, DISTCAP, etc

Risk assessment

Performed by certified third parties
Provides consumers with additional assurance

46 of 53

Minimize Loss of Control: Monitoring

Cloud consumer needs situational awareness for critical applications

When underlying components fail, what is the effect of the failure to the mission logic
What recovery measures can be taken

by provider and consumer

Requires an application-specific run-time monitoring and management tool for the consumer

The cloud consumer and cloud provider have different views of the system
Enable both the provider and tenants to monitor the components in the cloud that are under their control

When the underlying components fail in the cloud, the effect of the failures to the mission logic needs to be known so that correct recovery measures can be performed. We propose an application-specific run-time monitoring and management tool. With this tool, the application logic can remain on the consumer’s host computer. This allows the consumer to centrally monitor all aspects of the application as well as data flow. Since all outputs from underlying services are sent to the application logic, any data incompatibility between services is not an issue. The capabilities of the run-time monitoring and management tool are as follows: 1) Enable application user to determine the status of the cloud resources that may be used to run the application (across multiple clouds), 2) Enable application user to determine the real-time security posture and situational awareness of the application, 3) Provide the application user with the ability to move user’s application (or part of it) to another site (other VM in same cloud or different cloud altogether), 4) Provide the application user with the ability to change the application logic on the fly, 5) Provide communicate capabilities with cloud providers. There are a few cloud vendors such as NimSoft [41] and Hyperic [42] that provide application-specific monitoring tools that provide some of the above functionality. These monitoring tools may be further enhanced or used in conjunction with other tools to provide the degree of monitoring required. However, any tool that is to be used for military purposes must also receive some type of accreditation and certification procedure.

47 of 53

Minimize Loss of Control: Monitoring

Provide mechanisms that enable the provider to act on attacks he can handle.

infrastructure remapping

create new or move existing fault domains

shutting down offending components or targets

and assisting tenants with porting if necessary

Repairs

Provide mechanisms that enable the consumer to act on attacks that he can handle

application-level monitoring
RAdAC (Risk-adaptable Access Control)
VM porting with remote attestation of target physical host
Provide ability to move the user’s application to another cloud

48 of 53

Minimize Loss of Control: Utilize Different Clouds

The concept of ‘Don’t put all your eggs in one basket’

Consumer may use services from different clouds through an intra-cloud or multi-cloud architecture
A multi-cloud or intra-cloud architecture in which consumers

Spread the risk
Increase redundancy (per-task or per-application)
Increase chance of mission completion for critical applications

Possible issues to consider:

Policy incompatibility (combined, what is the overarching policy?)
Data dependency between clouds
Differing data semantics across clouds
Knowing when to utilize the redundancy feature

monitoring technology

Is it worth it to spread your sensitive data across multiple clouds?

Redundancy could increase risk of exposure

49 of 53

Minimize Loss of Control: Access Control

Many possible layers of access control

E.g. access to the cloud, access to servers, access to services, access to databases (direct and queries via web services), access to VMs, and access to objects within a VM
Depending on the deployment model used, some of these will be controlled by the provider and others by the consumer

Regardless of deployment model, provider needs to manage the user authentication and access control procedures (to the cloud)

Federated Identity Management: access control management burden still lies with the provider
Requires user to place a large amount of trust on the provider in terms of security, management, and maintenance of access control policies.

This can be burdensome when numerous users from different organizations with different access control policies, are involved

In cloud computing (as well as other systems), there are many possible layers of access control. For example, access to the cloud, access to servers, access to services, access to databases (direct and queries via web services), access to VMs, and access to objects within a VM. Depending on the deployment model used, some of these will be controlled by the provider and others by the consumer.

For example, Google Apps, a representative SaaS Cloud controls authentication and access to its applications, but users themselves can control access to their documents through the provided interface to the access control mechanism. In IaaS type approaches, the user can create accounts on its virtual machines and create access control lists for these users for services located on the VM.

Regardless of the deployment model, the provider needs to manage the user authentication and access control procedures (to the cloud). While some providers allow federated authentication – enabling the consumer-side to manage its users, the access control management burden still lies with the provider. This requires the user to place a large amount of trust on the provider in terms of security, management, and maintenance of access control policies. This can be burdensome when numerous users from different organizations with different access control policies, are involved. This proposal focuses on access control to the cloud. However, the concepts here could be applied to access control at any level, if deemed necessary. We propose a way for the consumer to manage the access control decision-making process to retain some control, requiring less trust of the provider.

Approach:

This approach requires the client and provider to have a pre-existing trust relationship, as well as a pre-negotiated standard way of describing resources, users, and access decisions between the cloud provider and consumer. It also needs to be able to guarantee that the provider will uphold the consumer-side’s access decisions. Furthermore, we need to show that this approach is at least as secure as the traditional access control model.

This approach requires the data owner to be involved in all requests. Therefore, frequent access scenarios should not use this method if traffic is a concern. However, many secure data outsourcing schemes require the user to grant keys/certificates to the query side, so that every time the user queries a database, the owner needs to be involved. Therefore, not much different than that so may not be a problem.

50 of 53

Minimize Loss of Control: Access Control

Consumer-managed access control

Consumer retains decision-making process to retain some control, requiring less trust of the provider
Requires the client and provider to have a pre-existing trust relationship, as well as a pre-negotiated standard way of describing resources, users, and access decisions between the cloud provider and consumer.

It also needs to be able to guarantee that the provider will uphold the consumer-side’s access decisions.

Should be at least as secure as the traditional access control model.

51 of 53

Minimize Loss of Control: �Access Control

Policy

Enforcement

Point

(intercepts all

resource

access requests

from all client

domains)

Policy

Decision

Point

for cloud

resource

on Domain A

Cloud Consumer in Domain B

ACM

(XACML

policies)

resources

Cloud Provider in Domain A

IDP

1. Authn request

2. SAML Assertion

3. Resource request (XACML Request) + SAML assertion

4. Redirect to domain of resource owner

7. Send signed and encrypted ticket

5. Retrieve policy

for specified resource

6. Determine whether user can access

specified resource

7. Create ticket for grant/deny

8. Decrypt and verify signature

9. Retrieve capability from ticket

10. Grant or deny access based on capability

Identity

Provider

eXtensible Access Control Markup Language

Security Assertion Markup Language

1 of 53

2 of 53

3 of 53

4 of 53

5 of 53

6 of 53

7 of 53

8 of 53

9 of 53

10 of 53

11 of 53

12 of 53

13 of 53

14 of 53

15 of 53

16 of 53

17 of 53

18 of 53

19 of 53

20 of 53

21 of 53

22 of 53

23 of 53

24 of 53

25 of 53

26 of 53

27 of 53

28 of 53

29 of 53

30 of 53

31 of 53

32 of 53

33 of 53

34 of 53

35 of 53

36 of 53

37 of 53

38 of 53

39 of 53

40 of 53

41 of 53

42 of 53

43 of 53

44 of 53

45 of 53

46 of 53

47 of 53

48 of 53

49 of 53

50 of 53

51 of 53

52 of 53

53 of 53