Welcome!

@CloudExpo Authors: Elizabeth White, Liz McMillan, Yeshim Deniz, Stackify Blog, ManageEngine IT Matters

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog, Cloud Security

@CloudExpo: Blog Feed Post

Securing Your ‘Data at Rest’ in the Cloud

Threat vectors in private, hybrid and public clouds

We’re all hungry for best practices and tips for securing data in the cloud and also how shared computer resources can and should work to ensure privacy and protection. The focus is on data security, especially data at rest.

Cloud computing is all about increased scalability and productivity. However, new cloud security threats such as “snapshotting” a virtual disk are emerging. These create new threats to private data, compared to when data was stored and secured between the four walls of a datacenter.

With cloud computing, multiple customers may share a single physical disk, although logically separated from each other. In theory, one can share the same physical disk with a competitor – without data crossing over. The same is true for physical servers. Equally, within a single cloud account, different projects may be sharing the same physical disks or physical servers. This virtualized approach is at the heart of cloud computing; it provides many of its benefits.

Best practices for such logical separation do exist and are well implemented by the best cloud providers. While essential, they do require the cloud user – the customer – to take some responsibility for securing data. To understand why, consider some of the threat vectors that do remain, even when logical separation is done right.

Threat vectors in private, hybrid and public clouds
Cloud technology is very powerful. It allows legitimate cloud customers to manage all of their disks and servers through a browser; for example it allows customers to easily copy or “snapshot” their disks, with a single cloud command. But consider a hacker who has obtained web access to a cloud account by stealing the Web User Interface (WUI) credentials or exposing a web vulnerability. That hacker can now also “snapshot” the disks.

Threat vectors can also exist because cloud accounts may contain multiple projects. This is a subtle point, because it applies to private clouds as well as public clouds.

People sometimes have pat answers for difficult questions; the “private vs. public” cloud debate is such a case. Some people claim private clouds answer all security questions. Private clouds are good, but the claim is exaggerated. This specific threat vector is an example. So here is how it goes.

You are a responsible professional and have properly secured your project in your company’s cloud account (whether public or private). However, your colleague at a different division has also set up a project, and – unfortunately – his virtual servers have a vulnerability. A hacker gains access to those servers and now that hacker is in your company’s cloud account. Depending on the exact details of the exploit, the damage to your project’s data security could be small or large. Obviously, this can happen even in a private cloud.

People often like to talk of the “insider” threat. Malicious insiders are rare – the insider threat is perhaps overplayed – but they are a painful possibility and these cases can cause huge damage when they do occur. Insiders can be at your own company or at the cloud provider. Just as with hackers, malicious insiders could misuse account credentials to access and misuse your data, or exploit their existing projects within your shared environment for malicious ends.

So what is an IT administrator going to do to secure data stored in the cloud?

The practicalities of trust and control for data in the cloud
One way to think of the cloud is as a great environment for outsourcing. Even private clouds mean that you are outsourcing your computing environment to some IT group inside your company, and public clouds are an obvious outsourcing situation.

Like any outsourcing situation, you want to outsource the hassle but keep the control. This is basically the attitude to take when going to the cloud.

It is important to remember that keeping control must happen at the project level – your project must be under your control. Segregating projects and defining how each project is protected independently of other projects is a good way to avoid many threat vectors.

Some of the rules for enforcing data security in the cloud are true in any data center scenario, not necessarily virtualized; and some are new or at least have a new emphasis.

Make sure your cloud, your software and your security tools allow you to enforce these general rules.

Define who has administrative access to the project.These are the people with the power to make big sweeping changes. Make sure it’s not just one person; what if that person is on vacation? But it must not be many people, and each person should have clear rules on what he or she can do.

Define who has user-level access to the project. Users may have access to data that administrators may not see. In fact, that is best practice. Make sure you manage your users and their rights to data.

Define fine-grained network controls. Make sure you can segregate your projects using networking techniques such as sub-nets and firewalls.

Define fine-grained authorization and authentication. Users and administrators should have clear identities, so you can control access to the resources they need; it should be possible to define fine-grained permissions for these identities. Some projects may require defining permissions for disk access, others for files, and still others for tables, rows or columns in a database.

Encrypt all sensitive data. Data in the cloud must be encrypted for security. There is simply no way to deal with the threat vectors mentioned above if data is not encrypted. This is an accepted fact by cloud data security experts.

Manage encryption keys carefully; otherwise, achieving confidentiality can prove difficult in the cloud. This is actually a major gotcha in cloud data security. The essential point is that encryption keys are the key to the kingdom, and you cannot trust anyone with your encryption keys.

It is obvious that you should not save your encryption keys in “plain”, on a disk in the cloud. But more than that, if you desire confidentiality, you cannot give your encryption keys to your cloud provider. The best providers will themselves tell you this, in a frank and helpful way – so ask them.

When it comes to encryption and encryption keys, you cannot trust anyone. There are several offers on the market that will try to tell you that you can trust them with your keys, so be aware.

There are several other offers on the market which do key management responsibly and well, but only by taking all of your encryption keys back to your physical data center. That kind of interferes with your goal of doing a cloud project.

Keeping trust and control while outsourcing complexity
While securing data at rest in cloud projects is entirely possible, it’s also a lot of work. Ideally, you’d like a solution which packages all this complexity.

The technological breakthroughs that enable pure cloud key management are split-key encryption and homomorphic key encryption. They provide the only way, currently on the market, to maintain complete confidentiality of data while staying 100 percent in the cloud.

This makes a large variety of projects possible and secure, including everything from disaster recovery and cloud bursting to pure cloud solutions. These types of encryption also maintain standards such as HIPAA, PCI DSS, SOX and SOC2.

But you need more than technology. Vendors need to be integrated with leading clouds and operating systems. This way, you can leverage valuable tools appropriate for the cloud of your choice, such as firewalls, virtual private networks, security groups and roles, authentication and authorization – together with your encryption and key management solution. A full solution is truly possible.

Securing a variety of data storage technologies
When it comes to data storage in the cloud, there is a wide range of options customers can choose from. These range from “plain” virtual disks, file systems (for Windows, Linux and UNIX), relational databases (Oracle, MySQL, MS SQL, IBM DB2 and others) and new and unique cloud options such as distributed storage (e.g. Simple Storage Service) or “NoSQL” databases (e.g. MongoDB). Furthermore, when it comes to databases, there is a choice to be made between fully encrypting the entire database, or encrypting at the finer granular level – at the table, row or column level, for example.

Such wide-ranging support requires “plugging in” to the cloud operating system at a very deep level, where the solution is transparent and fits well with most anything using the cloud environment. It also requires a cloud-enabled Application Programming Interface (API). A convenient User Interface doesn’t hurt either.

Gilad Parann-Nissany is the founder and CEO of Porticor (Ramat Hasharon, Israel). www.porticor.com

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
SYS-CON Events announced today that Progress, a global leader in application development, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Enterprises today are rapidly adopting the cloud, while continuing to retain business-critical/sensitive data inside the firewall. This is creating two separate data silos – one inside the firewall and the other outside the firewall. Cloud ISVs oft...
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists will examine how DevOps helps to meet th...
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory?
SYS-CON Events announced today that Cloudistics, an on-premises cloud computing company, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloudistics delivers a complete public cloud experience with composable on-premises infrastructures to medium and large enterprises. Its software-defined technology natively converges network, storage, compute, virtualization, and management into a ...
SYS-CON Events announced today that CollabNet, a global leader in enterprise software development, release automation and DevOps solutions, will be a Bronze Sponsor of SYS-CON's 20th International Cloud Expo®, taking place from June 6-8, 2017, at the Javits Center in New York City, NY. CollabNet offers a broad range of solutions with the mission of helping modern organizations deliver quality software at speed. The company’s latest innovation, the DevOps Lifecycle Manager (DLM), supports Value S...
SYS-CON Events announced today that Ocean9will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Ocean9 provides cloud services for Backup, Disaster Recovery (DRaaS) and instant Innovation, and redefines enterprise infrastructure with its cloud native subscription offerings for mission critical SAP workloads.
SYS-CON Events announced today that Systena America will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Systena Group has been in business for various software development and verification in Japan, US, ASEAN, and China by utilizing the knowledge we gained from all types of device development for various industries including smartphones (Android/iOS), wireless communication, security technology and IoT serv...
Multiple data types are pouring into IoT deployments. Data is coming in small packages as well as enormous files and data streams of many sizes. Widespread use of mobile devices adds to the total. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will look at the tools and environments that are being put to use in IoT deployments, as well as the team skills a modern enterprise IT shop needs to keep things running, get a handle on all this data, and deli...
We build IoT infrastructure products - when you have to integrate different devices, different systems and cloud you have to build an application to do that but we eliminate the need to build an application. Our products can integrate any device, any system, any cloud regardless of protocol," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
SYS-CON Events announced today that Infranics will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Since 2000, Infranics has developed SysMaster Suite, which is required for the stable and efficient management of ICT infrastructure. The ICT management solution developed and provided by Infranics continues to add intelligence to the ICT infrastructure through the IMC (Infra Management Cycle) based on mathemat...
SYS-CON Events announced today that Carbonite will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Carbonite protects your entire IT footprint with the right level of protection for each workload, ensuring lower costs and dependable solutions with DoubleTake and Evault.
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 21st International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. @ThingsExpo Silicon Valley Call for Papers is now open.
SYS-CON Events announced today that HTBase will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. HTBase (Gartner 2016 Cool Vendor) delivers a Composable IT infrastructure solution architected for agility and increased efficiency. It turns compute, storage, and fabric into fluid pools of resources that are easily composed and re-composed to meet each application’s needs. With HTBase, companies can quickly prov...
SYS-CON Events announced today that Juniper Networks (NYSE: JNPR), an industry leader in automated, scalable and secure networks, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Juniper Networks challenges the status quo with products, solutions and services that transform the economics of networking. The company co-innovates with customers and partners to deliver automated, scalable and secure network...
SYS-CON Events announced today that T-Mobile will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. As America's Un-carrier, T-Mobile US, Inc., is redefining the way consumers and businesses buy wireless services through leading product and service innovation. The Company's advanced nationwide 4G LTE network delivers outstanding wireless experiences to 67.4 million customers who are unwilling to compromise on ...
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
SYS-CON Events announced today that Hitachi Data Systems, a wholly owned subsidiary of Hitachi LTD., will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City. Hitachi Data Systems (HDS) will be featuring the Hitachi Content Platform (HCP) portfolio. This is the industry’s only offering that allows organizations to bring together object storage, file sync and share, cloud storage gateways, and sophisticated search and...
This talk centers around how to automate best practices in a multi-/hybrid-cloud world based on our work with customers like GE, Discovery Communications and Fannie Mae. Today’s enterprises are reaping the benefits of cloud computing, but also discovering many risks and challenges. In the age of DevOps and the decentralization of IT, it’s easy to over-provision resources, forget that instances are running, or unintentionally expose vulnerabilities.
The 21st International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Digital Transformation, Machine Learning and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding busin...