Click here to close now.

Welcome!

Cloud Expo Authors: Elizabeth White, Pat Romanski, Carmen Gonzalez, Liz McMillan, John Wetherill

Blog Feed Post

Answering Common Cloud Security Questions from CIOs

Cloud Security Cloud Key Management Cloud Encryption CIO  infoq cloud security Answering Common Cloud Security Questions from CIOsfrom InfoQ.com: With the news stories of possible data breaches at enterprises like Target, and the current trend of companies migrating to cloud environments for the flexibility, scalability, agility, and cost-effectiveness they offer, CIOs have been asking hard questions about cloud security.

As CIO, protecting your data (and your users) is one of your key responsibilities. Whether you already have some cloud projects running or are starting your first cloud project, these questions and answers may provide you with solutions and introduce some new techniques.

InfoQ: Is the cloud safe?

Gilad: The cloud, by definition, is not more or less safe than your own data center. As an interesting note, the recent media storm around the NSA, which started as a “cloud computing security” story, has morphed into a more general discussion. It turns out the NSA is able to eavesdrop on physical servers in physical data centers and has actually done so at many of the world’s most secure organizations.

Today, cloud computing has been discovered as safe and effective for a wide range of projects and data types, ranging across most vertical industries and market niches. Regulated, sensitive areas such as finance, health, legal, retail or government – are all in various stages of going to the cloud..

However, just like certain security precautions are taken in the physical world, cloud security also entails taking the appropriate precautions.

InfoQ: How does migrating to the cloud change my risks?

Gilad: Migrating applications and data to the cloud obviously shifts some responsibilities from your own data center to the cloud provider. It is an act of outsourcing. As such, it always involves a shift of control. Taking back control involves procedures and technology.

Cloud computing may be seen – in some aspects – as revolutionary; yet in other aspects it is evolutionary. Any study of controlling risks should start out by understanding this point. Many of the things we have learned in data centers evolve naturally to the cloud. The need for proper procedures is unchanged. Many of the technologies are also evolving naturally.

You should therefore start by mapping out your current procedures and current security-related technologies, and see how they evolve to the cloud. In many cases you’ll see a correspondence.

You’ll find however, that some areas really are a revolution. Clouds do not have walls, so physical security does not map well from the data center to the cloud. Clouds involve employees of the cloud service provider, so you need to find ways to control people who do not work for you. These are significant changes, and they require new technology and new procedures.

InfoQ: What are the most important aspects of a cloud security policy?

Gilad: Continuing the themes of evolution and revolution, some aspects of cloud security will seem familiar. Firewalls, antivirus, and authentication – are evolving to the world of cloud computing. You will find that your cloud provider often offers you solutions in these areas; and traditional vendors are evolving their solutions as well.

Some aspects may change your current thinking. Since clouds do not have walls, and cloud employees could see your data – you must create metaphoric walls around your data. In cloud scenarios, data encryption is the recognized best practice for these new needs.

Incidentally, data encryption also helps with a traditional data center need – most data breaches happen from the inside, so the threat is not just from cloud employees. However, there is no question that the threat from cloud insiders has shined a new spotlight on the need for data encryption.

InfoQ: What is the best practice for encrypting cloud data?

Gilad: You should encrypt data at rest and in motion. Encrypting “in motion” is already well known to you – the standards of HTTPS/SSL and IPSEC apply equally well in the data center and in the cloud.

Encrypting “at rest” means that the data must be encrypted when it resides on a disk, in a database, on a file system, in storage, and of course if it is backed up. In the real world, people have not always done this in data centers – often relying on physical security as a replacement. In the cloud, physical security is no alternative – you must encrypt sensitive data.

This actually means data must be encrypted constantly as it is being written, and decrypted only when it is going to be used (i.e. just before a specific calculation, and only in memory). Standards such as Advanced Encryption Standard (AES) are commonly used for data encryption at rest.

InfoQ: Does cloud encryption singlehandedly protect data?

Gilad: If data is properly encrypted it is, in a sense, locked and cannot be used if it falls into the wrong hands. Unless, of course, those hands have a key.

Proper management of encryption keys is as important as the encryption itself. In fact, if you keep your encryption keys to yourself – you keep ownership of your data. This is an interesting and fundamental point – in the cloud you are outsourcing your infrastructure, but you can maintain ownership by keeping the encryption keys.

If encryption keys are stored alongside the data, any breach that discloses the data will also disclose the key to access it. If encryption keys are stored with cloud providers, they own your data.

Think of your data like a safe deposit box – would you leave your key with the banker? What if he gets robbed? What if his employees are paid to make copies of your key?

A best practice is split key encryption. With this method, your data is encrypted (e.g. with AES), and then the encryption key is split into parts. One part is managed with a cloud security provider and one part stays only with you. This way, only you control access to your data.

Even if your encrypted data is compromised, the perpetrators will not be able to decrypt it and it will be useless to them.

InfoQ: How can encryption keys be protected while they are in use?

Gilad: Keys in use in the cloud do not have to be vulnerable. They can be protected using homomorphic key management. This cryptographic technique gives the application access to the data store without ever exposing the master keys to the encryption – in an unencrypted state. It also ensures that if such (encrypted) keys are stolen, they can still never be used to access your data store

InfoQ: Is cloud data encryption in compliance with regulations?

Gilad: Regulations like Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and many others (GLBA, FINRA, PIPEDA, et al) require or encourage cloud data to be properly encrypted and encryption keys to be properly managed. Some of these regulations even provide for a sort of “safe harbor” – that is, if your data is breached, but you can prove that you took the necessary steps to encrypt it and maintain control of the encryption keys, you may save the financial burden, the bureaucratic reporting requirements, and the damage to reputation involved with such an event.

InfoQ: Is cloud security cost-prohibitive and will it harm system performance?

Gilad: The cloud is often chosen for its lower operational overhead, and sometimes for actual dollar savings, compared with traditional data centers. Securing a cloud project does not need to negate the cloud’s ease of use nor make the project prohibitively expensive.

There are security solutions that require no hardware and, therefore, no large cap-ex investment. Pay-as-you-go business models make it easy to scale security up (or down) with the size of your project, as you add (or remove) virtual machines and data.

Performance can also be good. Modern cloud security virtual appliances and virtual agents – are optimized for cloud throughput and latency. You’ll be able to dial up performance as your cloud project scales up. To take a concrete example – data encryption – good solutions will include a capability to stream data as it is being encrypted (or decrypted), and do so inside your cloud account. Such approaches mean that virtual CPUs available in your cloud will be able to handle your performance needs with low latency.

InfoQ: Is there a way to protect cloud backups and disaster recovery?

Gilad: Data must be secured throughout its lifecycle. Properly encrypting data while it is in use, but then offering hackers unencrypted replicas as backups defeats the purpose of encrypting in the first place. You must encrypt and own the encryption keys for every point of the lifecycle of your information. Fortunately solutions that are built for the cloud do exist, and they should cover backups as well as primary copies.

InfoQ: What it more secure: a public cloud or a private cloud?

Gilad: Public and private clouds each have pros and cons in terms of ownership, control, cost, convenience and multi-tenancy. We have found that private clouds often require security controls similar to public ones. Use cases may involve users external to your company; or large “virtual” deployments with multiple internal projects, each with a need for strong security segregation. Your data can be properly encrypted, your keys can be properly managed, and you can be safe in all the major cloud scenarios: private, public, or hybrid.

InfoQ: If my data is in the cloud, my security is in the cloud, and my backup is in the cloud, what do I control?

Gilad: If you use encryption properly and maintain control of the encryption keys, you have replaced your physical walls with mathematical walls. You will own your data. Even though you do not control the physical resources, you maintain control of what they contain. This is one reason why encryption in the cloud is the best practice.

By properly using multiple regions or even multiple cloud providers, you can also ensure that you always have availability and access to your project and your data.

By combining such techniques, you do take back control. As CIO and owner of your data, you must always control your data – from beginning to end. Your control does not need to be sacrificed when you migrate to the cloud, though it may need to be managed differently.

 

 

 

The post Answering Common Cloud Security Questions from CIOs appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
17th Cloud Expo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterprises a...
Thanks to Docker, it becomes very easy to leverage containers to build, ship, and run any Linux application on any kind of infrastructure. Docker is particularly helpful for microservice architectures because their successful implementation relies on a fast, efficient deployment mechanism – which is precisely one of the features of Docker. Microservice architectures are therefore becoming more popular, and are increasingly seen as an interesting option even for smaller projects, instead of bein...
Move from reactive to proactive cloud management in a heterogeneous cloud infrastructure. In his session at 16th Cloud Expo, Manoj Khabe, Innovative Solution-Focused Transformation Leader at Vicom Computer Services, Inc., will show how to replace a help desk-centric approach with an ITIL-based service model and service-centric CMDB that’s tightly integrated with an event and incident management platform. Learn how to expand the scope of operations management to service management. He will al...
The Workspace-as-a-Service (WaaS) market will grow to $6.4B by 2018. In his session at 16th Cloud Expo, Seth Bostock, CEO of IndependenceIT, will begin by walking the audience through the evolution of Workspace as-a-Service, where it is now vs. where it going. To look beyond the desktop we must understand exactly what WaaS is, who the users are, and where it is going in the future. IT departments, ISVs and service providers must look to workflow and automation capabilities to adapt to growing ...
In this scenarios approach Joe Thykattil, Technology Architect & Sales at TimeWarner / Navisite, presented examples that will allow business-savvy professionals to make informed decisions based on a sound business model. This model covered the technology options in detail as well as a financial analysis. The TCO (Total Cost of Ownership) and ROI (Return on Investment) demonstrated how to start, develop and formulate a business case that will allow both small and large scale projects to achieve...
The truth is, today’s databases are anything but agile – they are effectively static repositories that are cumbersome to work with, difficult to change, and cannot keep pace with application demands. Performance suffers as a result, and it takes far longer than it should to deliver new features and capabilities needed to make your organization competitive. As your application and business needs change, data repositories and structures get outmoded rapidly, resulting in increased work for applica...
The speed of product development has increased massively in the past 10 years. At the same time our formal secure development and SDL methodologies have fallen behind. This forces product developers to choose between rapid release times and security. In his session at DevOps Summit, Michael Murray, Director of Cyber Security Consulting and Assessment at GE Healthcare, examined the problems and presented some solutions for moving security into the DevOps lifecycle to ensure that we get fast AND ...
After a couple of false starts, cloud-based desktop solutions are picking up steam, driven by trends such as BYOD and pervasive high-speed connectivity. In his session at 15th Cloud Expo, Seth Bostock, CEO of IndependenceIT, cut through the hype and the acronyms, and discussed the emergence of full-featured cloud workspaces that do for the desktop what cloud infrastructure did for the server. He also discussed VDI vs DaaS, implementation strategies and evaluation criteria.
Since 2008 and for the first time in history, more than half of humans live in urban areas, urging cities to become “smart.” Today, cities can leverage the wide availability of smartphones combined with new technologies such as Beacons or NFC to connect their urban furniture and environment to create citizen-first services that improve transportation, way-finding and information delivery. In her session at @ThingsExpo, Laetitia Gazel-Anthoine, CEO of Connecthings, will focus on successful use c...
In his session at DevOps Summit, Tapabrata Pal, Director of Enterprise Architecture at Capital One, will tell a story about how Capital One has embraced Agile and DevOps Security practices across the Enterprise – driven by Enterprise Architecture; bringing in Development, Operations and Information Security organizations together. Capital Ones DevOpsSec practice is based upon three "pillars" – Shift-Left, Automate Everything, Dashboard Everything. Within about three years, from 100% waterfall, C...
Skeuomorphism usually means retaining existing design cues in something new that doesn’t actually need them. However, the concept of skeuomorphism can be thought of as relating more broadly to applying existing patterns to new technologies that, in fact, cry out for new approaches. In his session at DevOps Summit, Gordon Haff, Senior Cloud Strategy Marketing and Evangelism Manager at Red Hat, will discuss why containers should be paired with new architectural practices such as microservices ra...
With the arrival of the Big Data revolution, a data professional is expected to master a broad spectrum of complex domains including data processing, mathematics, programming languages, machine learning techniques, and business knowledge. While this mastery is undoubtedly important, this narrow focus on tool usage has divorced many from the imagination required to solve real-world problems. As the demand for analysis increases, the data science community must transform from tool experts to "data...
Building low-cost wearable devices can enhance the quality of our lives. In his session at Internet of @ThingsExpo, Sai Yamanoor, Embedded Software Engineer at Altschool, provided an example of putting together a small keychain within a $50 budget that educates the user about the air quality in their surroundings. He also provided examples such as building a wearable device that provides transit or recreational information. He then reviewed the resources available to build wearable devices at ...
Thanks to Docker, it becomes very easy to leverage containers to build, ship, and run any Linux application on any kind of infrastructure. Docker is particularly helpful for microservice architectures because their successful implementation relies on a fast, efficient deployment mechanism – which is precisely one of the features of Docker. Microservice architectures are therefore becoming more popular, and are increasingly seen as an interesting option even for smaller projects, instead of bein...
DevOps tends to focus on the relationship between Dev and Ops, putting an emphasis on the ops and application infrastructure. But that’s changing with microservices architectures. In her session at DevOps Summit, Lori MacVittie, Evangelist for F5 Networks, will focus on how microservices are changing the underlying architectures needed to scale, secure and deliver applications based on highly distributed (micro) services and why that means an expansion into “the network” for DevOps.
How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff happe...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo in Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading in...
The 3rd International @ThingsExpo, co-located with the 16th International Cloud Expo – to be held June 9-11, 2015, at the Javits Center in New York City, NY – is now accepting Hackathon proposals. Hackathon sponsorship benefits include general brand exposure and increasing engagement with the developer ecosystem. At Cloud Expo 2014 Silicon Valley, IBM held the Bluemix Developer Playground on November 5 and ElasticBox held the DevOps Hackathon on November 6. Both events took place on the expo fl...
The emergence of cloud computing and Big Data warrants a greater role for the PMO to successfully manage enterprise transformation driven by these powerful trends. As the adoption of cloud-based services continues to grow, a governance model is needed to orchestrate enterprise cloud implementations and harness the power of Big Data analytics. In his session at Cloud Expo, Mahesh Singh, President of BigData, Inc., discussed how the Enterprise PMO takes center stage not only in developing the app...
In his session at DevOps Summit, Tapabrata Pal, Director of Enterprise Architecture at Capital One, will tell a story about how Capital One has embraced Agile and DevOps Security practices across the Enterprise – driven by Enterprise Architecture; bringing in Development, Operations and Information Security organizations together. Capital Ones DevOpsSec practice is based upon three "pillars" – Shift-Left, Automate Everything, Dashboard Everything. Within about three years, from 100% waterfall, C...