Click here to close now.

Welcome!

Cloud Expo Authors: Lori MacVittie, Liz McMillan, Pat Romanski, Plutora Blog, Carmen Gonzalez

Blog Feed Post

Answering Common Cloud Security Questions from CIOs

Cloud Security Cloud Key Management Cloud Encryption CIO  infoq cloud security Answering Common Cloud Security Questions from CIOsfrom InfoQ.com: With the news stories of possible data breaches at enterprises like Target, and the current trend of companies migrating to cloud environments for the flexibility, scalability, agility, and cost-effectiveness they offer, CIOs have been asking hard questions about cloud security.

As CIO, protecting your data (and your users) is one of your key responsibilities. Whether you already have some cloud projects running or are starting your first cloud project, these questions and answers may provide you with solutions and introduce some new techniques.

InfoQ: Is the cloud safe?

Gilad: The cloud, by definition, is not more or less safe than your own data center. As an interesting note, the recent media storm around the NSA, which started as a “cloud computing security” story, has morphed into a more general discussion. It turns out the NSA is able to eavesdrop on physical servers in physical data centers and has actually done so at many of the world’s most secure organizations.

Today, cloud computing has been discovered as safe and effective for a wide range of projects and data types, ranging across most vertical industries and market niches. Regulated, sensitive areas such as finance, health, legal, retail or government – are all in various stages of going to the cloud..

However, just like certain security precautions are taken in the physical world, cloud security also entails taking the appropriate precautions.

InfoQ: How does migrating to the cloud change my risks?

Gilad: Migrating applications and data to the cloud obviously shifts some responsibilities from your own data center to the cloud provider. It is an act of outsourcing. As such, it always involves a shift of control. Taking back control involves procedures and technology.

Cloud computing may be seen – in some aspects – as revolutionary; yet in other aspects it is evolutionary. Any study of controlling risks should start out by understanding this point. Many of the things we have learned in data centers evolve naturally to the cloud. The need for proper procedures is unchanged. Many of the technologies are also evolving naturally.

You should therefore start by mapping out your current procedures and current security-related technologies, and see how they evolve to the cloud. In many cases you’ll see a correspondence.

You’ll find however, that some areas really are a revolution. Clouds do not have walls, so physical security does not map well from the data center to the cloud. Clouds involve employees of the cloud service provider, so you need to find ways to control people who do not work for you. These are significant changes, and they require new technology and new procedures.

InfoQ: What are the most important aspects of a cloud security policy?

Gilad: Continuing the themes of evolution and revolution, some aspects of cloud security will seem familiar. Firewalls, antivirus, and authentication – are evolving to the world of cloud computing. You will find that your cloud provider often offers you solutions in these areas; and traditional vendors are evolving their solutions as well.

Some aspects may change your current thinking. Since clouds do not have walls, and cloud employees could see your data – you must create metaphoric walls around your data. In cloud scenarios, data encryption is the recognized best practice for these new needs.

Incidentally, data encryption also helps with a traditional data center need – most data breaches happen from the inside, so the threat is not just from cloud employees. However, there is no question that the threat from cloud insiders has shined a new spotlight on the need for data encryption.

InfoQ: What is the best practice for encrypting cloud data?

Gilad: You should encrypt data at rest and in motion. Encrypting “in motion” is already well known to you – the standards of HTTPS/SSL and IPSEC apply equally well in the data center and in the cloud.

Encrypting “at rest” means that the data must be encrypted when it resides on a disk, in a database, on a file system, in storage, and of course if it is backed up. In the real world, people have not always done this in data centers – often relying on physical security as a replacement. In the cloud, physical security is no alternative – you must encrypt sensitive data.

This actually means data must be encrypted constantly as it is being written, and decrypted only when it is going to be used (i.e. just before a specific calculation, and only in memory). Standards such as Advanced Encryption Standard (AES) are commonly used for data encryption at rest.

InfoQ: Does cloud encryption singlehandedly protect data?

Gilad: If data is properly encrypted it is, in a sense, locked and cannot be used if it falls into the wrong hands. Unless, of course, those hands have a key.

Proper management of encryption keys is as important as the encryption itself. In fact, if you keep your encryption keys to yourself – you keep ownership of your data. This is an interesting and fundamental point – in the cloud you are outsourcing your infrastructure, but you can maintain ownership by keeping the encryption keys.

If encryption keys are stored alongside the data, any breach that discloses the data will also disclose the key to access it. If encryption keys are stored with cloud providers, they own your data.

Think of your data like a safe deposit box – would you leave your key with the banker? What if he gets robbed? What if his employees are paid to make copies of your key?

A best practice is split key encryption. With this method, your data is encrypted (e.g. with AES), and then the encryption key is split into parts. One part is managed with a cloud security provider and one part stays only with you. This way, only you control access to your data.

Even if your encrypted data is compromised, the perpetrators will not be able to decrypt it and it will be useless to them.

InfoQ: How can encryption keys be protected while they are in use?

Gilad: Keys in use in the cloud do not have to be vulnerable. They can be protected using homomorphic key management. This cryptographic technique gives the application access to the data store without ever exposing the master keys to the encryption – in an unencrypted state. It also ensures that if such (encrypted) keys are stolen, they can still never be used to access your data store

InfoQ: Is cloud data encryption in compliance with regulations?

Gilad: Regulations like Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and many others (GLBA, FINRA, PIPEDA, et al) require or encourage cloud data to be properly encrypted and encryption keys to be properly managed. Some of these regulations even provide for a sort of “safe harbor” – that is, if your data is breached, but you can prove that you took the necessary steps to encrypt it and maintain control of the encryption keys, you may save the financial burden, the bureaucratic reporting requirements, and the damage to reputation involved with such an event.

InfoQ: Is cloud security cost-prohibitive and will it harm system performance?

Gilad: The cloud is often chosen for its lower operational overhead, and sometimes for actual dollar savings, compared with traditional data centers. Securing a cloud project does not need to negate the cloud’s ease of use nor make the project prohibitively expensive.

There are security solutions that require no hardware and, therefore, no large cap-ex investment. Pay-as-you-go business models make it easy to scale security up (or down) with the size of your project, as you add (or remove) virtual machines and data.

Performance can also be good. Modern cloud security virtual appliances and virtual agents – are optimized for cloud throughput and latency. You’ll be able to dial up performance as your cloud project scales up. To take a concrete example – data encryption – good solutions will include a capability to stream data as it is being encrypted (or decrypted), and do so inside your cloud account. Such approaches mean that virtual CPUs available in your cloud will be able to handle your performance needs with low latency.

InfoQ: Is there a way to protect cloud backups and disaster recovery?

Gilad: Data must be secured throughout its lifecycle. Properly encrypting data while it is in use, but then offering hackers unencrypted replicas as backups defeats the purpose of encrypting in the first place. You must encrypt and own the encryption keys for every point of the lifecycle of your information. Fortunately solutions that are built for the cloud do exist, and they should cover backups as well as primary copies.

InfoQ: What it more secure: a public cloud or a private cloud?

Gilad: Public and private clouds each have pros and cons in terms of ownership, control, cost, convenience and multi-tenancy. We have found that private clouds often require security controls similar to public ones. Use cases may involve users external to your company; or large “virtual” deployments with multiple internal projects, each with a need for strong security segregation. Your data can be properly encrypted, your keys can be properly managed, and you can be safe in all the major cloud scenarios: private, public, or hybrid.

InfoQ: If my data is in the cloud, my security is in the cloud, and my backup is in the cloud, what do I control?

Gilad: If you use encryption properly and maintain control of the encryption keys, you have replaced your physical walls with mathematical walls. You will own your data. Even though you do not control the physical resources, you maintain control of what they contain. This is one reason why encryption in the cloud is the best practice.

By properly using multiple regions or even multiple cloud providers, you can also ensure that you always have availability and access to your project and your data.

By combining such techniques, you do take back control. As CIO and owner of your data, you must always control your data – from beginning to end. Your control does not need to be sacrificed when you migrate to the cloud, though it may need to be managed differently.

 

 

 

The post Answering Common Cloud Security Questions from CIOs appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
The WebRTC Summit 2015 New York, to be held June 9-11, 2015, at the Javits Center in New York, NY, announces that its Call for Papers is open. Topics include all aspects of improving IT delivery by eliminating waste through automated business models leveraging cloud technologies. WebRTC Summit is co-located with 16th International Cloud Expo, @ThingsExpo, Big Data Expo, and DevOps Summit.
In this session we look at creating interactive communications via the web by adding messaging, file transfer, and group communication (group chat and audio/video conferencing) into the web experience. We will also discuss potential applications of this technology in areas including B2B, B2C, P2P, and gaming. Peter is Technical Director at Acision. He graduated from The University of Edinburgh in 2000 with a BSc (Hons) in Computer Science. After graduation Peter worked on a PSTN switch dev...
The Internet of Things Maturity Model (IoTMM) is a qualitative method to gauge the growth and increasing impact of IoT capabilities in an IT environment from both a business and technology perspective. In his session at @ThingsExpo, Tony Shan will first scan the IoT landscape and investigate the major challenges and barriers. The key areas of consideration are identified to get started with IoT journey. He will then pinpoint the need of a tool for effective IoT adoption and implementation, whic...
Shipping daily, injecting faults, and keeping an extremely high availability "without Ops"? Understand why NoOps does not mean no operations. Agile development methodologies require evolved operations to be successful. In his keynote at DevOps Summit, David Tesar, Microsoft Technical Evangelist on Microsoft Azure and DevOps, will discuss how Microsoft teams who have made huge progress with a DevOps transformation effectively utilize operations staff and how challenges were overcome. Regardless ...
Software is eating the world. Companies that were not previously in the technology space now find themselves competing with Google and Amazon on speed of innovation. As the innovation cycle accelerates, companies must embrace rapid and constant change to both applications and their infrastructure, and find a way to deliver speed and agility of development without sacrificing reliability or efficiency of operations. In her Day 2 Keynote DevOps Summit, Victoria Livschitz, CEO of Qubell, discussed...
Cloud computing started a technology revolution; now DevOps is driving that revolution forward. By enabling new approaches to service delivery, cloud and DevOps together are delivering even greater speed, agility, and efficiency. No wonder leading innovators are adopting DevOps and cloud together! In his session at DevOps Summit, Andi Mann, Vice President of Strategic Solutions at CA Technologies, explored the synergies in these two approaches, with practical tips, techniques, research data, wa...
SYS-CON Events announced today that AIC, a leading provider of OEM/ODM server and storage solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. AIC is a leading provider of both standard OTS, off-the-shelf, and OEM/ODM server and storage solutions. With expert in-house design capabilities, validation, manufacturing and production, AIC's broad selection of products are highly flexible and are conf...
SYS-CON Events announced today that Vicom Computer Services, Inc., a provider of technology and service solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. They are located at booth #427. Vicom Computer Services, Inc. is a progressive leader in the technology industry for over 30 years. Headquartered in the NY Metropolitan area. Vicom provides products and services based on today’s requirements...
SYS-CON Events announced today that Blue Box has been named “Bronze Sponsor” of SYS-CON's DevOps Summit New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Blue Box delivers Private Cloud as a Service (PCaaS) to a worldwide customer base. Built on a technology platform leveraging decades of operational expertise in cloud and distributed systems, Blue Box Cloud is a managed private cloud product available in both hosted and on-prem versions. Each Blue Box ...
Many of the well-known examples of DevOps success we read in blogs on the Internet paint an idyllic picture of DevOps productivity. A team was facing a stodgy, slow-moving operations department, teams weren’t delivering software on time. Those teams moved to DevOps, became proactive about infrastructure and deployment automation, and an overnight transition to productivity ensues. People are promoted, projects are successful, and developers and system administrators dance hand-in-hand in a final...
SYS-CON Events announced today that Soha will exhibit at SYS-CON's DevOps Summit New York, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Soha delivers enterprise-grade application security, on any device, as agile as the cloud. This turnkey, cloud-based service enables customers to solve secure application access and delivery challenges that traditional or virtualized network solutions cannot solve because they are too expensive, inflexible and operational...
The best mobile applications are augmented by dedicated servers, the Internet and Cloud services. Mobile developers should focus on one thing: writing the next socially disruptive viral app. Thanks to the cloud, they can focus on the overall solution, not the underlying plumbing. From iOS to Android and Windows, developers can leverage cloud services to create a common cross-platform backend to persist user settings, app data, broadcast notifications, run jobs, etc. This session provide...
Docker is becoming very popular--we are seeing every major private and public cloud vendor racing to adopt it. It promises portability and interoperability, and is quickly becoming the currency of the Cloud. In his session at DevOps Summit, Bart Copeland, CEO of ActiveState, discussed why Docker is so important to the future of the cloud, but will also take a step back and show that Docker is actually only one piece of the puzzle. Copeland will outline the bigger picture of where Docker fits a...
How do you securely enable access to your applications in AWS without exposing any attack surfaces? The answer is usually very complicated because application environments morph over time in response to growing requirements from your employee base, your partners and your customers. In his session at 16th Cloud Expo, Haseeb Budhani, CEO and Co-founder of Soha, will share five common approaches that DevOps teams follow to secure access to applications deployed in AWS, Azure, etc., and the frict...
ProfitBricks has launched its SDK for .NET, adding to its growing collection of libraries for the DevOps community. This new library exposes all functionality found in the SOAP API and expands ProfitBricks’ support for developers who work with Microsoft technology. “This .NET library addition provides a powerful programmatic interface to our SOAP API,” commented Achim Weiss, Co-founder and CEO of ProfitBricks. “This release is the latest in a series of new offerings that further extend ProfitBr...
SYS-CON Events announced today that B2Cloud, a provider of enterprise resource planning software, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. B2cloud develops the software you need. They have the ideal tools to help you work with your clients. B2Cloud’s main solutions include AGIS – ERP, CLOHC, AGIS – Invoice, and IZUM
As cloud gives an opportunity to businesses to buy services externally – how is cloud impacting your customers? In his General Session at 15th Cloud Expo, Fabio Gori, Director of Worldwide Cloud Marketing at Cisco, provided answers to big questions: Do you see hybrid cloud as where the world is going? What benefits does it bring? And how does Cisco connect all of these clouds? He also discussed Intercloud and Cisco’s investment on it.
The IoT Bootcamp is coming to Cloud Expo | @ThingsExpo on June 9-10 at the Javits Center in New York. Instructor. Registration is now available at http://iotbootcamp.sys-con.com/ Instructor Janakiram MSV previously taught the famously successful Multi-Cloud Bootcamp at Cloud Expo | @ThingsExpo in November in Santa Clara. Now he is expanding the focus to Janakiram is the founder and CTO of Get Cloud Ready Consulting, a niche Cloud Migration and Cloud Operations firm that recently got acquir...
SYS-CON Events announced today the DevOps Foundation Certification Course, being held June ?, 2015, in conjunction with DevOps Summit and 16th Cloud Expo at the Javits Center in New York City, NY. This sixteen (16) hour course provides an introduction to DevOps – the cultural and professional movement that stresses communication, collaboration, integration and automation in order to improve the flow of work between software developers and IT operations professionals. Improved workflows will res...
The world's leading Cloud event, Cloud Expo has launched Microservices Journal on the SYS-CON.com portal, featuring over 19,000 original articles, news stories, features, and blog entries. DevOps Journal is focused on this critical enterprise IT topic in the world of cloud computing. Microservices Journal offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. Follow new article posts on T...