Craig Balding's Cloud Security Blog

In my view, there are some strong technical security arguments in favour of Cloud Computing - assuming we can find ways to manage the risks. With this new paradigm come challenges and opportunities. The challenges are getting plenty of attention - I'm regularly afforded the opportunity to comment on them. However, let's not lose sight of the potential upside.

In this post, I walk through seven technical security benefits. Some are immediate, others may arise over time and have conditions attached (some unstated for the sake of brevity). However, I’m including the longer-range benefits now to raise awareness. Some of the outcomes listed are available today without the Cloud, but they are either complex and slow to implement (and thus less likely to happen) or prohibitive for capital cost reasons. I don’t claim this is a definitive list - it reflects where my thinking is today.

Some benefits depend on the Cloud service used and therefore do not apply across the board. For example; I see no solid forensic benefits with SaaS. Also, for space reasons, I’m purposely not including the ‘flip side’ to these benefits, however if you read this blog regularly you should recognise some.

On a sidenote, I believe the Cloud offers Small and Medium Businesses major potential security benefits. Frequently SMBs struggle with limited or non-existent in-house INFOSEC resources and budgets. The caveat is that the Cloud market is still very new - security offerings are somewhat foggy - making selection tricky. Clearly, not all Cloud providers will offer the same security.

Seven Technical Security Benefits of the Cloud

1. Centralised Data

• Reduced Data Leakage: this is the benefit I hear most from Cloud providers - and in my view they are right. How many laptops do we need to lose before we get this? How many backup tapes? The data “landmines” of today could be greatly reduced by the Cloud as thin client technology becomes prevalent. Small, temporary caches on handheld devices or Netbook computers pose less risk than transporting data buckets in the form of laptops. Ask the CISO of any large company if all laptops have company ‘mandated’ controls consistently applied; e.g. full disk encryption. You’ll see the answer by looking at the whites of their eyes. Despite best efforts around asset management and endpoint security we continue to see embarrassing and disturbing misses. And what about SMBs? How many use encryption for sensitive data, or even have a data classification policy in place?
• Monitoring benefits: central storage is easier to control and monitor. The flipside is the nightmare scenario of comprehensive data theft. However, I would rather spend my time as a security professional figuring out smart ways to protect and monitor access to data stored in one place (with the benefit of situational advantage) than trying to figure out all the places where the company data resides across a myriad of thick clients! You can get the benefits of Thin Clients today but Cloud Storage provides a way to centralise the data faster and potentially cheaper. The logistical challenge today is getting Terabytes of data to the Cloud in the first place.

2. Incident Response / Forensics

• Forensic readiness: with Infrastructure as a Service (IaaS) providers, I can build a dedicated forensic server in the same Cloud as my company and place it offline, ready for use when needed. I would only need pay for storage until an incident happens and I need to bring it online. I don’t need to call someone to bring it online or install some kind of remote boot software - I just click a button in the Cloud Providers web interface. If I have multiple incident responders, I can give them a copy of the VM so we can distribute the forensic workload based on the job at hand or as new sources of evidence arise and need analysis. To fully realise this benefit, commercial forensic software vendors would need to move away from archaic, physical dongle based licensing schemes to a network licensing model.
• Decrease evidence acquisition time: if a server in the Cloud gets compromised (i.e. broken into), I can now clone that server at the click of a mouse and make the cloned disks instantly available to my Cloud Forensics server. I didn’t need to “find” storage or have it “ready, waiting and unused” - its just there.
• Eliminate or reduce service downtime: Note that in the above scenario I didn’t have to go tell the COO that the system needs to be taken offline for hours whilst I dig around in the RAID Array hoping that my physical acqusition toolkit is compatible (and that the version of RAID firmware isn’t supported by my forensic software). Abstracting the hardware removes a barrier to even doing forensics in some situations.
• Decrease evidence transfer time: In the same Cloud, bit fot bit copies are super fast - made faster by that replicated, distributed filesystem my Cloud provider engineered for me. From a network traffic perspective, it may even be free to make the copy in the same Cloud. Without the Cloud, I would have to a lot of time consuming and expensive provisioning of physical devices. I only pay for the storage as long as I need the evidence.
• Eliminate forensic image verification time: Some Cloud Storage implementations expose a cryptographic checksum or hash. For example, Amazon S3 generates an MD5 hash automagically when you store an object. In theory you no longer need to generate time-consuming MD5 checksums using external tools - its already there.
• Decrease time to access protected documents: Immense CPU power opens some doors. Did the suspect password protect a document that is relevant to the investigation? You can now test a wider range of candidate passwords in less time to speed investigations.
  

• What is Cloud Computing?
• Cloud Computing: The Business of Building Clouds
• Cloud Computing: It's the Future of Enterprise IT
• RightScale CTO to Present at SYS-CON's Cloud Computing Expo
• Cloud Computing vs. Elastic Cloud: What's the Difference?
• Cloud Computing Expo: Introducing the Cloud Pyramid
• Is There A Difference Between Cloud Computing and SaaS?
• Cloud Computing - The Jargon is Back!
• Gartner: Cloud Security Will Triple by 2013
• One Consumer-Facing Usage of Cloud Computing: SaaS
• Cloud Computing Coming to Asian Market
• Cloud Computing: "Cloud Thinking" Abounds at Microsoft, Sun and Dell
• Cloud Computing - AT&T Takes to the Cloud
• Is Cloud Computing Right For You?
• Are Enterprises Ready for Cloud Computing?
• Cloud Computing: The On-Demand Model Has Been Available for a While
• Cloud Computing - Game Changing?
• Cloud Computing and Reliability
• VMware ESX August 12 Surprise: Implications for Cloud Computing
• Cloud Computing: The Rise of Cloud Platforms and Why the OS Doesn’t Matter
• Five Key Challenges of Enterprise Cloud Computing
• Virtualization Is Not Cloud Computing
• Cloud Computing Will Eventually Require Orchestration
• The Rise and Rise of Cloud Computing
• Is Cloud Computing the Wave of the Future?
• Cloud Computing: Securing the Cloud
• Google Chrome and Business Intelligence in the Cloud
• Cloud Computing & Privacy: Would You Trust Amazon?
• SYS-CON's November "Cloud Computing Bootcamp" Expected to be Sold-Out
• It's Time to Stop Fearing Change and Learn About Cloud Computing
• Who Has the Industry Lead in Cloud Computing?
• The Vocabulary of Cloud Computing
• [Flashback to 2008] Is Google the Elephant in the Cloud?
• Six Benefits of Cloud Computing
• What Does Obama Revolution Mean to Cloud Computing?
• Cloud Computing Is Far More Than Just Cutting Enterprise IT Costs
• James Urquhart Joins Cisco's Cloud Computing Dream Team
• How Good Is the Financial Crisis for Cloud Computing Providers?
• Ten Key Reasons Enterprise Cloud Computing Is Going Places
• NPR Asks: Will Cloud Computing Work in the White House?
• Cloud Computing and Cloud Computering
• Did Google's Eric Schmidt Coin "Cloud Computing"?
• The Comprehension of Cloud Subjectivity
• Dell Included in Microsoft-USDA Cloud Computing Deal