云計算與安全cloud computing security

CloudComputingSecurityConsiderationsJoeStSauver,Ph.D.SecurityProgramsManager,Internet2@Internet2JointTechsSaltLakeCity,Utah4:10-4:30PM,Tuesday,2/2/2010Disclaimer:allopinionsstrictlymyown.2Introduction3SomeCautionsAboutToday'sTalk/TopicAsyoulikelyalreadyknow,there'saLOTofhypeassociatedwithcloudcomputing.I'msorryaboutthat(butIcan'tfixthat)Cloudcomputingisahugetopic.Itencompassesdiversemodelsandtechnologies,eventhoughusersandthetradepresstendtolumpthemunderacommonname.Coveringallpotentialsecurityissuesin20minutesissimplyimpossible.Forthatmatter,pleasenotethatwe'restilldiscoveringmanyofthesecurityissueswhichwillchallengecloudcomputing!Why?Inpart,that'sbecausecloudcomputingisstillawork-in-progress.Becauseitisrapidlyevolving,whatItelltodayyoumayquicklybecomeirrelevantorobsolete.Nonetheless,there'ssomuchthrustbehindcloudcomputingthatwesimplydon'thavetheoptionofsittingbackandwaitingtounderstandaddresscloudcomputingsecurityissues.4What'sDrivingCloudComputing?DriversInclude…Thoughtleaders:Amazon,Google,MicrosoftandmanyotherInternetthoughtleadershaveallalignedbehindthecloudTheeconomy:Becausecloudcomputingshouldtheoreticallyhelpsitesavoidmajornewcapitalexpenditures(capex)whilealsocontrollingsomeongoingoperationalexpenses(opex),cloudcomputingispotentiallya"lifesaver"forfinanciallystrappedbusinesses,includingmanymajoruniversities.TheFeds:CloudcomputinghassubstantialmomentuminWashingtonDC:itwasfeaturedinthejust-releasedfederalITbudget;VivekKundra,thefederalCIO,haschampionedcreationof,a“one-stopshop”forcloudcomputingservicesforfederalagencies;DISAhascreatedaverysuccessfulcloudcomputingprojectcalled"RACE;"andHowardSchmidt,thenewfederalcybersecuritycoordinator,hassaidthatsecuringcloudcomputingwillbeatoppriority.56Apps.Gov(CurrentlyaBitofAWorkInProgress)7DISA'sRACE8OurCommunityIsAlsoPressingAheadCloudcomputingseemtobeturninguponprettymucheverynetworkingandsecuritymailinglistI'monYou'veheard/willbehearinganumberofcloudcomputingtalksduringthisweek'smeeting,whichisprobablynotsurprisingsincecloudcomputingwasoneofJointTech'sexplicitfocusareas.ButI'mseeingcloudseverywhere,notjusthereatJointTechs.Heck,I'mevenseeing"clouds"(withfrequentreferencestosecurity!)appearinthingslikethelastInternet2MemberMeeting"IntroductiontoInternet2"talk9"CyberinfrastructureVisualized:"

ACloud,WithLotsof"Security"References10WhyIs"Security"EverywhereonThatSlide?Securityisgenerallyperceivedasahugeissueforthecloud:

DuringakeynotespeechtotheBrookingsInstitutionpolicyforum,“CloudComputingforBusinessandSociety,”[MicrosoftGeneralCounselBrad]SmithalsohighlighteddatafromasurveycommissionedbyMicrosoftmeasuringattitudesoncloudcomputingamongbusinessleadersandthegeneralpopulation.

Thesurveyfoundthatwhile58percentofthegeneralpopulationand86percentofseniorbusinessleadersareexcitedaboutthepotentialofcloudcomputing,morethan

90percentofthesesamepeopleareconcernedaboutthesecurity,accessandprivacyoftheirowndatain

thecloud.

11AnotherDataPointforCloudsandSecuritySource:

atslide1712CloudComputingIsManyDifferent

ThingstoManyDifferentPeopleAllofthefollowinghavebeenmentionedfromtimetotimeasexamplesof“cloudcomputing:”

--AmazonWebServicesincludingtheElasticCompute

Cloud(EC2),AmazonSimpleStorageService(S3),etc.)

--RackspaceCloud(formerlyMosso)

--Google’sAppEngine

--Windows’AzurePlatform(production/for-feeasoftoday!)

--theOGF(includingitsOpenCloudComputingInterface)

13--SETI@Home,Folding@Home,,etc.

--outsourcedcampusemailservice(toGmailorL),

oroutsourcedspamfiltering(e.g.,toPostiniorIronport)

--useofvirtualization(e.g.,VMware)tohostdepartmental

systemseitheronlocalservers,oronoutsourcedVPSInreality,someofthoseactivitiesarenot(strictlyspeaking)what'susuallydefinedas"cloudcomputing,"14SomeGenerallyAcceptedCharacteristicsMostpeoplewouldagreethattruecloudcomputing… --usuallyhasloworzeroupfrontcapitalcosts

--largelyeliminatesoperationalresponsibilities(e.g.,ifadisk

failsoraswitchlosesconnectivity,youdon’tneedtofixit)

--forthemostpart,cloudcomputingeliminatesknowledgeof

WHEREone’scomputationalworkisbeingdone;yourjob

isbeingrun“somewhere”outthereinthe“cloud”

15--offerssubstantialelasticityandscalability:ifyouinitially

needoneCPU,that’sfine,butifyousuddenlyneed999

more,youcangetthem,too(andwithverylittledelay!)

If/whendemanddrops,youcanscaleyourusageback,too

--cloudcomputingleverageseconomiesofscale(running

megadatacenterswithtensofthousandsofcomputersis

farlessexpensive(percomputer)thanrunningasmall

machineroomwithjustamodestclusterofsystems)16Some"Clouds"Won'tNecessarily

HaveAllofThoseCharacteristicsForinstance,ifyoursiteisrunningalocalprivatecloud:

--thereWILLbecapitalexpendituresupfront,

--you(orsomeoneatyoursite)WILLstillcareaboutthings

likehardwarefailures,and

--youlikelyWON'Thavetheillusionofaseeminglyinfinite

inventoryofprocessors(ormemoryordisk)

Nonetheless,alocalprivatecloudservicemayfunctionallyworkthesamewayasapubliccloudservice,andhybridcloudmodelsmayevencombineprivateandpubliccloudservicesinafairlyseamlessway.Ubuntu'senterprisecloudofferingisaniceexampleofthis.1718WillYourCampusOfferPrivateCloudServices?Ifyouhaven'tbeenthinkingaboutofferingprivatecloudservices,Iwouldsuggestthatyoumightwantto,includingthinkinghardaboutanypotentialsecurityissuesassociatedwithdoingso.19SoWhatAboutSecurityintheCloud?Fortheremainderofthistalk,we'lloutlinesomeofthesecurityissuesyoumightrunintowhenusingcloudcomputing20InSomeWays,"CloudComputingSecurity"

IsNoDifferentThan"RegularSecurity"Forexample,manyapplicationsinterfacewithendusersviatheweb.AllthenormalOWASPwebsecurityvulnerabilities

--thingslikeSQLinjection,crosssitescripting,crosssiterequestforgeries,etc.,--allofthosevulnerabilitiesarejust

asrelevanttoapplicationsrunningonthecloudastheyaretoapplicationsrunningonconventionalhosting.Similarly,considerphysicalsecurity.Adatacenterfullofserverssupportingcloudcomputingisinternallyandexternallyindistinguishablefromadatacenterfullof"regular"servers.Ineachcase,itwillbeimportantforthedatacentertobephysicallysecureagainstunauthorizedaccessorpotentialnaturaldisasters,buttherearenospecialnewphysicalsecurityrequirementswhichsuddenlyappearsimplybecauseoneofthosefacilitiesissupportingcloudcomputing21ThereAreSomeUniqueCloud-RelatedAreasWhichWe'reNOTGoingToWorryAboutTodayContractingforCloudServices:Eventhoughcontractualterms(includingthingslikeSLAs)canbeusedtomitigatesomerisks,I'mnotalawyer,andI'mnotgoingtopretendtobeone,sowe'renotgoingtocoverissuesrelatedtocontractingforcloudservices.Fortunately,NACUAdidagreatjobdiscussingthistopicinarecentseminar,see/meetings/VirtualSEminars/december2009/home.htmlCompliance,AuditingandeDiscovery:Becausethismeetingisprimarilyaboutresearchandeducation,notbusinessprocessesanduniversityadministration,wewillnotconsiderthepotentialneedforcloudcomputingtobecompliantwithPaymentCardIndustrysecuritystandards,FERPA,HIPAA,GLBA,orotherrelatedcompliancemandates.Sowhataresomecloud-relatedsecurityissues?22The"A"inTheSecurity"C-I-A"ObjectivesComputerandnetworksecurityisfundamentallyaboutthreegoals/objectives:

--confidentiality(C)

--integrity(I),and

--availability(A).Availabilityistheareawherecloudbasedinfrastructureappearstohavehaditslargest(oratleastmosthighlypublicized)challengestodate.Forexample,considersomeofthecloud-related

outageswhichhavebeenwidelyreported…23Bitbucket,DDoS'dOffTheAir24MaintenanceInducedCascadingFailures25It'sNotJustTheNetwork:StorageIsKey,TooSeeHowever,seealso:MicrosoftConfirmsDataRecoveryforSidekickUsers26AndLet'sNotForgetAboutPowerIssues27MitigatingCloudComputingAvailabilityIssuesRiskanalystswilltellyouthatwhenyouconfrontarisk,youcantrytoeliminatetherisk,youcanmitigate/minimizetheimpactoftherisk,oryoucansimplyaccepttherisk.Ifyoutrulyrequirenon-stopavailability,youcantryusingmultiplecloudproviders,oryoucouldusepublicandprivatecloudnodestoimproveredundancy.Somecloudcomputingservicesalsoofferservicedividedintomultiple"regions."Bydeployinginfrastructureinmultipleregions,isolationfrom"single-region-only"events(suchasthepoweroutagementionedpreviously)canbeobtained.Availabilityissuesmayalsobeabletobeatleastpartiallymitigatedattheapplicationlevelbythingslikelocalcaching.Sometimes,though,itmaysimplymakefinancialsenseforyoutojustaccepttheriskofarareandbriefoutage.(Remember,99.99availability==>52+minutesdowntime/yr)28MitigatingDataLossRisksTheriskofdataloss(asintheT-MobileSidekickcase)isanexceptiontotheavailabilitydiscussionontheprecedingslide.Usersmaybeabletotolerateanoccasionalserviceinterrup-tion,butnon-recoverabledatalossescankillabusiness.Mostcloudcomputingservicesusedistributedandreplicatedglobalfilesystemswhicharedesignedtoinsurethathardwarefailures(orevenlossofanentiredatacenter)willnotresultinanypermanentdataloss,butIbelievethereisstillvalueindoingatraditionaloffsitebackupofone'sdata,whetherthatdataisinusebytraditionalserversorcloudcomputingservers.Whenlookingforsolutions,makesureyoufindonesthatbacksupdataFROMthecloud(manybackupsolutionsaremeanttobackuplocaldataTOthecloud!)29CloudComputingAndPerimeterSecurityWhileI'mnotahugefanoffirewalls(asI'vepreviouslydiscussedattheSpring2008I2MMin"CyberinfrastructureArchitectures,SecurityandAdvancedApplications,"see),atleastsomesitesdofindvalueinshelteringatleastsomepartsoftheirinfrastructurebehindafirewall.Theremaybeamisconceptionthatcloudcomputingresourcescan'tbeshelteredbehindafirewall(seeforexample"HP'sHurd:Cloudcomputinghasitslimits(especiallywhenyouface1,000attacksaday),"Oct20th,2009,)Contrastthatwith"AmazonWebServices:OverviewofSecurityProcesses"(seetherefsattheback).AWShasamandatoryinboundfirewallconfiguredinadefaultdenymode,andcustomersmustexplicitlyopenportsinbound.30CloudComputing&Host-BasedIntrusionDetectionWhileI'mnotveryenthusiasticaboutfirewalls,Iamabigfanofwell-instrumented/well-monitoredsystemsandnetworks.Choosingcloudcomputingdoesnotnecessarilymeanforgoingyourabilitytomonitorsystemsforhostileactivity.

OneexampleofatoolthatcanhelpwiththistaskisOSSEC(theOpenSourceHost-BasedIntrusionDetectionSystem),anIDSwhichsupportsvirtualizedenvironments:31CloudComputingAlsoRelies

ontheSecurityofVirtualizationBecausecloudcomputingisbuiltontopofvirtualization,iftherearesecurityissueswithvirtualization,thentherewillalsosecurityissueswithcloudcomputing.Forexample,couldsomeoneescapefromaguestvirtualmachineinstancetothehostOS?Whilethecommunityhastraditionallybeensomewhatskepticalofthispossibility,thatchangedwithBlackhatUSA2009,whereKostyaKortchinskyofImmunityInc.presented"Cloudburst:AVMwareGuesttoHostEscapeStory",see

BHUSA09-Kortchinsky-Cloudburst-SLIDES.pdfKostyaopined:"VMwareisn'tanadditionalsecuritylayer,it'sjustanotherlayertofindbugsin"[putanotherway,runningavirtualizationproductincreasestheattacksurface]32ChoiceofCloudProviderCloudcomputingisaformofoutsourcing,andyouneedahighleveloftrustintheentitiesyou'llbepartneringwith.Itmayseemdauntingatfirsttorealizethatyourapplicationdepends(critically!)onthetrustworthinessofyourcloudproviders,butthisisnotreallyanythingnew--today,evenifyou'renotusingthecloud,youalreadyrelyonandtrust:

--networkserviceproviders,

--hardwarevendors,

--softwarevendors,

--serviceproviders,

--datasources,etc.

Yourcloudproviderwillbejustonemoreentityonthatlist.33CloudProviderLocationYouactuallywanttoknow(roughly)whereyourcloudlives.Forexample,oneofthewaysthatcloudcomputingcompanieskeeptheircostslowisbylocatingtheirmegadatacentersinlocationswherelabor,electricityandrealestatecostsarelow,andnetworkconnectivityisgood.Thus,yourcloudprovidercouldbeworkingsomeplaceyou

mayneverhaveheardof,suchasTheDalles,Oregon,

wherepowerischeapandfiberisplentiful,orjustaseasilysomeplaceoverseas.Ifyourapplicationanddatadoendupataninternationalsite,thosesystemswillbesubjecttothelawsandpoliciesofthatjurisdiction.Areyoucomfortablewiththatframework?Areyoualsoconfidentthatinternationalconnectivitywillremainupanduncongested?Canyoulivewiththelatenciesinvolved?34CloudProviderEmployeesIfyou'relikemostsites,you'reprobablyprettycarefulabouttheemployeesyouhireforcriticalroles(suchassysadminsandnetworkenginers).Butwhataboutyourcloudprovider?Ifyourcloudproviderhascarelessoruntrustworthysystemadministrators,theintegrity/privacyofyourdata'satrisk.Howcanyoutellifyourcloudproviderhascarefulandtrustworthyemployees?Askthem!

--Dobackgroundsgetcheckedbeforepeoplegethired?

--Doemployeesreceiveextensivein-housetraining?

--Doemployeesholdrelevantcertifications?

--Dochecklistsgetusedforcriticaloperations?

--Aresystemadministratoractionstrackedandauditableon

aposthocbasisifthere'sananomalousevent?

--Doadministrativeprivilegesgetpromptlyremovedwhen

employeesleaveorchangetheirresponsibilities?35CloudProviderTransparencyYouwillonlybeabletoassessthesufficiencyofcloudprovidersecuritypracticesifthecloudprovideriswillingtodiscloseitssecuritypracticestoyou.Ifyourprovidertreatssecuritypracticesasaconfidentialorbusinessproprietarything,andwon'tdisclosetheirsecuritypracticestoyou,you'llhaveahardtimeassessingthesufficiencyoftheirsecuritypractices.Unfortunately,youmayneedtoconsiderusingadifferentprovider.Remember:"Trust,butverify."[AproverbfrequentlyquotedbyPresidentReaganduringarmscontrolnegotiations]I'mnotknownforbeingabigMicrosoftcheerleader,butMicrosoftdeservesrecognitionforpromotingboththeirCloudComputingAdvancementActandpressingcloudvendorstopolicethemselveswhenitcomestotransparency.See/presspass/presskits/cloudpolicy/36AnExampleofTheWrongApproachSource:

cloudsecurityorg-interviews-guido-van-rossum-google-app-engine-python-and-security.html37ProviderFailuresAreAlsoARealPossibilityEvenforared-hottechnologylikecloudcomputing,thereisnoguaranteethatyourproviderswillfinanciallysurvive.Whatwillyoudoifyourproviderliquidates?