SlideShare uma empresa Scribd logo
1 de 7
Baixar para ler offline
Answering Common Cloud Security Questions
from CIOs
Posted by Gilad Parran-Nissany[1] on Feb 12, 2014 | 2 Discuss
With the news stories of possible data breaches at enterprises like Target, and the
current trend of companies migrating to cloud environments for the flexibility,
scalability, agility, and cost-effectiveness they offer, CIOs have been asking hard
questions about cloud security.
As CIO, protecting your data (and your users) is one of your key responsibilities.
Whether you already have some cloud projects running or are starting your first cloud
project, these questions and answers may provide you with solutions and introduce
some new techniques.
InfoQ: Is the cloud safe?
Gilad: The cloud, by definition, is not more or less safe than your own data center.
As an interesting note, the recent media storm around the NSA, which started as a
“cloud computing security” story, has morphed into a more general discussion. It
turns out the NSA is able to eavesdrop on physical servers in physical data centers
and has actually done so at many of the world’s most secure organizations.
Today, cloud computing has been discovered as safe and effective for a wide range of
projects and data types, ranging across most vertical industries and market niches.
Regulated, sensitive areas such as finance, health, legal, retail or government - are
all in various stages of going to the cloud..
However, just like certain security precautions are taken in the physical world, cloud
security also entails taking the appropriate precautions.
InfoQ: How does migrating to the cloud change my risks?
Gilad: Migrating applications and data to the cloud obviously shifts some
responsibilities from your own data center to the cloud provider. It is an act of
outsourcing. As such, it always involves a shift of control. Taking back control
involves procedures and technology.
Cloud computing may be seen – in some aspects – as revolutionary; yet in other
aspects it is evolutionary. Any study of controlling risks should start out by
understanding this point. Many of the things we have learned in data centers evolve
naturally to the cloud. The need for proper procedures is unchanged. Many of the
technologies are also evolving naturally.
You should therefore start by mapping out your current procedures and current
security-related technologies, and see how they evolve to the cloud. In many cases
you’ll see a correspondence.
You’ll find however, that some areas really are a revolution. Clouds do not have
walls, so physical security does not map well from the data center to the cloud.
Clouds involve employees of the cloud service provider, so you need to find ways to
control people who do not work for you. These are significant changes, and they
require new technology and new procedures.
InfoQ: What are the most important aspects of a cloud security policy?
Gilad: Continuing the themes of evolution and revolution, some aspects of cloud
security will seem familiar. Firewalls, antivirus, and authentication – are evolving to
the world of cloud computing. You will find that your cloud provider often offers you
solutions in these areas; and traditional vendors are evolving their solutions as well.
Some aspects may change your current thinking. Since clouds do not have walls, and
cloud employees could see your data - you must create metaphoric walls around your
data. In cloud scenarios, data encryption is the recognized best practice for these
new needs.
Incidentally, data encryption also helps with a traditional data center need – most
data breaches happen from the inside, so the threat is not just from cloud employees.
However, there is no question that the threat from cloud insiders has shined a new
spotlight on the need for data encryption.
InfoQ: What is the best practice for encrypting cloud data?
Gilad: You should encrypt data at rest and in motion. Encrypting “in motion” is
already well known to you – the standards of HTTPS/SSL and IPSEC apply equally
well in the data center and in the cloud.
Encrypting “at rest” means that the data must be encrypted when it resides on a disk,
in a database, on a file system, in storage, and of course if it is backed up. In the real
world, people have not always done this in data centers – often relying on physical
security as a replacement. In the cloud, physical security is no alternative – you must
encrypt sensitive data.
This actually means data must be encrypted constantly as it is being written, and
decrypted only when it is going to be used (i.e. just before a specific calculation, and
only in memory). Standards such as Advanced Encryption Standard (AES) are
commonly used for data encryption at rest.
InfoQ: Does cloud encryption singlehandedly protect data?
Gilad: If data is properly encrypted it is, in a sense, locked and cannot be used if it
falls into the wrong hands. Unless, of course, those hands have a key.
Proper management of encryption keys is as important as the encryption itself. In
fact, if you keep your encryption keys to yourself – you keep ownership of your data.
This is an interesting and fundamental point – in the cloud you are outsourcing your
infrastructure, but you can maintain ownership by keeping the encryption keys.
If encryption keys are stored alongside the data, any breach that discloses the data
will also disclose the key to access it. If encryption keys are stored with cloud
providers, they own your data.
Think of your data like a safe deposit box – would you leave your key with the
banker? What if he gets robbed? What if his employees are paid to make copies of
your key?
A best practice is split key encryption[2]. With this method, your data is encrypted
(e.g. with AES), and then the encryption key is split into parts. One part is managed
with a cloud security provider and one part stays only with you. This way, only you
control access to your data.
Even if your encrypted data is compromised, the perpetrators will not be able to
decrypt it and it will be useless to them.
InfoQ: How can encryption keys be protected while they are in use?
Gilad: Keys in use in the cloud do not have to be vulnerable. They can be protected
using homomorphic key management[3]. This cryptographic technique gives the
application access to the data store without ever exposing the master keys to the
encryption - in an unencrypted state. It also ensures that if such (encrypted) keys are
stolen, they can still never be used to access your data store
InfoQ: Is cloud data encryption in compliance with regulations?
Gilad: Regulations like Payment Card Industry Data Security Standard (PCI DSS),
the Health Insurance Portability and Accountability Act (HIPAA), and many others
(GLBA, FINRA, PIPEDA, et al) require or encourage cloud data to be properly
encrypted and encryption keys to be properly managed. Some of these regulations
even provide for a sort of “safe harbor” – that is, if your data is breached, but you
can prove that you took the necessary steps to encrypt it and maintain control of the
encryption keys, you may save the financial burden, the bureaucratic reporting
requirements, and the damage to reputation involved with such an event.
InfoQ: Is cloud security cost-prohibitive and will it harm system performance?
Gilad: The cloud is often chosen for its lower operational overhead, and sometimes
for actual dollar savings, compared with traditional data centers. Securing a cloud
project does not need to negate the cloud’s ease of use nor make the project
prohibitively expensive.
There are security solutions that require no hardware and, therefore, no large cap-ex
investment. Pay-as-you-go business models make it easy to scale security up (or
down) with the size of your project, as you add (or remove) virtual machines and
data.
Performance can also be good. Modern cloud security virtual appliances and virtual
agents - are optimized for cloud throughput and latency. You’ll be able to dial up
performance as your cloud project scales up. To take a concrete example – data
encryption – good solutions will include a capability to stream data as it is being
encrypted (or decrypted), and do so inside your cloud account. Such approaches
mean that virtual CPUs available in your cloud will be able to handle your
performance needs with low latency.
InfoQ: Is there a way to protect cloud backups and disaster recovery?
Gilad: Data must be secured throughout its lifecycle. Properly encrypting data while
it is in use, but then offering hackers unencrypted replicas as backups defeats the
purpose of encrypting in the first place. You must encrypt and own the encryption
keys for every point of the lifecycle of your information. Fortunately solutions that are
built for the cloud do exist, and they should cover backups as well as primary copies.
InfoQ: What it more secure: a public cloud or a private cloud?
Gilad: Public and private clouds each have pros and cons in terms of ownership,
control, cost, convenience and multi-tenancy. We have found that private clouds
often require security controls similar to public ones. Use cases may involve users
external to your company; or large “virtual” deployments with multiple internal
projects, each with a need for strong security segregation. Your data can be properly
encrypted, your keys can be properly managed, and you can be safe in all the major
cloud scenarios: private, public, or hybrid.
InfoQ: If my data is in the cloud, my security is in the cloud, and my backup is in
the cloud, what do I control?
Gilad: If you use encryption properly and maintain control of the encryption keys,
you have replaced your physical walls with mathematical walls. You will own your
data. Even though you do not control the physical resources, you maintain control of
what they contain. This is one reason why encryption in the cloud is the best practice.
By properly using multiple regions or even multiple cloud providers, you can also
ensure that you always have availability and access to your project and your data.
By combining such techniques, you do take back control. As CIO and owner of your
data, you must always control your data – from beginning to end. Your control does
not need to be sacrificed when you migrate to the cloud, though it may need to be
managed differently.
About the Author

Gilad Parann-Nissany is the founder and CEO of Porticor Cloud Security[4].
He is a pioneer in the field of cloud computing who has built SaaS clouds, contributed
to SAP products and created a cloud operating system. He has written extensively on
the importance of cloud encryption and encryption key management for PCI and HIPAA
compliance. Gilad can be found on his blog[5], Twitter[6], LinkedIn [7], and Google+[8]
discussing cloud security.

Tell us what you think
Re: Encryption only a small part of the story Feb 23, 2014 11:08 by Gilad ParannNissany
Thanks Mike.
Regarding the provider going bust, indeed encryption doesn't solve that. Yet try looking
at two or more providers or at least two regions of the same provider for high
availability. Encryption can help by securing both parts of your high availability
deployment.
Regarding integrity, there are cases where encryption or digital signatures can help you
discover tampering has occured. More generally, if you snapshot your data regularly
you'll be able to recover from the tampering. Again, the snapshots can and should be
encrypted - a good solution will do that.
More generally, encryption is crucial because it solves one of the main differences
between clouds and traditional deployments. It restores control to the proper owner.
1. http://www.infoq.com/author/Gilad-Parran~Nissany
2. http://www.porticor.com/technology/
3. http://www.porticor.com/homomorphic-encryption/
4. http://www.porticor.com/
5. http://www.porticor.com/articles/general/
6. https://twitter.com/giladpn
7. http://il.linkedin.com/in/giladparann
8. https://plus.google.com/109000829856881765332/posts

Mais conteúdo relacionado

Mais de Vision Concepts Infrastructure Services Solution

Mais de Vision Concepts Infrastructure Services Solution (20)

Palo Alto Networks VM-Series firewall now available on NetScaler SDX Platform
Palo Alto Networks VM-Series firewall now available on NetScaler SDX PlatformPalo Alto Networks VM-Series firewall now available on NetScaler SDX Platform
Palo Alto Networks VM-Series firewall now available on NetScaler SDX Platform
 
Citrix Application Lifecycle Management
Citrix Application Lifecycle ManagementCitrix Application Lifecycle Management
Citrix Application Lifecycle Management
 
Delivery-on-Demand Company Raises $16 Million, Questions About Safety and Out...
Delivery-on-Demand Company Raises $16 Million, Questions About Safety and Out...Delivery-on-Demand Company Raises $16 Million, Questions About Safety and Out...
Delivery-on-Demand Company Raises $16 Million, Questions About Safety and Out...
 
Could Google end sweatshop labor?
Could Google end sweatshop labor?Could Google end sweatshop labor?
Could Google end sweatshop labor?
 
How to Change the IT Architect Hiring Practice
How to Change the IT Architect Hiring PracticeHow to Change the IT Architect Hiring Practice
How to Change the IT Architect Hiring Practice
 
NetApp To Offer Integrated Storage Array And Virtualization Software
NetApp To Offer Integrated Storage Array And Virtualization SoftwareNetApp To Offer Integrated Storage Array And Virtualization Software
NetApp To Offer Integrated Storage Array And Virtualization Software
 
Big Data - Security Concerns
Big Data - Security ConcernsBig Data - Security Concerns
Big Data - Security Concerns
 
Apple adding hundreds of new engineers and operations staff in China to speed...
Apple adding hundreds of new engineers and operations staff in China to speed...Apple adding hundreds of new engineers and operations staff in China to speed...
Apple adding hundreds of new engineers and operations staff in China to speed...
 
Data Analytics and the Ubiquitous Internet of Things
Data Analytics and the Ubiquitous Internet of ThingsData Analytics and the Ubiquitous Internet of Things
Data Analytics and the Ubiquitous Internet of Things
 
Citrix UniPrint NetGain Case Study
Citrix UniPrint NetGain Case StudyCitrix UniPrint NetGain Case Study
Citrix UniPrint NetGain Case Study
 
Uniprint Infinity Citrix Printing Solution
Uniprint Infinity Citrix Printing SolutionUniprint Infinity Citrix Printing Solution
Uniprint Infinity Citrix Printing Solution
 
Citrix Top 10 Trends
Citrix Top 10 Trends Citrix Top 10 Trends
Citrix Top 10 Trends
 
Learn KVM and Receive Exclusive Invitation to Linux Foundation Collaboration ...
Learn KVM and Receive Exclusive Invitation to Linux Foundation Collaboration ...Learn KVM and Receive Exclusive Invitation to Linux Foundation Collaboration ...
Learn KVM and Receive Exclusive Invitation to Linux Foundation Collaboration ...
 
Build Your 2008R2 2-Node Cluster
Build Your 2008R2 2-Node ClusterBuild Your 2008R2 2-Node Cluster
Build Your 2008R2 2-Node Cluster
 
How to Change the IT Architect Hiring Practice so Companies and End-Users Win...
How to Change the IT Architect Hiring Practice so Companies and End-Users Win...How to Change the IT Architect Hiring Practice so Companies and End-Users Win...
How to Change the IT Architect Hiring Practice so Companies and End-Users Win...
 
VDI - Zero Client Printing Solution
VDI - Zero Client Printing SolutionVDI - Zero Client Printing Solution
VDI - Zero Client Printing Solution
 
GuideIT Storage Requirements Template
GuideIT Storage Requirements TemplateGuideIT Storage Requirements Template
GuideIT Storage Requirements Template
 
GuideIT Delivery Design - Netscaler
GuideIT Delivery Design - NetscalerGuideIT Delivery Design - Netscaler
GuideIT Delivery Design - Netscaler
 
GuideIT Delivery Design - File Shares
GuideIT Delivery Design - File SharesGuideIT Delivery Design - File Shares
GuideIT Delivery Design - File Shares
 
Guide IT Delivery Design - Security
Guide IT Delivery Design - SecurityGuide IT Delivery Design - Security
Guide IT Delivery Design - Security
 

Último

Introduction to Quantum Computing
Introduction to Quantum ComputingIntroduction to Quantum Computing
Introduction to Quantum ComputingGDSC PJATK
 
COMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a WebsiteCOMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a Websitedgelyza
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureEric D. Schabell
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfDaniel Santiago Silva Capera
 
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...DianaGray10
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.YounusS2
 
Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfinfogdgmi
 
PicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer ServicePicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer ServiceRenan Moreira de Oliveira
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsSeth Reyes
 
Nanopower In Semiconductor Industry.pdf
Nanopower  In Semiconductor Industry.pdfNanopower  In Semiconductor Industry.pdf
Nanopower In Semiconductor Industry.pdfPedro Manuel
 
Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfAijun Zhang
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8DianaGray10
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Commit University
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopBachir Benyammi
 
Linked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesLinked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesDavid Newbury
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Adtran
 
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostKubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostMatt Ray
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesThousandEyes
 
Things you didn't know you can use in your Salesforce
Things you didn't know you can use in your SalesforceThings you didn't know you can use in your Salesforce
Things you didn't know you can use in your SalesforceMartin Humpolec
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...Aggregage
 

Último (20)

Introduction to Quantum Computing
Introduction to Quantum ComputingIntroduction to Quantum Computing
Introduction to Quantum Computing
 
COMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a WebsiteCOMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a Website
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability Adventure
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
 
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.
 
Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdf
 
PicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer ServicePicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer Service
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and Hazards
 
Nanopower In Semiconductor Industry.pdf
Nanopower  In Semiconductor Industry.pdfNanopower  In Semiconductor Industry.pdf
Nanopower In Semiconductor Industry.pdf
 
Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdf
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 Workshop
 
Linked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesLinked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond Ontologies
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™
 
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostKubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
 
Things you didn't know you can use in your Salesforce
Things you didn't know you can use in your SalesforceThings you didn't know you can use in your Salesforce
Things you didn't know you can use in your Salesforce
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
 

Answering Common Cloud Security Questions from CIO

  • 1. Answering Common Cloud Security Questions from CIOs Posted by Gilad Parran-Nissany[1] on Feb 12, 2014 | 2 Discuss With the news stories of possible data breaches at enterprises like Target, and the current trend of companies migrating to cloud environments for the flexibility, scalability, agility, and cost-effectiveness they offer, CIOs have been asking hard questions about cloud security. As CIO, protecting your data (and your users) is one of your key responsibilities. Whether you already have some cloud projects running or are starting your first cloud project, these questions and answers may provide you with solutions and introduce some new techniques. InfoQ: Is the cloud safe? Gilad: The cloud, by definition, is not more or less safe than your own data center. As an interesting note, the recent media storm around the NSA, which started as a “cloud computing security” story, has morphed into a more general discussion. It turns out the NSA is able to eavesdrop on physical servers in physical data centers and has actually done so at many of the world’s most secure organizations. Today, cloud computing has been discovered as safe and effective for a wide range of projects and data types, ranging across most vertical industries and market niches. Regulated, sensitive areas such as finance, health, legal, retail or government - are all in various stages of going to the cloud.. However, just like certain security precautions are taken in the physical world, cloud security also entails taking the appropriate precautions. InfoQ: How does migrating to the cloud change my risks? Gilad: Migrating applications and data to the cloud obviously shifts some
  • 2. responsibilities from your own data center to the cloud provider. It is an act of outsourcing. As such, it always involves a shift of control. Taking back control involves procedures and technology. Cloud computing may be seen – in some aspects – as revolutionary; yet in other aspects it is evolutionary. Any study of controlling risks should start out by understanding this point. Many of the things we have learned in data centers evolve naturally to the cloud. The need for proper procedures is unchanged. Many of the technologies are also evolving naturally. You should therefore start by mapping out your current procedures and current security-related technologies, and see how they evolve to the cloud. In many cases you’ll see a correspondence. You’ll find however, that some areas really are a revolution. Clouds do not have walls, so physical security does not map well from the data center to the cloud. Clouds involve employees of the cloud service provider, so you need to find ways to control people who do not work for you. These are significant changes, and they require new technology and new procedures. InfoQ: What are the most important aspects of a cloud security policy? Gilad: Continuing the themes of evolution and revolution, some aspects of cloud security will seem familiar. Firewalls, antivirus, and authentication – are evolving to the world of cloud computing. You will find that your cloud provider often offers you solutions in these areas; and traditional vendors are evolving their solutions as well. Some aspects may change your current thinking. Since clouds do not have walls, and cloud employees could see your data - you must create metaphoric walls around your data. In cloud scenarios, data encryption is the recognized best practice for these new needs. Incidentally, data encryption also helps with a traditional data center need – most data breaches happen from the inside, so the threat is not just from cloud employees. However, there is no question that the threat from cloud insiders has shined a new spotlight on the need for data encryption. InfoQ: What is the best practice for encrypting cloud data?
  • 3. Gilad: You should encrypt data at rest and in motion. Encrypting “in motion” is already well known to you – the standards of HTTPS/SSL and IPSEC apply equally well in the data center and in the cloud. Encrypting “at rest” means that the data must be encrypted when it resides on a disk, in a database, on a file system, in storage, and of course if it is backed up. In the real world, people have not always done this in data centers – often relying on physical security as a replacement. In the cloud, physical security is no alternative – you must encrypt sensitive data. This actually means data must be encrypted constantly as it is being written, and decrypted only when it is going to be used (i.e. just before a specific calculation, and only in memory). Standards such as Advanced Encryption Standard (AES) are commonly used for data encryption at rest. InfoQ: Does cloud encryption singlehandedly protect data? Gilad: If data is properly encrypted it is, in a sense, locked and cannot be used if it falls into the wrong hands. Unless, of course, those hands have a key. Proper management of encryption keys is as important as the encryption itself. In fact, if you keep your encryption keys to yourself – you keep ownership of your data. This is an interesting and fundamental point – in the cloud you are outsourcing your infrastructure, but you can maintain ownership by keeping the encryption keys. If encryption keys are stored alongside the data, any breach that discloses the data will also disclose the key to access it. If encryption keys are stored with cloud providers, they own your data. Think of your data like a safe deposit box – would you leave your key with the banker? What if he gets robbed? What if his employees are paid to make copies of your key? A best practice is split key encryption[2]. With this method, your data is encrypted (e.g. with AES), and then the encryption key is split into parts. One part is managed with a cloud security provider and one part stays only with you. This way, only you control access to your data.
  • 4. Even if your encrypted data is compromised, the perpetrators will not be able to decrypt it and it will be useless to them. InfoQ: How can encryption keys be protected while they are in use? Gilad: Keys in use in the cloud do not have to be vulnerable. They can be protected using homomorphic key management[3]. This cryptographic technique gives the application access to the data store without ever exposing the master keys to the encryption - in an unencrypted state. It also ensures that if such (encrypted) keys are stolen, they can still never be used to access your data store InfoQ: Is cloud data encryption in compliance with regulations? Gilad: Regulations like Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and many others (GLBA, FINRA, PIPEDA, et al) require or encourage cloud data to be properly encrypted and encryption keys to be properly managed. Some of these regulations even provide for a sort of “safe harbor” – that is, if your data is breached, but you can prove that you took the necessary steps to encrypt it and maintain control of the encryption keys, you may save the financial burden, the bureaucratic reporting requirements, and the damage to reputation involved with such an event. InfoQ: Is cloud security cost-prohibitive and will it harm system performance? Gilad: The cloud is often chosen for its lower operational overhead, and sometimes for actual dollar savings, compared with traditional data centers. Securing a cloud project does not need to negate the cloud’s ease of use nor make the project prohibitively expensive. There are security solutions that require no hardware and, therefore, no large cap-ex investment. Pay-as-you-go business models make it easy to scale security up (or down) with the size of your project, as you add (or remove) virtual machines and data. Performance can also be good. Modern cloud security virtual appliances and virtual agents - are optimized for cloud throughput and latency. You’ll be able to dial up performance as your cloud project scales up. To take a concrete example – data encryption – good solutions will include a capability to stream data as it is being
  • 5. encrypted (or decrypted), and do so inside your cloud account. Such approaches mean that virtual CPUs available in your cloud will be able to handle your performance needs with low latency. InfoQ: Is there a way to protect cloud backups and disaster recovery? Gilad: Data must be secured throughout its lifecycle. Properly encrypting data while it is in use, but then offering hackers unencrypted replicas as backups defeats the purpose of encrypting in the first place. You must encrypt and own the encryption keys for every point of the lifecycle of your information. Fortunately solutions that are built for the cloud do exist, and they should cover backups as well as primary copies. InfoQ: What it more secure: a public cloud or a private cloud? Gilad: Public and private clouds each have pros and cons in terms of ownership, control, cost, convenience and multi-tenancy. We have found that private clouds often require security controls similar to public ones. Use cases may involve users external to your company; or large “virtual” deployments with multiple internal projects, each with a need for strong security segregation. Your data can be properly encrypted, your keys can be properly managed, and you can be safe in all the major cloud scenarios: private, public, or hybrid. InfoQ: If my data is in the cloud, my security is in the cloud, and my backup is in the cloud, what do I control? Gilad: If you use encryption properly and maintain control of the encryption keys, you have replaced your physical walls with mathematical walls. You will own your data. Even though you do not control the physical resources, you maintain control of what they contain. This is one reason why encryption in the cloud is the best practice. By properly using multiple regions or even multiple cloud providers, you can also ensure that you always have availability and access to your project and your data. By combining such techniques, you do take back control. As CIO and owner of your data, you must always control your data – from beginning to end. Your control does not need to be sacrificed when you migrate to the cloud, though it may need to be managed differently.
  • 6. About the Author Gilad Parann-Nissany is the founder and CEO of Porticor Cloud Security[4]. He is a pioneer in the field of cloud computing who has built SaaS clouds, contributed to SAP products and created a cloud operating system. He has written extensively on the importance of cloud encryption and encryption key management for PCI and HIPAA compliance. Gilad can be found on his blog[5], Twitter[6], LinkedIn [7], and Google+[8] discussing cloud security. Tell us what you think Re: Encryption only a small part of the story Feb 23, 2014 11:08 by Gilad ParannNissany Thanks Mike. Regarding the provider going bust, indeed encryption doesn't solve that. Yet try looking at two or more providers or at least two regions of the same provider for high availability. Encryption can help by securing both parts of your high availability deployment. Regarding integrity, there are cases where encryption or digital signatures can help you discover tampering has occured. More generally, if you snapshot your data regularly you'll be able to recover from the tampering. Again, the snapshots can and should be encrypted - a good solution will do that. More generally, encryption is crucial because it solves one of the main differences between clouds and traditional deployments. It restores control to the proper owner. 1. http://www.infoq.com/author/Gilad-Parran~Nissany 2. http://www.porticor.com/technology/ 3. http://www.porticor.com/homomorphic-encryption/
  • 7. 4. http://www.porticor.com/ 5. http://www.porticor.com/articles/general/ 6. https://twitter.com/giladpn 7. http://il.linkedin.com/in/giladparann 8. https://plus.google.com/109000829856881765332/posts