1.
Dave Asprey • VP Cloud Security<br />Dave_asprey@trendmicro.com<br />@daveasprey (cloud + virtual security tweets)<br />Encryption in the public cloud: 16 Bits of Advice for Security techniques<br />

2.
Trend Micro Confidential 3/23/2011<br />2<br />Adapted from an original presentation delivered to<br />Members of the SDforum, Jan. 2011<br />By Dave Asprey, VP of Cloud Security, Trend Micro<br />

3.
Your speaker<br />Dave Asprey<br />VP, Cloud Security<br />Cloud & Virtualization Evangelist<br />dave_asprey@trendmicro.com @daveasprey<br />cloudsecurity.trendmicro.com Linkedin.com/in/asprey<br />Background<br />Blue Coat - VP Technology<br />Citrix - Strategic Planning, Virtualization Business<br />Netscaler – Dir PM<br />Exodus/Savvis – Dir PM & Strategy exec<br />Speedera/Akamai – Sr. Dir PM<br />3Com – Web IT guy<br />UC Santa Cruz – Ran Web & Internet Engineering Program <br />Author, PWC Tech Forecast: Systems & Network Mgt + Scaling<br />Trend Micro Confidential3/23/2011<br />3<br />

4.
Data Privacy Concerns in the Cloud<br />▪ Data is stored in plain text<br />▪ Virtual volumes can move without the owners knowledge<br />▪ Little ability to audit or monitor access to resources or data<br />▪ Hypervisors and storage are shared with other users<br />▪ Storage devices contain residual data<br />

5.
Amazon Web Services™ Customer Agreement<br />Trend Micro Confidential3/23/2011<br />5<br />7.2. Security. We strive to keep Your Content secure, but cannot guarantee that we will be successful at doing so, given the nature of the Internet. Accordingly, without limitation to Section 4.3 above and Section 11.5 below, you acknowledge that you bear sole responsibility for adequate security, protection and backup of Your Content and Applications. We strongly encourage you, where available and appropriate, to (a) use encryption technology to protect Your Content from unauthorized access, (b) routinely archive Your Content, and (c) keep your Applications or any software that you use or run with our Services current with the latest security patches or updates. We will have no liability to you for any unauthorized access or use, corruption, deletion, destruction or loss of any of Your Content or Applications.<br />Translation: If it gets hacked, it’s your fault.<br />http://aws.amazon.com/agreement/#7 (23 November 2010)<br />

6.
6<br />Security: the #1 Cloud Challenge<br />Security and privacy higher than <br />Sum (performance, immaturity, regulatory compliance)<br />Gartner (April 2010)<br />Classification 3/23/2011<br />

7.
Use encrypted, self-defending hosts<br />Classification 3/23/2011<br />7<br />Multiple customers on one physical server – potential for attacks via the hypervisor<br />Shared network inside the firewall<br />Doesn’t matter – the edge of my virtual machine is protected<br />Doesn’t matter – treat the LAN as public<br />Internet<br />Shared Storage<br />Shared Firewall<br />Shared firewall – Lowest common denominator – less fine grained control<br />Easily copied machine images – who else has your server?<br />Shared storage – is customer segmentation secure against attack?<br />Virtual Servers<br />Doesn’t matter – They can start my server but only I can unlock my data<br />Doesn’t matter – My data is encrypted<br />Doesn’t matter – treat the LAN as public<br />

8.
Advice<br />1. Encrypt network traffic<br />2. Use only encrypted file systems for block devices<br />3. Encrypt everything in shared storage<br />4. Only allow decryption keys to enter the cloud during decryption<br />5. Only authentication credential in VMs = key to decrypt file system key<br />Trend Micro Confidential3/23/2011<br />8<br />

9.
…More advice<br />6. At instance startup, fetch encrypted file system key<br />7. No password-based authentication for shell access<br />8. No allowed passwords for sudo access (!)<br />9. Make regular backups off-cloud<br />Trend Micro Confidential3/23/2011<br />9<br />

10.
…Even more advice<br />10. Minimize # of services per VM instance (goal = 1)<br />11. Only open ports you need<br />12. Specify source addresses & only allow HTTP global access<br />13. Keep sensitive data in a separate database<br />Trend Micro Confidential3/23/2011<br />10<br />

11.
Final advice<br />14. Use host-based intrusion detection system<br />15. Use system hardening tools<br />16. Write better applications!<br />Trend Micro Confidential3/23/2011<br />11<br />

12.
Thank You. <br />Dave Asprey<br />VP Cloud Security<br />dave_asprey@trendmicro.com<br />@daveasprey<br />cloudsecurity.trendmicro.com<br />Props to: George Reese & O’Reilly Blog<br />Trend Micro Confidential3/23/2011<br />12<br />