SlideShare a Scribd company logo
Cloud Computing & Security: Are
    there clouds in our sky ?
> Antonio Sanz
  > I3A - IT Manager
    > Security Expert
> http://i3a.unizar.es
 > ansanz@unizar.es
  > @antoniosanzalc
Cloud
Computing
Index                                        4




     > Cloud Computing

     > Opportunities

     > Cloud Computing risks

     > Migrating to a Cloud Infraestructure



Tema 1: Diseño de software seguro
Cloud Computing Security
“Cloud computing is a model for
  enabling ubiquitous, convenient,
 on-demand network access to a
    shared pool of configurable
     computing resources (e.g.,
     networks, servers, storage,
applications, and services) that can
    be rapidly provisioned and
released with minimal management
      effort or service provider
             interaction”

    [*First & last boring slide. Promise]
Cloud Computing: Main point        6




         >On demand
         >Ubiquous
         >Resource pool
         >Elastic
         >Measureable
Tema 1: Diseño de software seguro
Cloud Computing Security
Service Types
IaaS – Infrastructure as a Service                        8



                            > Raw infrastructure

                            > Storage, network & servers

                            > We do the rest

                            > Flexible but costly

                            > Ej: Amazon AWS



Tema 1: Diseño de software seguro
Cloud Computing Security
PaaS – Platform as a Service                           9



                         > You’ve got the OS but no
                           apps

                         > IaaS + OS + Base services

                         > App deploying ok (.jar)

                         > Less control but less cost

                         > Ej: Google App Engine



Tema 1: Diseño de software seguro
Cloud Computing Security
SaaS – Software as a Service                             10



                            > You’ve got everything

                            > Iaas + Paas + Apps

                            > Ready to go

                            > Minimal control / Minimal
                              effort

                            > Ej: Salesforce.com (CRM)



Tema 1: Diseño de software seguro
Cloud Computing Security
Public, Private Clouds                      11




         > Públic: Public access, shared
           resources, (-security, -cost)
           Ej: Amazon AWS

         > Private: Private access,
           dedicated resources (+security,
           +cost)
           Ej: NASA Nebula     OpenStack



Tema 1: Diseño de software seguro
Cloud Computing Security
Community , Hybrid                        12




        > Community: Group that shares
          a private cloud
          Ej: Business holding

        > Hybrid: Mix some of the others




Tema 1: Diseño de software seguro
Cloud Computing Security
Technology
Technologies                            14



        > Virtualization

        > Shared storage

        > High speed networks

        > Multidevice access

        > Advanced Middleware (access,
          monitoring, provisioning)



Tema 1: Diseño de software seguro
Cloud Computing Security
Advantages
Cloud Computing Pros                16



        > Elasticity / Scalability

        > Availability

        > Performance

        > Ubiquous access

        > Very low CAPEX

        > OPEX savings


Tema 1: Diseño de software seguro
Cloud Computing Security
Success Case
Amazon AWS - http://aws.amazon.com/          18



        > Amazon Web Services

        > EC2 (Elastic Cloud Computing)

        > S3 (Simple Storage Service)

        > You can do … almost everything

        > Others: Rackspace, vCloud, Azure,
          IBM (great, too)



Tema 1: Diseño de software seguro
Cloud Computing Security
NetFlix - http://www.netflix.com/               19



     > Video streaming (Films, serials, shows)

     > Almost 20% of EEUU bandwidth

     > Uses Amazon AWS

     > Benefits: Escalability + Availability

     > Video transcoding “on the fly” with EC2

     > Video storage in EC3 with S3

     > Usage data analysis with EC2



Tema 1: Diseño de software seguro
Cloud Computing Security
Dropbox - http://www.dropbox.com/                 20



        > Backup in the cloud

        > Around 12Pb (12.000 Tb)

        > Uses Amazon S3

        > Benefit: Escalability

        > Business model (VIP):
          http://www.w2lessons.com/2011/04/econo
          mics-of-dropbox.html



Tema 1: Diseño de software seguro
Cloud Computing Security
Technology

             Cloud
               Is
             Good!
Cloud Computing Risks
Business Risks
Vendor Lock-In
= To have you
  by the   balls

Vendor Lock-In
Vendor Lock-In
Vendor lock-in                                     27



     > It’s hard to say goodbye

     > SaaS : No “export” option

     > PaaS : API interoperability

     > IaaS : Different technologies

     > Defsense: Right CP (Cloud Provider) choice



Tema 1: Diseño de software seguro
Cloud Computing Security
Lack of IT Governance
Lack of IT Governance                      29




    > IT Governance != Cloud Computing
      Governance

    > Limited funcionalities / High costs

    > Loss of Control of our IT

    > Defense: Clear objectives & design,
      Right CP choice



Tema 1: Diseño de software seguro
Cloud Computing Security
Compliance & Laws
Compliance & Laws                          31




       > We need to comply with all the
         regulations (PCI DSS, LOPD)

       > Imposes transitive compliance on
         the CP

       > Legal lapses

       > Defense: Good analysis, right CP
         choice



Tema 1: Diseño de software seguro
Cloud Computing Security
SLAs
SLA (Service Level Agreements)       33



      > Contract signed with CP

      > Services offered

      > Warranties offered

      > Service metrics &
        compensations/penalties

      > Defense: SLA study & tuning



Tema 1: Diseño de software seguro
Cloud Computing Security
Provider Failures
Provider failures                       35



        > “Errare machina est”

        > Starting security standards

        > CP Business Continuity plan

        > OUR Business Continuity plan

        > Defense: Business continuity
          definition, right CP choice



Tema 1: Diseño de software seguro
Cloud Computing Security
Third party failures
Third party failures                             37



        > CP = Service & Technologies
          Integrator

        > But … what about electricity,
          connectivity, HVAC ?

        > We have to take care of our
          facilities too

        > Defense: Right CP choice, third party
          evaluation (CP and proper)


Tema 1: Diseño de software seguro
Cloud Computing Security
Technical risks
Resource
Starvation
Resource starvation                            40




       > Resources are assigned on demand

       > CP scales up … but how ?

       > Situation: No more resources
         available when they were most
         needed !!

       > Defense: Resource reservation, right
         CP choice


Tema 1: Diseño de software seguro
Cloud Computing Security
Isolation Faults
Isolation Faults                                 42




     > Cloud = Shared Resources = Shared flat

     > How secure is your neighbour ?

     > Third party security failure   Everybody
       is compromised

     > Defense: Private Clouds, right CP choice




Tema 1: Diseño de software seguro
Cloud Computing Security
Data leaks
Data leaks                                       44




        > Lots of sensitive info in our CP

        > Disgruntled employees

        > Wrong service configuration

        > Defense: Right CP choice, cipher use,
          log reviews




Tema 1: Diseño de software seguro
Cloud Computing Security
Data Transit
Data Transit                                46




        > Network        Information flows

        > Local interception

        > On transit interception

        > In-Cloud Intercepcion

        > Defense: SSL, cipher use




Tema 1: Diseño de software seguro
Cloud Computing Security
Cloud Provider Compromise
CP Compromise                                    48



     > Cloud = Technology mesh = Lots of
       possible security flaws

     > Cloud interface management attacks

     > Cloud user management attacks

     > Infrastructure attacks

     > Defense: Right CP choice, SLAs, incident
       response planning


Tema 1: Diseño de software seguro
Cloud Computing Security
DDOS
DDOS / EDOS                                        50



        > DDOS (Distributed Denial Of Service)

        > Intended to take down an infrastructure
          Attack to availability

        > Cloud    Neighbour are collateral damage

        > EDOS (Economic Denial of Service)

        > Intended to cause economic damage

        > Defense: SLAs, charge limits, incident
          response



Tema 1: Diseño de software seguro
Cloud Computing Security
Cipher & Backup
Cipher                                        52



        > Sensible info      Cipher

        > Secure information deletion (wipe)

        > Defensas: Strong ciphers, guardar
          claves, SLA




Tema 1: Diseño de software seguro
Cloud Computing Security
Backups                                        53




        > Info is EVERYTHING        Backups

        > Don’t forget your backups (even if
          the CP does … you too)

        > Automated procedure

        > Defensa: Procedure design, right CP
          choice




Tema 1: Diseño de software seguro
Cloud Computing Security
Logs Access                                     54



        > Logs = Activity of our IT

        > Needed to do debugging

        > Critic if a security incident arises

        > How can access my logs ?

        > Defense: SLA, right CP choice




Tema 1: Diseño de software seguro
Cloud Computing Security
Disaster
Recovery
Disaster Recovery                                    56



     > Shit happens (Murphy’s Law)

     > Earthquakes, fires, floods, alien invasions…

     > Our CP must have a Business Continuity
       plan

     > We must have ours !!

     > Defense: Business Continuity plan



Tema 1: Diseño de software seguro
Cloud Computing Security
57
Legal Risks




Tema 1: Diseño de software seguro
Cloud Computing Security
Compliance & Laws                               58




        > Lots of laws & regulations

        > Is our CP compliant ?

        > National & International laws

        > Defense: Preliminary analysis, right
          CP choice




Tema 1: Diseño de software seguro
Cloud Computing Security
Data protection                                 59



        > LOPD (Ley Orgánica de Protección
          de Datos)

        > Cloud implies sometimes
          international data transfers
          Complicated issues

        > Safe Harbour       Amazon, Google

        > Defense: Preliminary analysis, right
          CP choice


Tema 1: Diseño de software seguro
Cloud Computing Security
Computer Forensic                          60



       > Security incident in our CP
         Someone has set up a child
         pornography site

       > Maybe anyone in our cloud !!

       > Possible result = Server seizure

       > Defense: Right CP choice, SLA,
         Business Continuity plan


Tema 1: Diseño de software seguro
Cloud Computing Security
Using Cloud Computing
Analyze
Identify Services                             63




       > Services that can benefit most from
         Cloud Computing

       > Main benefits: Scalability,
         Availability & Elasticity

       > Intermitent but heavy resource use
         services (Ej: Sports newspapers on
         mondays)



Tema 1: Diseño de software seguro
Cloud Computing Security
Evaluate CC models                           64



        > IaaS, PaaS, SaaS ?

        > ¿Public, Private, Hybrid,
          Community?

        > See what others like us are doing

        > Decide which model fits our needs
          best



Tema 1: Diseño de software seguro
Cloud Computing Security
Know
Defining security needs                        66



        > Know our service throughly

        > Define the information flows

        > Identify sensitive info

        > Measure how critical the service is

        > Assign a value to the srevice



Tema 1: Diseño de software seguro
Cloud Computing Security
Risk Analysis                                67




       > Know the existing risks when using
         cloud computing

       > Apply them to our service

       > Define a maximum risk level

       > Important!: Be utterly objective




Tema 1: Diseño de software seguro
Cloud Computing Security
Plan
Evaluate cloud providers                   69



        > Read carefully the SLA (Service
          Level Agreements)

        > Read it again

        > Evaluate security compliance

        > Added value services

        > Price !



Tema 1: Diseño de software seguro
Cloud Computing Security
Security controls                        70




       > Define security controls

       > Controls in the cloud & our IT

       > Technical & procedural control

       > Target: Lower our real risk




Tema 1: Diseño de software seguro
Cloud Computing Security
Decide
Bean counting …                              72



        > Migration costs

        > Cloud operation costs

        > Current operation costs

        > Troubleshooting costs (both cloud
          & current)

        > Make money talk …



Tema 1: Diseño de software seguro
Cloud Computing Security
Make a decision                                73



        > Evaluate pros & cons of our current
          IT model & cloud computing

        > It’s not all about money …

        > Informed decision taking

        > You always should have a plan B




Tema 1: Diseño de software seguro
Cloud Computing Security
CC offers great
  opportunities
CC has   risks
          There has to
            be a plan
Conclusiones                              75




     >Cloud computing is here

     >Lots of business models &
      opportunities

     >Must know all the risks

     >Must have a sensible business plan



Tema 1: Diseño de software seguro
Cloud Computing Security
Conclusiones


               I love it
               when a
               cloud
                 plan
                comes
               together
Don’t be under a cloud !
More info?. Press here !                                          78



  Cloud Security Alliance
  https://cloudsecurityalliance.org/

  Cloud Computing Security Guide - CSA
  http://cloudsecurityalliance.org/guidance/csaguide.v2.1.pdf

  ENISA – Cloud Computing Security Risks
  http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-
     risk-assessment

  Australia Gov. - Cloud Computing Risk Analysis Report
  http://www.dsd.gov.au/publications/Cloud_Computing_Security_Consid
     erations.pdf




Tema 1: Diseño de software seguro
Cloud Computing Security
Have a plan and jump into the sky !




Antonio Sanz / ansanz@unizar.es / @antoniosanzalc
    $slides = http://www.slideshare.net/ansanz

More Related Content

PDF
Cloud computing understanding security risk and management
PDF
Cloud Security - Security Aspects of Cloud Computing
PPT
Security Issues of Cloud Computing
PPTX
Cloud Computing Security
PPTX
Cloud computing security issues and challenges
PDF
SailPoint - IdentityNow Identity Governance
PDF
Cloud Computing Security
PPTX
Cloud security Presentation
Cloud computing understanding security risk and management
Cloud Security - Security Aspects of Cloud Computing
Security Issues of Cloud Computing
Cloud Computing Security
Cloud computing security issues and challenges
SailPoint - IdentityNow Identity Governance
Cloud Computing Security
Cloud security Presentation

What's hot (20)

PPT
Cloud Security
PPTX
Chap 6 cloud security
PDF
Cloud Security: A New Perspective
PDF
Cloud Security Strategy
PPTX
Introduction to Mobile Cloud Computing
PPTX
Cloud Computing Security Issues
PDF
Microsoft Zero Trust
PPSX
Next-Gen security operation center
PPTX
Cloud Computing : Security and Forensics
PPTX
SEIM-Microsoft Sentinel.pptx
PPTX
Webinar - CMMC Certification.pptx
PPTX
Cloud service models
PDF
Privacy issues in the cloud
PPTX
The Zero Trust Model of Information Security
PPTX
Virtualization security threats in cloud computing
PPTX
Cloud Computing & Cloud Storage
PPT
Cloud computing
PDF
Container Security Using Microsoft Defender
PPTX
Cloud security and security architecture
PPTX
Cloud Security
Cloud Security
Chap 6 cloud security
Cloud Security: A New Perspective
Cloud Security Strategy
Introduction to Mobile Cloud Computing
Cloud Computing Security Issues
Microsoft Zero Trust
Next-Gen security operation center
Cloud Computing : Security and Forensics
SEIM-Microsoft Sentinel.pptx
Webinar - CMMC Certification.pptx
Cloud service models
Privacy issues in the cloud
The Zero Trust Model of Information Security
Virtualization security threats in cloud computing
Cloud Computing & Cloud Storage
Cloud computing
Container Security Using Microsoft Defender
Cloud security and security architecture
Cloud Security
Ad

Viewers also liked (20)

PPT
Cloud computing security
PPTX
Security in cloud computing
PPT
Cloud computing-security-issues
PPTX
Data security in cloud computing
PPT
Cloud computing security - Insights
PDF
Cloud computing & Security presentation
PDF
Cloud Computing Security
PPT
Cloud Computing - Security Benefits and Risks
PPTX
Cloud computing security
PPT
Cloud Computing & Security Concerns
PDF
Cloud Computing and Security - ISACA Hyderabad Chapter Presentation
PPT
Cloud Computing Security Issues
PDF
2013 State of Cloud Survey SMB Results
PDF
Breaking through the Clouds
PPTX
2013 Future of Cloud Computing - 3rd Annual Survey Results
PDF
Intro to cloud computing — MegaCOMM 2013, Jerusalem
PPTX
Cloud security ppt
PDF
Can we hack open source #cloud platforms to help reduce emissions?
PDF
Summer School Scale Cloud Across the Enterprise
PPTX
Simplifying The Cloud Top 10 Questions By SMBs
Cloud computing security
Security in cloud computing
Cloud computing-security-issues
Data security in cloud computing
Cloud computing security - Insights
Cloud computing & Security presentation
Cloud Computing Security
Cloud Computing - Security Benefits and Risks
Cloud computing security
Cloud Computing & Security Concerns
Cloud Computing and Security - ISACA Hyderabad Chapter Presentation
Cloud Computing Security Issues
2013 State of Cloud Survey SMB Results
Breaking through the Clouds
2013 Future of Cloud Computing - 3rd Annual Survey Results
Intro to cloud computing — MegaCOMM 2013, Jerusalem
Cloud security ppt
Can we hack open source #cloud platforms to help reduce emissions?
Summer School Scale Cloud Across the Enterprise
Simplifying The Cloud Top 10 Questions By SMBs
Ad

Similar to Cloud computing security (20)

PDF
Dr. Michael Valivullah, NASS/USDA - Cloud Computing
PDF
Peering Through the Cloud Forrester EMEA 2010
PDF
Info Sec 2010 Possibilities And Security Challenges Of Cloud Computing (Han...
PDF
Presd1 10
PDF
IBM Point of View: Security and Cloud Computing
PDF
IBM Point of view -- Security and Cloud Computing (Tivoli)
PDF
Cloud Computing 101 Workshop Sample
PDF
Taiye Lambo - Auditing the cloud
PPTX
Cloud Computing Security
PDF
Security of,for & by cloud
PPT
Cloudcomputingoct2009 100301142544-phpapp02
PDF
MISA Cloud workshop - Cloud 101
PPTX
Yes, you can be pci compliant using a public iaas cloud a case study by phi...
PDF
Cloud Security - Made simple
PPTX
Bright and Gray areas of Clound Computing
PDF
Clearing the air on Cloud Computing
PDF
Understanding the Cloud
PDF
Presenter manual cloud computing (specially for summer interns)
PDF
Cloud Computing Contracts and Services: What's Really Happening Out There? T...
PDF
Security & Privacy in Cloud Computing
Dr. Michael Valivullah, NASS/USDA - Cloud Computing
Peering Through the Cloud Forrester EMEA 2010
Info Sec 2010 Possibilities And Security Challenges Of Cloud Computing (Han...
Presd1 10
IBM Point of View: Security and Cloud Computing
IBM Point of view -- Security and Cloud Computing (Tivoli)
Cloud Computing 101 Workshop Sample
Taiye Lambo - Auditing the cloud
Cloud Computing Security
Security of,for & by cloud
Cloudcomputingoct2009 100301142544-phpapp02
MISA Cloud workshop - Cloud 101
Yes, you can be pci compliant using a public iaas cloud a case study by phi...
Cloud Security - Made simple
Bright and Gray areas of Clound Computing
Clearing the air on Cloud Computing
Understanding the Cloud
Presenter manual cloud computing (specially for summer interns)
Cloud Computing Contracts and Services: What's Really Happening Out There? T...
Security & Privacy in Cloud Computing

More from Antonio Sanz Alcober (20)

PDF
Ciberamenazas - ¿A qué nos enfrentamos?
PDF
Zen y el arte de pescar APT
PDF
China y el ciberespionaje: Sun Tzu, APT1 y los tiempos interesantes.
PDF
Cyberthreats: Are we screwed ?
PDF
Computer Forensics: You can run but you can't hide
DOCX
SEA - Syrian Electronic Army - Cyberterrorism
PDF
Sex lies and queues: Confessions of an HPC sysadmin
PDF
Cómo comprar seguro en internet
PDF
Apple compra Microsoft : Respuesta ante incidentes de seguridad en redes soci...
PDF
Harry el Sucio te enseña Seguridad en Wordpress
PDF
Sex, lies and magnetic tapes: Confessions of a sysadmin
PDF
Cibercrimen qué hace tu dinero cuando no lo miras
PDF
Administracion electronica: Tecnologías al servicio del ciudadano
PDF
Solving Big problems with Condor - II HPC Sysadmins Meeting
PDF
Supercomputación: Haciendo HOY la ciencia del mañana
PDF
Historia de la inteligencia china
PDF
Análisis de la capacidad científica, tecnológica e innovadora de la república...
PDF
Por qué un Pecha Kucha es mejor que un Iphone (y casi tanto como el chocolate)
PDF
Seguridad en redes sociales
PDF
Capacidades de China para la ciberguerra
Ciberamenazas - ¿A qué nos enfrentamos?
Zen y el arte de pescar APT
China y el ciberespionaje: Sun Tzu, APT1 y los tiempos interesantes.
Cyberthreats: Are we screwed ?
Computer Forensics: You can run but you can't hide
SEA - Syrian Electronic Army - Cyberterrorism
Sex lies and queues: Confessions of an HPC sysadmin
Cómo comprar seguro en internet
Apple compra Microsoft : Respuesta ante incidentes de seguridad en redes soci...
Harry el Sucio te enseña Seguridad en Wordpress
Sex, lies and magnetic tapes: Confessions of a sysadmin
Cibercrimen qué hace tu dinero cuando no lo miras
Administracion electronica: Tecnologías al servicio del ciudadano
Solving Big problems with Condor - II HPC Sysadmins Meeting
Supercomputación: Haciendo HOY la ciencia del mañana
Historia de la inteligencia china
Análisis de la capacidad científica, tecnológica e innovadora de la república...
Por qué un Pecha Kucha es mejor que un Iphone (y casi tanto como el chocolate)
Seguridad en redes sociales
Capacidades de China para la ciberguerra

Recently uploaded (20)

PPTX
A Presentation on Artificial Intelligence
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
PDF
Per capita expenditure prediction using model stacking based on satellite ima...
PDF
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
PPTX
MYSQL Presentation for SQL database connectivity
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
PPTX
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
PDF
NewMind AI Weekly Chronicles - August'25 Week I
PDF
Machine learning based COVID-19 study performance prediction
PDF
CIFDAQ's Market Insight: SEC Turns Pro Crypto
PDF
Electronic commerce courselecture one. Pdf
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
PDF
Unlocking AI with Model Context Protocol (MCP)
PDF
Modernizing your data center with Dell and AMD
PDF
Dropbox Q2 2025 Financial Results & Investor Presentation
PPT
Teaching material agriculture food technology
A Presentation on Artificial Intelligence
Digital-Transformation-Roadmap-for-Companies.pptx
Per capita expenditure prediction using model stacking based on satellite ima...
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
Diabetes mellitus diagnosis method based random forest with bat algorithm
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
MYSQL Presentation for SQL database connectivity
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
NewMind AI Weekly Chronicles - August'25 Week I
Machine learning based COVID-19 study performance prediction
CIFDAQ's Market Insight: SEC Turns Pro Crypto
Electronic commerce courselecture one. Pdf
Advanced methodologies resolving dimensionality complications for autism neur...
Mobile App Security Testing_ A Comprehensive Guide.pdf
Unlocking AI with Model Context Protocol (MCP)
Modernizing your data center with Dell and AMD
Dropbox Q2 2025 Financial Results & Investor Presentation
Teaching material agriculture food technology

Cloud computing security

  • 1. Cloud Computing & Security: Are there clouds in our sky ?
  • 2. > Antonio Sanz > I3A - IT Manager > Security Expert > http://i3a.unizar.es > ansanz@unizar.es > @antoniosanzalc
  • 4. Index 4 > Cloud Computing > Opportunities > Cloud Computing risks > Migrating to a Cloud Infraestructure Tema 1: Diseño de software seguro Cloud Computing Security
  • 5. “Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction” [*First & last boring slide. Promise]
  • 6. Cloud Computing: Main point 6 >On demand >Ubiquous >Resource pool >Elastic >Measureable Tema 1: Diseño de software seguro Cloud Computing Security
  • 8. IaaS – Infrastructure as a Service 8 > Raw infrastructure > Storage, network & servers > We do the rest > Flexible but costly > Ej: Amazon AWS Tema 1: Diseño de software seguro Cloud Computing Security
  • 9. PaaS – Platform as a Service 9 > You’ve got the OS but no apps > IaaS + OS + Base services > App deploying ok (.jar) > Less control but less cost > Ej: Google App Engine Tema 1: Diseño de software seguro Cloud Computing Security
  • 10. SaaS – Software as a Service 10 > You’ve got everything > Iaas + Paas + Apps > Ready to go > Minimal control / Minimal effort > Ej: Salesforce.com (CRM) Tema 1: Diseño de software seguro Cloud Computing Security
  • 11. Public, Private Clouds 11 > Públic: Public access, shared resources, (-security, -cost) Ej: Amazon AWS > Private: Private access, dedicated resources (+security, +cost) Ej: NASA Nebula OpenStack Tema 1: Diseño de software seguro Cloud Computing Security
  • 12. Community , Hybrid 12 > Community: Group that shares a private cloud Ej: Business holding > Hybrid: Mix some of the others Tema 1: Diseño de software seguro Cloud Computing Security
  • 14. Technologies 14 > Virtualization > Shared storage > High speed networks > Multidevice access > Advanced Middleware (access, monitoring, provisioning) Tema 1: Diseño de software seguro Cloud Computing Security
  • 16. Cloud Computing Pros 16 > Elasticity / Scalability > Availability > Performance > Ubiquous access > Very low CAPEX > OPEX savings Tema 1: Diseño de software seguro Cloud Computing Security
  • 18. Amazon AWS - http://aws.amazon.com/ 18 > Amazon Web Services > EC2 (Elastic Cloud Computing) > S3 (Simple Storage Service) > You can do … almost everything > Others: Rackspace, vCloud, Azure, IBM (great, too) Tema 1: Diseño de software seguro Cloud Computing Security
  • 19. NetFlix - http://www.netflix.com/ 19 > Video streaming (Films, serials, shows) > Almost 20% of EEUU bandwidth > Uses Amazon AWS > Benefits: Escalability + Availability > Video transcoding “on the fly” with EC2 > Video storage in EC3 with S3 > Usage data analysis with EC2 Tema 1: Diseño de software seguro Cloud Computing Security
  • 20. Dropbox - http://www.dropbox.com/ 20 > Backup in the cloud > Around 12Pb (12.000 Tb) > Uses Amazon S3 > Benefit: Escalability > Business model (VIP): http://www.w2lessons.com/2011/04/econo mics-of-dropbox.html Tema 1: Diseño de software seguro Cloud Computing Security
  • 21. Technology Cloud Is Good!
  • 25. = To have you by the balls Vendor Lock-In
  • 27. Vendor lock-in 27 > It’s hard to say goodbye > SaaS : No “export” option > PaaS : API interoperability > IaaS : Different technologies > Defsense: Right CP (Cloud Provider) choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 28. Lack of IT Governance
  • 29. Lack of IT Governance 29 > IT Governance != Cloud Computing Governance > Limited funcionalities / High costs > Loss of Control of our IT > Defense: Clear objectives & design, Right CP choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 31. Compliance & Laws 31 > We need to comply with all the regulations (PCI DSS, LOPD) > Imposes transitive compliance on the CP > Legal lapses > Defense: Good analysis, right CP choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 32. SLAs
  • 33. SLA (Service Level Agreements) 33 > Contract signed with CP > Services offered > Warranties offered > Service metrics & compensations/penalties > Defense: SLA study & tuning Tema 1: Diseño de software seguro Cloud Computing Security
  • 35. Provider failures 35 > “Errare machina est” > Starting security standards > CP Business Continuity plan > OUR Business Continuity plan > Defense: Business continuity definition, right CP choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 37. Third party failures 37 > CP = Service & Technologies Integrator > But … what about electricity, connectivity, HVAC ? > We have to take care of our facilities too > Defense: Right CP choice, third party evaluation (CP and proper) Tema 1: Diseño de software seguro Cloud Computing Security
  • 40. Resource starvation 40 > Resources are assigned on demand > CP scales up … but how ? > Situation: No more resources available when they were most needed !! > Defense: Resource reservation, right CP choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 42. Isolation Faults 42 > Cloud = Shared Resources = Shared flat > How secure is your neighbour ? > Third party security failure Everybody is compromised > Defense: Private Clouds, right CP choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 44. Data leaks 44 > Lots of sensitive info in our CP > Disgruntled employees > Wrong service configuration > Defense: Right CP choice, cipher use, log reviews Tema 1: Diseño de software seguro Cloud Computing Security
  • 46. Data Transit 46 > Network Information flows > Local interception > On transit interception > In-Cloud Intercepcion > Defense: SSL, cipher use Tema 1: Diseño de software seguro Cloud Computing Security
  • 48. CP Compromise 48 > Cloud = Technology mesh = Lots of possible security flaws > Cloud interface management attacks > Cloud user management attacks > Infrastructure attacks > Defense: Right CP choice, SLAs, incident response planning Tema 1: Diseño de software seguro Cloud Computing Security
  • 49. DDOS
  • 50. DDOS / EDOS 50 > DDOS (Distributed Denial Of Service) > Intended to take down an infrastructure Attack to availability > Cloud Neighbour are collateral damage > EDOS (Economic Denial of Service) > Intended to cause economic damage > Defense: SLAs, charge limits, incident response Tema 1: Diseño de software seguro Cloud Computing Security
  • 52. Cipher 52 > Sensible info Cipher > Secure information deletion (wipe) > Defensas: Strong ciphers, guardar claves, SLA Tema 1: Diseño de software seguro Cloud Computing Security
  • 53. Backups 53 > Info is EVERYTHING Backups > Don’t forget your backups (even if the CP does … you too) > Automated procedure > Defensa: Procedure design, right CP choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 54. Logs Access 54 > Logs = Activity of our IT > Needed to do debugging > Critic if a security incident arises > How can access my logs ? > Defense: SLA, right CP choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 56. Disaster Recovery 56 > Shit happens (Murphy’s Law) > Earthquakes, fires, floods, alien invasions… > Our CP must have a Business Continuity plan > We must have ours !! > Defense: Business Continuity plan Tema 1: Diseño de software seguro Cloud Computing Security
  • 57. 57 Legal Risks Tema 1: Diseño de software seguro Cloud Computing Security
  • 58. Compliance & Laws 58 > Lots of laws & regulations > Is our CP compliant ? > National & International laws > Defense: Preliminary analysis, right CP choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 59. Data protection 59 > LOPD (Ley Orgánica de Protección de Datos) > Cloud implies sometimes international data transfers Complicated issues > Safe Harbour Amazon, Google > Defense: Preliminary analysis, right CP choice Tema 1: Diseño de software seguro Cloud Computing Security
  • 60. Computer Forensic 60 > Security incident in our CP Someone has set up a child pornography site > Maybe anyone in our cloud !! > Possible result = Server seizure > Defense: Right CP choice, SLA, Business Continuity plan Tema 1: Diseño de software seguro Cloud Computing Security
  • 63. Identify Services 63 > Services that can benefit most from Cloud Computing > Main benefits: Scalability, Availability & Elasticity > Intermitent but heavy resource use services (Ej: Sports newspapers on mondays) Tema 1: Diseño de software seguro Cloud Computing Security
  • 64. Evaluate CC models 64 > IaaS, PaaS, SaaS ? > ¿Public, Private, Hybrid, Community? > See what others like us are doing > Decide which model fits our needs best Tema 1: Diseño de software seguro Cloud Computing Security
  • 65. Know
  • 66. Defining security needs 66 > Know our service throughly > Define the information flows > Identify sensitive info > Measure how critical the service is > Assign a value to the srevice Tema 1: Diseño de software seguro Cloud Computing Security
  • 67. Risk Analysis 67 > Know the existing risks when using cloud computing > Apply them to our service > Define a maximum risk level > Important!: Be utterly objective Tema 1: Diseño de software seguro Cloud Computing Security
  • 68. Plan
  • 69. Evaluate cloud providers 69 > Read carefully the SLA (Service Level Agreements) > Read it again > Evaluate security compliance > Added value services > Price ! Tema 1: Diseño de software seguro Cloud Computing Security
  • 70. Security controls 70 > Define security controls > Controls in the cloud & our IT > Technical & procedural control > Target: Lower our real risk Tema 1: Diseño de software seguro Cloud Computing Security
  • 72. Bean counting … 72 > Migration costs > Cloud operation costs > Current operation costs > Troubleshooting costs (both cloud & current) > Make money talk … Tema 1: Diseño de software seguro Cloud Computing Security
  • 73. Make a decision 73 > Evaluate pros & cons of our current IT model & cloud computing > It’s not all about money … > Informed decision taking > You always should have a plan B Tema 1: Diseño de software seguro Cloud Computing Security
  • 74. CC offers great opportunities CC has risks There has to be a plan
  • 75. Conclusiones 75 >Cloud computing is here >Lots of business models & opportunities >Must know all the risks >Must have a sensible business plan Tema 1: Diseño de software seguro Cloud Computing Security
  • 76. Conclusiones I love it when a cloud plan comes together
  • 77. Don’t be under a cloud !
  • 78. More info?. Press here ! 78 Cloud Security Alliance https://cloudsecurityalliance.org/ Cloud Computing Security Guide - CSA http://cloudsecurityalliance.org/guidance/csaguide.v2.1.pdf ENISA – Cloud Computing Security Risks http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing- risk-assessment Australia Gov. - Cloud Computing Risk Analysis Report http://www.dsd.gov.au/publications/Cloud_Computing_Security_Consid erations.pdf Tema 1: Diseño de software seguro Cloud Computing Security
  • 79. Have a plan and jump into the sky ! Antonio Sanz / ansanz@unizar.es / @antoniosanzalc $slides = http://www.slideshare.net/ansanz