Cloud Security
- 1. Dr.M.Pyingkodi Dept of Computer Applications Kongu Engineering College Erode, India [email protected]
- 2. Cloud Security Consists of a set of policies, controls, procedures and technologies that work together to protect » Cloud-based systems » Data and » infrastructure Procedures and technology that secure cloud computing environments against both external and insider cybersecurity threats. Security measures are configured to protect cloud data, support regulatory compliance Protect customers privacy as well as setting authentication rules for individual users and devices. From authenticating access to filtering traffic, cloud security can be configured to the exact needs of the business
- 3. Cloud Security Challenges People can attack network hosts and web apps as fast as they can be protected. Cloud administrators should test their environments and have the latest security audits and reports. Take care when adopting new technologies, such as AI and machine learning, which use many data sources
- 4. Areas of cloud computing that they felt were uniquely troublesome • Auditing A cloud auditor can make an assessment of the security controls in the information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to the security requirements for the system • Data integrity • e-Discovery for legal compliance E-discovery is still reliable for organizing and preserving data for legal compliance, but e-discovery in the cloud and container-based storage complicate governance processes. • Privacy • Recovery • Regulatory compliance Cloud compliance is about complying with the laws and regulations
- 5. To evaluate your risks Need to perform the following analysis 1.Determine which resources (data, services, or applications) you are planning to move to the cloud. 2.Determine the sensitivity of the resource to risk. Risks that need to be evaluated are loss of privacy, unauthorized access by others, loss of data, and interruptions in availability 3.Determine the risk associated with the particular cloud type for a resource. 4.Take into account the particular cloud service model that you will be using. 5.If you have selected a particular cloud service provider, you need to evaluate its system to understand how data is transferred, where it is stored, and how to move data both in and out of the cloud.
- 6. Cloud Computing Categories 1. Public cloud services, operated by a public cloud provider software-as-a-service (SaaS), infrastructure-as-a-service (IaaS), and platform-as-a-service (PaaS). 2.Private cloud services, operated by a public cloud provider These services provide a computing environment dedicated to one customer, operated by a third party. 3.Private cloud services, operated by internal staff These services are an evolution of the traditional data center, where internal staff operates a virtual environment they control. 4.Hybrid cloud services Private and public cloud computing configurations can be combined, hosting workloads and data based on optimizing factors such as cost, security, operations and access. Operation will involve internal staff, and optionally the public cloud provider.
- 7. Cloud Security Alliance The security boundary The boundary between the responsibility of the service provider is separate from the responsibility of the customer. The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA’s comprehensive research program works in collaboration with industry, higher education and government on a global basis.
- 8. The CSA partitions its guidance into a set of operational domains • Governance and enterprise risk management • Legal and electronic discovery • Compliance and audit • Information lifecycle management • Portability and interoperability • Traditional security, business continuity, and disaster recovery • Datacenter operations • Incidence response, notification, and remediation • Application security • Encryption and key management • Identity and access management • Virtualization
- 10. Security service boundary In the SaaS model, the vendor provides security as part of the Service Level Agreement, with the compliance, governance, and liability levels stipulated under the contract for the entire stack. For the PaaS model, the security boundary may be defined for the vendor to include the software framework and middleware layer. In the PaaS model, the customer would be responsible for the security of the application and UI at the top of the stack. The model with the least built-in security is IaaS, where everything that involves software of any kind is the customer’s problem.
- 11. Security Responsibilities by Services Models
- 12. Security mapping The cloud service model you choose determines where in the proposed deployment the variety of security features, compliance auditing, and other requirements must be placed. To determine the particular security mechanisms you need, you must perform a mapping of the particular cloud service model to the particular application you are deploying. These mechanisms must be supported by the various controls that are provided by your service provider, your organization, or a third party. A security control model includes the security that you normally use for your applications, data, management, network, and physical hardware
- 13. Securing Data Securing data sent to, received from, and stored in the cloud is the single largest security concern that most organizations should have with cloud computing These are the key mechanisms for protecting ❖Access control ❖Auditing ❖ Authentication ❖Authorization data mechanisms
- 14. Brokered Cloud Storage Access The problem with the data you store in the cloud is that it can be located anywhere in the cloud service provider’s system: In another datacenter, another state or province, and in many cases even in another country. Therefore, to protect your cloud storage assets, you want to find a way to isolate data from direct client access. Brokered Cloud Storage Access is an approach for isolating storage in the cloud. In this approach, two services are created: A broker with full access to storage but no access to client. A proxy with no access to storage but access to both client and broker.
- 15. Brokered Cloud Storage Access Isolated Access to Data Data stored in cloud can be retrieved from anywhere, hence it should have a mechanism to isolate data and protect it from clients direct access. To isolate storage in the cloud, Brokered Cloud Storage Access is an approach. Following two services are generated in this approach: • A broker with complete access to storage, but no access to client. • A proxy with no access to storage, but access to client and broker both. The broker does not need full access to the cloud storage, but it may be configured to grant READ and QUERY operations, while not allowing APPEND or DELETE. The proxy has a limited trust role, while the broker can run with higher privileges or even as native code.
- 16. Security mapping Two services are in the direct data path between the client and data stored in the cloud. A broker with complete access to storage, but no access to client. A proxy with no access to storage, but access to client and broker both. Under this system, when a client makes a request for data, here’s what happens: 1. The request goes to the external service interface (or endpoint) of the proxy, which has only a partial trust. 2. The proxy, using its internal interface, forwards the request to the broker. 3. The broker requests the data from the cloud storage system. 4. The storage system returns the results to the broker. 5. The broker returns the results to the proxy. 6. The proxy completes the response by sending the data requested to the client.
- 17. Working of Brokered Cloud Access System
- 18. Creation of Storage Zones with Associated Encryption Keys
- 19. Storage location and Tenancy data stored in the cloud is usually stored from multiple tenants, each vendor has its own unique method for segregating one customer’s data from another. Important to have some understanding of how your specific service provider maintains data segregation. Most cloud service providers store data in an encrypted form. Encryption does present its own set of problems. There is a problem with encrypted data, the result is that the data may not be recoverable
- 20. Encryption • Strong encryption technology is a core technology for protecting data in transit to and from the cloud as well as data stored in the cloud. • The goal of encrypted cloud storage is to create a virtual private storage system that maintains confidentiality and data integrity while maintaining the benefits of cloud storage: ubiquitous, reliable, shared data storage. • Encryption should separate stored data (data at rest) from data in transit. • Microsoft allows up to five security accounts per client, and you can use these different accounts to create different zones. • On Amazon Web Service, you can create multiple keys and rotate those keys during different sessions. • Keys should have a defined lifecycle. • Among the schemes used to protect keys are the creation of secure key stores that have restricted role-based access, automated key stores backup, and recovery techniques. • It’s a good idea to separate key management from the cloud provider
- 21. Auditing and compliance Logging is the recording of events into a repository; auditing is the ability to monitor the events to understand performance. Logging and auditing is an important function because it is not only necessary for evaluation performance. Logs should record system, application, and security events, at the very minimum. Cloud service providers often have proprietary log formats that you need to be aware of. Monitoring and analysis tools you use need to be aware of these logs and able to work with them. Cloud services are both multitenant and multisite operations, the logging activity and data for different clients may not only be co-located, they may also be moving across a landscape of different hosts and sites.
- 22. Compliance under the laws of the governing bodies • Which regulations apply to your use of a particular cloud computing service • Which regulations apply to the cloud service provider and where the demarcation line falls for responsibilities • How your cloud service provider will support your need for information associated with regulation • How to work with the regulator to provide the information necessary regardless of who had the responsibility to collect the data
- 23. SLAs that enforce for protections • You have contracts reviewed by your legal staff. • You have a right-to-audit clause in your SLA. • You review any third parties who are service providers and assess their impact on security and regulatory compliance. • You understand the scope of the regulations that apply to your cloud computing applications and services. • You consider what steps you must take to comply with the demands of regulations that apply. • You consider adjusting your procedures to comply with regulations. • You collect and maintain the evidence of your compliance with regulations. • You determine whether your cloud service provider can provide an audit statement that is SAS 70 Type II-compliant.
- 24. Establishing Identity • Managing personal identity information so that access to computer resources, applications, data, and services is controlled properly. • IDaaS is cloud-based authentication built and operated by a third-party provider. • The goal of an Identity Service is to ensure users are who they claim to be, and to give them the right kinds of access to software applications, files, or other resources at the right times • Identity management is a primary mechanism for controlling access to data in the cloud, prevent_x0002_ing unauthorized uses, maintaining user roles, and complying with regulations.
- 25. Presence • Its purpose is to signal availability for interaction over a network. • It is used on networks to indicate the status of available parties and their location • Presence is an enabling technology for peer-to-peer interaction. • it adds context that can modify services and service delivery • Among the cloud computing services that rely on • presence information are telephony systems such as VoIP, instant messaging services (IM), and geo-location-based systems such as GPS. • Presence is playing an important role in cell phones, particularly smart phones.
- 26. Identity protocol standards Identity Protocol Standards define how exchange identity information between parties. Many protocols that provide identity services form the basis to create interoperability among services. Commonly used Identity protocol standards: • OpenID • XACML and SAML • OAuth Cloud computing requires the following: • That you establish an identity • That the identity be authenticated • That the authentication be portable • That authentication provide access to cloud
- 27. OpenID ❖It is the standard associated with creating an identity and authenticate its use by a third-party service. ❖It is the key to creating Single Sign-On (SSO) systems. ❖OpenID doesn’t specify the means for authentication of an identity; a particular system should execute the authentication process. ❖Authentication can be by a Challenge and Response Protocol (CHAP), through smart card, or a biometric measurement. In OpenIDL, the authentication procedure has the following steps: • The end-user uses a program like a browser that is called a user agent to enter an OpenID identifier. • The OpenID is presented to a service that provides access to the resource that is desired. • An entity called a relaying party queries the OpenID identity provider to authenticate the accuracy of the OpenID credentials. • The authentication is sent back to the relaying party from the identity provider and access is either provided or denied.
- 28. OAuth • An open standard called OAuth provides a token service that can be used to present validated access to resources. • The use of OAuth tokens allows clients to present credentials that contain no account information (userID or password) to a cloud service. • The token comes with a defined period after which it can no longer be used.
- 29. Windows Azure Identity Standards The Windows Azure Platform uses a claims-based identity based on open authentication and access protocols. These standards may be used without modification on a system that is running in the cloud or on-premises. Windows Azure security draws on the following three services: • Active Directory Federation Services 2.0 It is a Security Token Service (STS) that allows users to authenticate their access to applications both locally and in the cloud with a claims- based identity. • Windows Azure AppFabric Access Control Service Claims-based identity system is built directly into the AppFabric Access Control authentication and claims-based authorization access. • Windows Identity Foundation (WIF) SOAP service (WCF-SOAP) into a unified object model. This allows WIF to have full access to the features of WS-Security and to work with tokens in the SAML format.