Securing the Cloud [2011]

Securing the Cloud Cloud Computer Security Techniques and Tactics This page intentionally left blank Securing the Cloud Cloud Computer Security Techniques and Tactics Vic (J.R.) Winkler Technical Editor Bill Meine AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an imprint of Elsevier Acquiring Editor: Angelina Ward Development Editor: Matt Cater Project Manager: Jessica Vaughan Designer: Alisa Andreola Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA © 2011 Elsevier Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Application submitted British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 978-1-59749-592-9 For information on all Syngress publications visit our website at www.syngress.com Typeset by: diacriTech, Chennai, India Printed in the United States of America 10 11 12 13 14 10 9 8 7 6 5 4 3 2 1 This book is dedicated to my parents Gernot and Renate, wife Rebecca, daughter Carra, and to Rebecca’s father William Payne. Rebecca: Thank you for putting up with me (and not only because of this book) during this time. I owe you a great deal. Carra: You are embarking on your own story; watch your punctuation. Blue skies and may the wind always be at your back. My father-in-law William Payne passed away this past year. Bill embodied Southern charm and he left a legacy not only with his daughter but also as the Chief Engineer of the C130. This page intentionally left blank Contents Acknowledgments. .......................................................xiii About the Author............................................................xv About the Technical Editor. xvii Introduction.................................................................xix CHAPTER 1 Introduction to Cloud Computing and Security.................1 Understanding Cloud Computing. 1 Cloud Scale, Patterns, and Operational Efficiency.........2 A Synergistic Trick. ........................3 Elasticity, Shape Shifting, and Security...................3 The IT Foundation for Cloud. 4 Cloud Computing as Foundation for Cloud Services. 5 Cloud Computing Qualities. 7 The Bottom Line. ............................................8 An Historical View: Roots of Cloud Computing. ...........10 Decentralization and Proliferation. 10 Networking, the Internet, and the Web. 11 Virtualization...........................................12 A Brief Primer on Security: From 50,000 ft...................13 Terminology and Principles.............................14 Risk Management. ..................................17 Security Must Become a Business Enabler...............17 A Brief Primer on Architecture. 18 Systems Engineering....................................19 IT Architecture.........................................20 Security Architecture: A Brief Discussion. 20 Defense in Depth. 23 Cloud Is Driving Broad Changes. ...........................23 Cloud Works Today. ..................................24 Valid Concerns. .......................................25 Summary. ..................................................26 Endnotes. ...................................................26 CHAPTER 2 Cloud Computing Architecture................................29 Cloud Reference Architecture. ............................29 Revisiting Essential Characteristics. 30 Cloud Service Models. 33 Cloud Deployment Models..............................35 vii viii Contents Control over Security in the Cloud Model. 37 Cloud Application Programming Interfaces. 39 Making Sense of Cloud Deployment. 39 Public Clouds. ........................................40 Private Clouds..........................................40 Community Clouds. 41 Hybrid Clouds. .......................................41 Making Sense of Services Models. .........................43 Cloud Software-as-a-Service............................43 Cloud Platform-as-a-Service.............................43 Cloud Infrastructure-as-a-Service. 43 How Clouds Are Formed and Key Examples. 44 Using Virtualization to Form Clouds. 45 Using Applications or Services to Form Clouds..........48 Real-world Cloud Usage Scenarios. 49 Virtualization Formed Clouds. ........................49 Application/Service Formed Clouds. 51 Hybrid Cloud Models...................................52 Summary. ..................................................52 Endnotes. ...................................................52 CHAPTER 3 Security Concerns, Risk Issues, and Legal Aspects...........55 Cloud Computing: Security Concerns. ......................56 A Closer Examination: Virtualization. 57 A Closer Examination: Provisioning. 62 A Closer Examination: Cloud Storage. .....64 A Closer Examination: Cloud Operation, Security, and Networking. ......................................66 Assessing Your Risk Tolerance in Cloud Computing..........67 Assessing the Risk. .................................68 Information Assets and Risk. 69 Privacy and Confidentiality Concerns. ...................70 Data Ownership and Locale Concerns. .....71 Auditing and Forensics. 72 Emerging Threats.......................................73 So, Is It Safe?. 73 Legal and Regulatory Issues. ...............................74 Third Parties. 75 Data Privacy. 79 Litigation. ............................................84 Summary. ..................................................85 Endnotes. ...................................................87 Contents ix CHAPTER 4 Securing the Cloud: Architecture.............................89 Security Requirements for the Architecture. ...................91 Physical Security.......................................91 Cloud Security Standards and Policies. 93 Cloud Security Requirements. 94 Security Patterns and Architectural Elements. ................102 Defense In-depth. ....................................102 Honeypots. 104 Sandboxes. 104 Network Patterns. 104 The Importance of a CMDB. .........................107 Cabling Patterns.......................................109 Resilience and Grace. .................................110 Planning for Change...................................111 Cloud Security Architecture. 111 Cloud Maturity and How It Relates to Security.........112 Jericho Forum.........................................113 Representative Commercial Cloud Architectures. 114 Representative Cloud Security Architectures............115 Planning Key Strategies for Secure Operation. .............121 Classifying Data and Systems. ....................121 Define Valid Roles for Cloud Personnel and Customers. ......................................122 Summary...................................................123 Endnotes. 123 CHAPTER 5 Securing the Cloud: Data Security..........................125 Overview of Data Security in Cloud Computing. 125 Control over Data and Public Cloud Economics. 126 Organizational Responsibility: Ownership and Custodianship. 127 Data at Rest...........................................128 Data in Motion........................................130 Common Risks with Cloud Data Security. 130 Data Encryption: Applications and Limits. 132 Overview of Cryptographic Techniques................133 Common Mistakes or Errors with Data Encryption. ....135 Cloud Data Security: Sensitive Data Categorization. 137 Authentication and Identity. 137 Access Control Techniques. 138 Data Categorization and the Use of Data Labels........140 Application of Encryption for Data at Rest. 141 x Contents Application of Encryption for Data in Motion. .......142 Impediments to Encryption in the Cloud. 143 Deletion of Data. ..................143 Data Masking. ........................................144 Cloud Data Storage. .......................................145 Cloud Lock-in (the Roach Motel Syndrome). 146 Metadata..............................................148 AvoidingCloudLock-in(theRoachMotelSyndrome)....149 Summary...................................................150

Load more