Cloud Computing Security
Total Page:16
File Type:pdf, Size:1020Kb
http://www.anewmorning.com/2011/05/24/cloud-computing-comic/ Cloud Computing and its Security Issues Dr. Dan (Dong-Seong) Kim University of Canterbury, New Zealand [email protected] http://www.cosc.canterbury.ac.nz/dongseong.kim University of Canterbury (UC) . University of Canterbury (UC) • originated in 1873 in the centre of Christchurch as Canterbury College (currently UC) . Alumni of UC • Ernest Rutherford1: physicist – Nobel Prize in chem. • John Key–current Prime Minister of New Zealand • Computer Science and Software Engineering department at UC has been ranked in the top 101-150 Computer Science departments in the 2011 International QS World University Rankings. 1: http://www.nobelprize.org/nobel_prizes/chemistry/laureates/1908/rutherford-bio.html About myself . Lecturer (Assistant Professor in US) since Aug. 2011 • Full time/permanent • Computer science and software engineering Dept. • Research/teaching: Computer and Network Security . Postdoc at Duke U. from June 2008- July 2011 • (Kishor S. Trivedi group) . U of Maryland, USA in 2007 • Virgil D. Gligor group (former ACM SIGSAC chair) . Studied at KAU in Korea (BS, MS, PhD) • JongSou Park group (Penn. State PhD) Outline . Why cloud computing? . What is cloud computing? • NIST Definition • Essential characteristics • Service delivery models • Deployment models . A Case Study . Why not using Cloud? . Taxonomy of Fear • CIA or FBI? . Security and Privacy Issues Why cloud computing? Locally hosted Email vs. Cloud based. Server utilization How ?? Virtualization + automation = cloud Migration to cloud computing Case Study of a Cloud Deployment New 100% Development Liberated funding for new Software Strategic Costs development, transformation Change investment or Capacity Power direct saving Costs Case Study Results Current Annual savings: $3.3M IT Deployment (1-time) Labor Costs (84%) Spend (Operations and Software $3.9M to $0.6M Maintenance) Costs Power Costs (88.8%) Hardware, labor & power savings Hardware Labor Costs reduced annual cost Costs ( - 80.7%) of operation by annualized ( ) Hardware Costs 83.8% ( - 88.7%) Note: 3-Year Depreciation Period with 10% Discount Rate What is Cloud Computing? Definition of Cloud Computing . NIST (National Institute of Standards and Technology) definition • a model for enabling ubiquitous, convenient, on- demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction Source: NIST Essential characteristics of cloud computing . On-demand self service . Broadband network access . Resource pooling . Rapid elasticity . Measured service http://www.eucalyptus.com/resources/cloud-overview/what-is-cloud-computing Cloud Service Delivery Models http://blog.appcore.com/blog/bid/168247/3-Types-of-Cloud-Service-Models http://it20.info/2010/11/random-thoughts-and-blasphemies-around-iaas-paas-saas-and-the- cloud-contract/ Cloud Service Delivery Models (cont.) . SaaS (Software as a Service) • The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. PaaS (Platform as a Service) • To deploy onto the cloud infrastructure consumer-created or acquired applications created using program languages and tools supported by the provider . IaaS (Infrastructure as a Service) • To provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software which can include operation systems and applications. XaaS • Data, Search, Security, Hacking, … From [1] NIST Cloud Deployment models Cloud Deployment models (cont.) . Private cloud • Is operated solely for an organization. Public cloud • Is made available to the general public or a large industry group • Is owned by an organization (e.g., MS, Amazon) selling cloud services. Community cloud • Is shared by several organizations and supports a specific community that has shard concerns (e.g., mission, policy, and compliance considerations) . Hybrid cloud • Is a composition of two or more clouds (private, community, or public) that remain unique entities but are bounded together by standardized (e.g., cloud bursting for load balancing between clouds) A Case Study Case Study: Amazon Cloud Infrastructure . The first & Best Cloud computing S3 EC2 19 Amazon Cloud Infrastructure 20 Amazon Cloud Infrastructure . Powerful New IT Consumption Models . New York Times used • S3/EC2 to process • 4TB of TIFFs • Into 1.5TB of PDFs • Using 100 EC2 Xen VMs • And HDFS (Hadoop) . In 24 hours . For USD 240! http://cloudcomputersupes.wordpress.com/category/cloud-funny-messages/ Hesitate to use cloud computing? If cloud computing is so great, why isn’t everyone doing it? . The cloud acts as a big black box, nothing inside the cloud is visible to the clients . Clients have no idea or control over what happens inside a cloud Cloud If cloud computing is so great, why isn’t everyone doing it? (cont.) . Even if the cloud provider is honest, it can have malicious system admins who can tamper with the VMs (Virtual Machines) and violate confidentiality and integrity . Clouds are still subject to traditional data confidentiality, integrity, availability, and privacy issues, plus some additional attacks What is Confidentiality, Integrity, Availability? Morocco and New Zealand Bob in North island Alice in South Island Security objectives: Confidentiality An example Internet Alice in UGETGVSecret? Bob in North by DES, 3DES, AES, South Island island etc by Caesar with k=2 E rd The data has not been viewed by a 3 Confidentiality Encryption party Confidentiality: the protection of transmitted data from passive attacks (release of message contents and traffic analysis) How? ?? secret UGETGV Shift by 1 ? TFDSFU Substitution by 2 ? (Transposition) UGETGV Caesar cipher key = 2 Q: What’s this? All blacks (AB)? New Zealand National rugby team’s name How does AB relate to principle of ciphers? All blacks? . Substitution ? Richie McCaw Andrew Hore Adam Thomson Cory Jane AndrewDan Carter Ellis All blacks? . Transposition (permutation) ? Richie McCaw Adam Thomson Cory Jane Dan Carter Use both Substitution and transposition to win the championship Security objectives (cont.): Integrity How ? Use HMAC(Hashed message authentication code) New Zealand sport? New Zealand fruit? Internet One Alice in South way function Bob in North Island island hash II hatelove you All blacks Kiwi E The data has not been modified in Integrity Crytographic transit Hash func. Integrity: the assurance that data received are exactly as sent by an authorized entity (i.e., contain no modification, insertion, deletion, or replay) An illustrative example Input I love you I hate Message 345689 you (pre-image) A hash Divided by 23 A hash function and take function some values. Hash value (message digest, fingerprint) 15029.95652173913043… Integrity can be checked Security objectives (cont.) : Availability Internet Distributed Denial of Alice in Bob in North Service (DDoS) attacks South Island island … E For any information system to serve its purpose, the information must Availability be available when it is needed Source: http://memeburn.com Security objectives : summary Internet Alice in Bob in North South Island island The data has not been viewed by a 3rd Confidentiality Encryption party The data has not been modified in Integrity Hash func. transit The data must be available when it is Availability Fault/intrusi needed on tolerance Companies are still afraid to use clouds [Chow09ccsw] Causes of Problems Associated with Cloud Computing . Most security problems stem from: 1. Loss of control 2. Lack of trust (mechanisms) 3. Multi-tenancy 1. Loss of Control in the Cloud . Consumer’s loss of control • Data, applications, resources are located with provider Cloud Provider Premises Customer Data Customer Customer Code • User identity management is handled by the cloud 1. Loss of Control in the Cloud (cont.) . User access control rules, security policies and enforcement are managed by the cloud provider . Consumer relies on provider to ensure • Data security and privacy • Resource availability • Monitoring and repairing of services/resources 2. Lack of Trust in the Cloud . Trust in the cloud? • the customers’ level of confidence in using the cloud . Main components of Trust in Cloud Computing • Security – CIA + other. • Privacy - Protection against the exposure or leakage of personal or confidential data (e.g. personally identifiable information). • Accountability - complying with measures that give effect to practices articulated in given guidelines o Preventive control (e.g., risk analysis)/detective control (e.g., Intrusion detection system) • Auditability t- o ensure operational integrity and customer data protection 3. Multi-tenancy Issues in the Cloud Who are my neighbors? What is their objective? They present another facet of risk and trust requirements . Cloud Computing brings new threats • Multiple independent users share the same physical infrastructure • Thus an attacker can legitimately be in the same physical machine as the target . How to provide separation between tenants? Taxonomy of Fear Cloud Computing Security . Information Security Principles Unchanged Taxonomy of Fear: Confidentiality . Fear of loss of control over data • Will the sensitive data stored on a cloud remain confidential? • Will cloud compromises leak confidential client data . Will the cloud