Security in Cloud Computing A Security Assessment of Cloud Computing Providers for an Online Receipt Storage Mats Andreassen Kåre Marius Blakstad Master of Science in Computer Science Submission date: June 2010 Supervisor: Lillian Røstad, IDI Norwegian University of Science and Technology Department of Computer and Information Science Problem Description We will survey some current cloud computing vendors and compare them to find patterns in how their feature sets are evolving. The start-up firm dSafe intends to exploit the promises of cloud computing in order to launch their business idea with only marginal hardware and licensing costs. We must define the criteria for how dSafe's application can be sufficiently secure in the cloud as well as how dSafe can get there. Assignment given: 14. January 2010 Supervisor: Lillian Røstad, IDI Abstract Considerations with regards to security issues and demands must be addressed before migrating an application into a cloud computing environment. Different vendors, Microsoft Azure, Amazon Web Services and Google AppEngine, provide different capabilities and solutions to the individual areas of concern presented by each application. Through a case study of an online receipt storage application from the company dSafe, a basis is formed for the evaluation. The three cloud computing vendors are assessed with regards to a security assessment framework provided by the Cloud Security Alliance and the application of this on the case study. Finally, the study is concluded with a set of general recommendations and the recommendation of a cloud vendor. This is based on a number of security as- pects related to the case study’s existence in the cloud. With dSafe’s high demands of data locality, integrity and security, Google AppEngine is discarded as an option due to the lack of focus on business related applications, whilst Microsoft Azure is the recommended cloud vendor – closely followed by Amazon Web Services – due to its suitable technical solutions with regards to existing implementation, risk mitigation capabilities and audit results. Preface This report is the result of our Master Thesis work during the spring of 2010. Throughout the work we have gained much insight into both the positive and negative aspects of cloud computing as well as knowledge of the capabilities of three of the major cloud computing vendors. We foresee that we will benefit greatly from this experience during the course of our careers. We would like to thank our supervisor, Lillian Røstad, for her guidance and Daro Navaratnam, as well as his team, for allowing us to use dSafe in our case study and their assistance during said study. K˚areBlakstad and Mats Andreassen Trondheim, June 2010. ii Contents Abstracti Preface ii Contents iii List of Figuresv List of Tables vii 1 Introduction1 1.1 Research Questions............................2 1.2 Approach.................................2 1.2.1 Comparative Study........................3 1.2.2 Understanding The Case.....................3 1.2.3 Case Study............................3 1.3 Report Outline..............................5 2 Cloud Computing7 2.1 Service Models..............................9 2.1.1 Software-as-a-Service....................... 10 2.1.2 Platform-as-a-Service...................... 11 2.1.3 Infrastructure-as-a-Service.................... 11 2.2 Deployment Models........................... 11 2.2.1 Public cloud........................... 11 2.2.2 Private cloud........................... 12 2.2.3 Community cloud........................ 12 2.2.4 Hybrid cloud........................... 12 2.3 The Cloud Vendors............................ 13 2.3.1 Windows Azure.......................... 13 2.3.2 Amazon Web Services...................... 14 2.3.3 Google AppEngine........................ 14 2.4 Cloud Security Aspects......................... 15 2.4.1 Service Level Agreements and Compliance Features..... 17 iii CONTENTS CONTENTS 2.4.2 Authentication Services..................... 20 2.4.3 Audit and Certifications..................... 21 2.4.4 Cloud Tech Support....................... 24 2.4.5 Incident Response and Logging................. 25 2.4.6 On-demand Self-service..................... 26 2.4.7 Broad Network Access...................... 27 2.4.8 Resource Pooling......................... 28 2.4.9 Internal Access Control..................... 30 2.4.10 Virtualisation........................... 32 2.5 Summary................................. 37 3 Case Overview 39 3.1 The Company............................... 39 3.1.1 Business Plan........................... 40 3.1.2 Market.............................. 41 3.1.3 Business Model.......................... 41 3.2 Information Flow and Storage...................... 41 3.2.1 The data flow........................... 41 3.2.2 Persisted storage......................... 43 3.3 Technical Challenges........................... 45 3.3.1 Confidentiality.......................... 45 3.3.2 Identification and Authentication................ 45 3.3.3 Non-repudiation......................... 46 4 Case Study 47 4.1 Analysing the Risk............................ 47 4.1.1 Identifying the Asset for Cloud Deployment.......... 48 4.1.2 Evaluating the Asset....................... 51 4.2 Deployment Model Acceptance..................... 63 4.3 The Twelve Domains of Critical Focus................. 64 4.3.1 Governance domains....................... 65 4.3.2 Operational Domain....................... 72 4.4 Risk Mitigation.............................. 83 5 Conclusions 89 5.1 Final Recommendations......................... 89 5.2 Conclusions................................ 90 5.3 Further Work............................... 91 5.3.1 Comprehensible Risk Analysis................. 91 5.3.2 Federated Identity........................ 92 5.3.3 Maturity of Cloud Technology................. 92 References 93 A Feedback from The Data Inspectorate (Norwegian) 99 iv CONTENTS CONTENTS B Email Correspondence with the Data Inspectorate (Norwegian) 103 v CONTENTS CONTENTS vi List of Figures 1.1 Study approach overview........................4 2.1 Overview of the cloud computing layers................9 2.2 Cloud service model categorisation................... 10 2.3 Overview of the cloud computing deployment models......... 12 2.4 Amazon’s Availability Zones....................... 29 2.5 The virtualisation security areas of focus................ 33 2.6 Azure and Web Services virtualisation approach............ 34 2.7 Amazon Web Services architecture with security measures...... 35 3.1 Gantt-diagram over dSafe activities................... 42 3.2 Top level Data Flow Diagram...................... 43 3.3 ER diagram of dSafe’s databases.................... 44 4.1 Risk multiplication matrix........................ 51 4.2 The twelve domains of critical focus.................. 64 4.3 An overview of the five governance domains............... 65 4.4 An overview of the seven operational domains............. 72 vii LIST OF FIGURES LIST OF FIGURES viii List of Tables 4.1 Data assets overview........................... 49 4.2 Process assets overview......................... 50 4.3 Data asset risk assessment summary.................. 59 4.3 Data asset risk assessment summary.................. 60 4.4 Process asset risk assessment summary................. 61 4.4 Process asset risk assessment summary................. 62 4.5 Summary of acceptable deployment models.............. 63 4.6 Microsoft Azure mitigations within the critical domains....... 85 4.7 Amazon Web Services mitigations within the critical domains.... 86 4.8 Google AppEngine mitigations within the critical domains...... 87 ix LIST OF TABLES LIST OF TABLES x Chapter 1 Introduction Cloud Computing has long been a buzzword within the field of computer science. As with most buzzwords there are numerous definitions, but most agree that Cloud Computing entails putting applications and data in the hands of others. Unless you run your applications and keep your data on your own hardware on-premises, you leave the security of said assets in the hands of others. In a world where applications are riddled with weaknesses and vulnerabilities, can you really trust another company to keep your assets? When a computer is within your network, you can protect it with other security systems such as firewalls and IDSs. You can build a resilient system that works even if those vendors you have to trust may not be as trustworthy as you like. With any outsourcing model, whether it be cloud computing or something else, you can’t. You have to trust your outsourcer completely. You not only have to trust the outsourcer’s security, but its reliability, its availability, and its business continuity. – Bruce Schneier[1] There are several providers1 available and their platforms differ substantially in their flexibility. How much of the infrastructure the customer is able to access can directly affect the security of their own services as well as that of others. This difference can have critical consequences: Research has been described in which meticulous analysis of a cloud’s hardware in idealised circumstances allow attackers to log the keystrokes of users on separate virtual machines [2]. Some of the cloud platforms are therefore polished surfaces with little access to the underlying infrastructure and others allow customers to delve deeper. This report will detail these differences and their consequences for security. By comparing the platforms we intend to, from a security standpoint, comment on the maturity of a selected set of current cloud computing vendors.