Abstract:
The purpose of this paper is to illustrate the infrastructure security of the network level of the cloud. The paper covers rudimentary network architecture and design. The paper will also address some known threats and vulnerabilities along with possible remediation efforts for risk reduction. The paper will focus on the use of 3rd party datacenters and network security between that and the customer systems
Introduction
To start out, the good news is that the data involved in cloud computing is only vulnerable in three places. The bad news is that those places are at the source, the destination and the network that connects the two. Cloud computing or Software as a Service (SaaS) is becoming the latest buzz word in corporations and small business alike in today’s economy. In an effort to reduce the total cost of ownership of information technology as a whole, business is moving away from purchasing and maintaining their own internal infrastructure of servers and system administrators. Instead, many businesses are maneuvering to reduce the expense of maintaining multiple systems by either creating an internal cloud using virtualization technology or by utilizing third party datacenters specializing in hosting customers’ systems in shared spaces. “Many companies are creating cloud services as a “pay as you go” scenario. These include sharing networks, computers, storage and even software applications.” (Szczygiel, 2010, March) The third party solution provider of the data center can offer many economic advantages for the corporate consumer such as data assurance, redundant systems, and hot/hot disaster recovery sites distributed around the globe. Internet technology has evolved enough to where the information can be accessed from anywhere in the world from a multitude of devices formatted in an assortment of methods.
When adopting a network security strategy for your cloud computing plan, there are several items that must be considered and discussed with the third party service provider. The areas that must be are confidentiality and integrity of information to and from the systems at the business to the datacenter, access control, availability and redefining the network to accommodate the cloud. These need to be defined explicitly before any implementation is to take place.
Network Confidentiality and Integrity
When network confidentiality and integrity is mentioned for cloud security, PKI is uttered and the matter is then left to the implementation team to roll out a certificate based solution. Unfortunately, this is not the only aspect of network confidentiality and integrity that needs addressing. Data sources are being exposed via the Internet in the cloud solution. “Confidentiality issues center on where the data is being stored, how and to where it's moved, and where it might be moving in the future, says Roland Trope, a partner at Trope and Schramm in New York City who is writing a book on cloud computing.” (Acello, 2010)
With the advent of Web 2.0 technologies such as XML, SOAP, AJAX and the multitude of cloud application platforms from a multitude of vendors, vulnerabilities are often exposed even when the traffic is sent over a network connection. In order to mitigate these risks, a Transport Layer Session (TLS) connection should be used using the SSL protocol for web browsers. Internet Protocol Security (IPSec) should be used for communication within the systems containing applications and data used by the corporate consumer. IPSec should be utilized for in situations where information is transferred across any network between data centers, to/from the customer and even within the data center. Keep in mind that the data center is using a shared network and the corporate consumer has little control over applications run on other systems not controlled by it. If another system within the data center is compromised by a different and less security conscious corporate consumer, then network integrity could be compromised. IPSec configured with policies to accept traffic based on source and destination address or networks will help mitigate the risk of a compromised system from sniffing the network for traffic.
Host based firewalls also will mitigate the risk of attack by reducing the surface exposure reducing the amount of ports open. Use of a SSL VPN portal will also increase security since it can offer ability to tunnel all web based and application traffic through the tunnel.
Access Control
Restricting access to the required users from the requisite systems should be adhered to conform to security policy requirements. Access control is extremely important when using third party datacenters because of the inability to audit the network traffic. Monitoring is often limited and delegated to the cloud hosting service.
Adoption of an identity and access management (IAM) solution should be integrated in the early stages of cloud migration planning to coordinate the control of passwords and rights for local systems and the cloud infrastructure. “Organizations also are turning to IAM to meet compliance and regulatory requirements that are putting a greater burden on the security administration function in the form of additional reports, better records of workflow and change requests, and periodic self-assessments.” (Rai & Chukwuma, 2009)
Continuing on with the advantages of a SSL VPN portal solution, the use of a system to control access based on identity and credentials is necessary to be compliant with several legal mandates. VPN portals can also provide auditing based on several points of data including but not limited to time, date, user identity, source IP, data or application accessed. Some VPN portal solutions even offer endpoint detection that will determine if the system accessing the information has required security software updates and anti-virus installed and can limit access until the connection requirements have been remediated.
Another concern is who will really have access to the data. There must be a high level of trust to the cloud service provider and their employees. Another concern is where the data is stored in regards to the physical location of the servers and the replication servers. What are the legal restrictions in possibly storing the information in a jurisdiction other than the one where the business consumer is located? Consider that the company has a government contract that deals with sensitive information. If the data is stored in a foreign data center, it is possible that the data could be copied under laws of that government and used for espionage purposes, be it national, industrial or corporate spying. Also, if the data is kept domestic but stored in another jurisdiction, there could be legal implications in the event of a subpoena or lawsuit to access that information.
Availability
If you don’t have the information available to you when you need it, then it is useless. Most cloud service providers have distributed datacenters that are considered hot sites for disaster recovery. The most vulnerable link in the chain is the business consumer’s access to the Internet. Even though the data and servers have moved to the cloud, the company is still responsible form maintenance of its local resources such as workstations, mobile communication devices and the local network. Since the business will rely on the Internet connection for access to the information, redundant gateways must be instituted in the network design.
Business continuity planning must be incorporated into the security plan at this time. Although the prospects are remote, what are the plans to retrieve data if there the cloud service provider goes out of business or if a dispute occurs between the business consumer and the company? Are there plans if the cloud provider is compromised by an attack? If the data systems goes down, how long would it take to restore it? These are just some of the questions that must be addressed in the plan.
Redundant data centers, multiple portals and hot sites should be required on any contract with an cloud service provider. Service level agreements must be negotiated that will guarantee uptime and determine the repercussions if those have not been met. “Users of individual SaaS products have generally become confident that their vendor is proficient in maintaining security, ensuring that data is backed up and carrying out other support tasks. However, venturing more broadly into “the cloud,” where many applications may be used as services, is a different matter; establishing trust with numerous third-party suppliers is a complex process.” (Lamont, 2010)
“Fortunately, the SaaS model provides numerous answers for these types of challenges. Multi-tenant SaaS services are normally hosted in highly reliable data centers with built-in redundancy.
The best providers also employ separate disaster recovery centers to restore full operations if the primary center is disabled. Redundancy in the communication path is built into this model due to the Internet’s capability to send information via numerous routes.” (Szczygiel, 2010, March)
Network Architecture & Redesign
Collaboration must be done with the cloud service provider in relation to the architecture of the cloud for the business consumer. Virtual and physical firewalls, portals and proxies must be put in place that meets compliance and redundancy requirements. Domain Name System (DNS) management must be setup and established in a secure fashion.
Network zones and tiers are no longer necessary in the local environment anymore. Internal infrastructure is now minimal with possibly the use of a proxy servers, print servers and Internet routers. In the cloud, the segmentation is virtualized, done by security groups, security domains and virtual data centers. In most instances, the systems are virtualized also. “Essentially, virtualization enables one to encapsulate the processing capabilities of a computing resource into a virtual machine and execute the virtual machine in an isolated environment on a host computer. This enables one to run one or more virtual machines on the same host computer, run a virtual machine on a host computer with a different operating system, run a virtual machine in a “sandbox” where the virtual machine’s action cannot modify the host computer, to name just a few applications.” (Lunsford, 2009)
Administrative control is no longer done by the local system administrators. Although the business consumer will likely keep a few IT professionals employed, the reliance is now upon the administrators of the cloud service provider to perform maintenance. Local administrators will need to maintain the local workstations, network appliances and the remaining servers. These IT Staff members must coordinate with the cloud service provider’s administrative staff for maintenance of the virtual machines. Cloud service providers usually maintain the host systems where the virtual systems reside. It must be clear on who maintains security patches on those systems, manages DNS entries and maintains security access of those systems.
Conclusion
Cloud security has multiple environmental vulnerabilities such as insecure APIs in platforms, logical multi-tenancy where information from multiple business are co-mingled in a data center, data protection and leakage, lack of audit controls and denial of service along with other network threats. Securing the network against these threats is a way of mitigating some of the risks involved when trusting the data that is vital to the business to a third party. Just as one would pick up a phone, turn on a radio or television, connecting to the data would be expected and as seamless as possible to those authorized to access it through the device of their choice. The nebulous networked data centers distributed around the world are allowing multitudes of individuals and companies to collaborate on the immediate needs independent of where they are located, given that the user has access to the Internet. All is good…no reason to panic.
Works Cited
Acello, R. (2010, April). Get Your Head in the Cloud. ABA Journal, pp. 28-29.
Lamont, J. (2010, January). Building Trust in the Cloud. KM World, p. 13.
Lunsford, D. L. (2009). Virtualization Technologies in Information Systems Education. ournal of Information Systems Education, 339-348.
Rai, S., & Chukwuma, P. (2009, August). Security in a Cloud. Internal Auditor, pp. 21-23.
Szczygiel, J. (2010, March). The 5 C's of SaaS. Security Dealer & Integrator, 69-70.
No comments:
Post a Comment