17.1.1  What Is Security?

Before we can discuss how to secure the cloud, we must first define what is meant by “security.” What does it mean to have a “secure” cloud? What aspects must be addressed by any cloud security solution?

For the purposes of this chapter, we state that a “secure” cloud is one that addresses the following information security principles: confidentiality, integrity, availability, identity, authentication, authorization, and auditing. Representative questions from potential cloud adopters include:

•Confidentiality: Can anyone else see my data when it is in the cloud?

•Integrity: Can anyone else modify my data when it is in the cloud?

•Availability: Will my data/applications always be up and running? What if the cloud provider goes out of business?

•Authentication: When people access my data and applications, how does the cloud ensure that they are who they claim to be?

•Authorization: How does the cloud ensure that people can only access the data and applications that they are allowed to access?

•Auditing: How can I verify that all of these items are consistently addressed?

Now that we have sufficiently scoped our definition of security, we examine the existing security controls to identify gaps in coverage associated with cloud computing.

17.2  ISO 27002 Gap Analyses

ISO 27002 (formerly ISO 17799) “establishes guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization” [7]. Although the standard offers a high-level description for providing information security, it does not include detailed information on how the security controls should be implemented.

By comparing the ISO 27002 security controls against the technologies and use cases of cloud computing, a number of security gaps were identified and are discussed below. Because cloud computing extensively leverages virtualization technologies, much of the discussion is focused on virtualization gaps.

This information is intended to provide a high-level overview of some of the challenges associated with securing the cloud. There are additional gaps against the ISO standard that are not discussed and many other issues to consider. The interested reader is referred to [6] for more details.

Because ISO 27002 is organized around “families” of related controls, our discussion follows this organization. In this section, we address the following ISO 27002 families:

•Asset Management

•Communications and Operations Management

•Information Systems Acquisition, Development, and Maintenance

•Information Security Incident Management

•Compliance

17.2.1  Asset Management

The goal of Asset Management controls is to protect organizational assets. Within this family, gaps were identified in the following: Asset Tracking.

Traditionally, physical access is required to insert new servers into the network. In a cloud data center, virtual environments can be provisioned without the need for physical access to the network. Thus, it may be possible to have rogue virtual servers on the network. Controls must be introduced to track these new virtual assets across the network to make sure appropriate security measures are in place.

Also, it is important to develop a consistent naming scheme for servers on the network in order to maintain accurate logs and to track events. Naming schemes for data center hosts are typically locationand application-centric. However, these schemes are not always applicable to virtual servers, which migrate from server to server and even across physical sites. Similarly, servers may be shared by multiple applications, making application-based naming ineffective.

Finally, in a virtualized data center, there will be virtual devices that may come and go as instances are modified. Instances are simply cloud resources, and could represent virtual machines, software-as-a-service modules, storage units, etc. Examples of virtual devices include network interfaces, consoles, serial ports, USB ports, floppy, CD ROMs, and storage systems. These virtual devices could be used to gain unauthorized access to the system or to copy data on/off the instances.

17.2.2  Communications and Operations Management

The goal of Communications and Operations Management controls is to maintain the availability and integrity of information and equipment. Within this family, gaps were identified in the following controls: Change Management, Capacity Management, System UtilityAccess Control, Patch Management, SystemAudits, Media Destruction and System Reuse, Data Encryption, Logging and Monitoring, and Backups.

Change Management: Existing data center change control processes are simplified by the fact that many times individual hosts are assigned exclusively to an application. In a cloud environment, one physical server typically runs many virtual machines and is responsible for a number of business tasks. Thus, a change to a single host may impact multiple applications within the data center.

Capacity Management: There are three primary issues associated with capacity management in the cloud. First, the cloud environment must be effectively sized. One of the benefits of using a cloud environment is the ability to rapidly provision new instances. As such, there must be mechanisms in place to determine the number

of instances the existing infrastructure can handle without impacting business tasks.

Second, all applications running within the same physical segment of the cloud are, in effect, competing with each other for the same CPU, memory, storage, and networking resources. Because of this, it may be possible for a single application to cause a denial-of-service attack within the cloud by demanding a large amount of resources (thereby negatively impacting other applications).

Finally, an application ‘X’ running in a cloud may be able to gather information about the state of other applications due to the number of resources available to application ‘X’. For example, if application ‘X’ notices that available CPU, disk, or network resources have been reduced, it may be able to deduce that the other applications on the cloud are running at a higher level than normal. This information might be useful to a malicious individual trying to gather information about the state of the cloud.

System Utility Access Control: Cloud computing will result in new utilities and management consoles that must be used in a secure manner. These are unlike traditional system administration tools, since they effectively provide administrator capabilities (e.g., create, destroy, and move) to “standard” users. These tools must support controls to prevent misuse.

Patch Management: There are two primary concerns associated with applying patches in a cloud environment: patching the underlying “cloud” infrastructure and patching individual instances. New controls will need to be put into place to patch the underlying host operating system (hypervisor) without impacting the virtualized servers running on that host. Instances may need to be migrated to an alternative host, especially if rebooting is required. Also, individual instances may be offline when patches are applied and thus will need to be patched immediately when brought online. Instances will need to be scanned when brought online to make sure they are not missing any patches.

System Audits: Traditionally, physical systems are audited when first built and put into production. In a cloud environment, virtual instances of operating systems may be built and put into production with little or no oversight. Procedures will need to be modified to include audits at the creation of the system and every time a virtual system comes back online after having been modified.

Media Destruction and System Reuse: New controls will be needed to guarantee that, upon destruction, the instance is indeed removed completely from the cloud environment. This includes all of the file systems, memory paging files, and metadata. For the most critical data, such as classified government information, the persistent storage may need to be physically removed and destroyed.

Data Encryption: A malicious user copying off a dormant image of an instance can view not only the file system associated with the image but also the volatile memory image that is stored to disk. Passwords and other confidential data, normally encrypted on disk but not in memory, may end up stored on disk in an unencrypted format. New controls are required to encrypt an instance while it is stored on disk and as it is being migrated between servers.

Logging and Monitoring: With the introduction of the cloud, a new operating system, the hypervisor, must be monitored. Additionally, individual logs from physical servers and virtualized instances will need to be gathered, processed, and aggregated into a centralized location. The distributed nature of the data processing across the cloud will require sophisticated log processing to correlate information across multiple logs from many sources in different log formats.

Backups: The backup of a single physical resource may contain information from a number of instances. Policies and procedures must ensure that no data leaks can occur between instances.

17.2.3  Information Systems Acquisition, Development,

and Maintenance

The goal of Systems Acquisition, Development, and Maintenance controls is to prevent information loss and errors, as well as unauthorized modification or access. Within this family, gaps were identified in the following controls: Message Integrity and Technical Standards.

Message Integrity: The introduction of new tools, user interfaces, and APIs to support and interact with the cloud will introduce new control messages across the network. Such messages will be used to create, launch, and deprovision cloud resources, as well as to implement and verify various security controls. As such, these messages are obvious targets for attack and must be protected to ensure that they cannot be altered, duplicated, or deleted.

Technical Standards: Cloud computing is beginning to leverage new technologies that require changes in how software is developed, tested, deployed, and managed. Existing controls, policies, and procedures will need to be modified to handle these new types of software to prevent poorly written and untested software from being introduced into production. Additionally, new standards are required for hypervisor operating systems.

17.2.4  Information Security Incident Management

The goal of Information Security Incident Management controls is to ensure that, when security incidents occur, a consistent process is followed to remedy the situation. Within this family, gaps were identified in the following controls: Reporting Security Events and Collection of Evidence.

Reporting Security Events: With the introduction of the hypervisor, there are new security events that must be logged, reported, and possibly investigated (such as moving an instance across physical resources). Existing procedures will need to be expanded to handle these new security events.