Download
1 / 89
890 likes | 994 Views
Feeling safe in the cloud. Pete Hickey Université d’Ottawa. Everybody talks about clouds. Not all are happy. History of confusion. 1967 The Saskatoon Connection. Joni Mitchel, 1967. I’ve looked at clouds from both sides now From up and down And still somehow
E N D
Feeling safe in the cloud Pete Hickey Universitéd’Ottawa
History of confusion • 1967 The Saskatoon Connection
Joni Mitchel, 1967 I’ve looked at clouds from both sides now From up and down And still somehow It’s cloud illusions I recall I really don’t know clouds at all
Clouds • Some people think the moving student e-mail to Google/Microsoft is moving to the cloud. • Much more than that.
Jean-Philippe’s mountain cloud • Not everyone has the same idea • Can’t see what is there.
What goes around comes around • Early days, mainframes. • Move to PCs and distributed processing • At one time we had 37 Novell servers on campus • Move to centralize • Economics : economy of scale • Manageability • Move to the cloud is the same thing on a larger scale.
It will come • Just because something is not a good fit does not stop us. • Look at the Internet • Not designed for how we use it • We change in spite of the issues.
Clouds are attractive! • Somebody Else’s Problem(SEP) is a condition where individuals/populations of individuals choose to decentralize themselves from an issue that may be in critical need of recognition • Everyone offering cloud services • Whatever you want, you can get it. • You can even get things you don’t want.
Clouds are attractive! • Can provide something you don’t have the resources for • Broad network access • Available from anywhere • Accessible from any platform • Can be provided FAST! • Rapid elasticity.
Clouds are attractive! • Reduce or eliminate need for YOUR tech support. Get rid of your skilled geeks • Trust the company to provide the service.
New skillsets required! • Contract negotiation more important! • You must have a thorough understanding of your process/system • You must have a thorough understanding of their system • You must ensure everything is clear in the contract.
Planning is essential • When providing something in-house, you can react to changes, unrealized needs. • In theory, an project is well planned in advance. • In reality, not always true. “Let’s get it going, then fix it after.”
The UnknownAs we know, There are known knowns. There are things we know we know. We also know There are known unknowns. That is to say We know there are some things We do not know. But there are also unknown unknowns, The ones we don't know We don't know. —Feb. 12, 2002, US Department of Defense news briefing
Trust the company • Everyone is getting into the cloud. • Do you have confidence in the company’s ability to deliver the product? • Or are they just getting the product out the door
Areas of trust to consider • The ability of the company to provide what you want • The integrity of the employees of that company.
Trust People • In general, people are trustworthy. • Trust should make you think of this:
Trust • Statistics tell us that, the larger the population, the greater the number at the end of the bell curve. • As we increase the size of the population we trust, the probability of an untrustworthy individual increases.
Trust • Dataloss.org states that data loss is from • 22% inside accidental • 10% inside malicious. • Malicious insider is HIGH RISK • Due to their access to sensitive data. • You have more insiders
Trust • In the past, we would trust our staff because we knew them. • The cloud brings a new style of trust.
Trust • You can’t trust a population you don’t know. • Get it in the contract! • Job for the future “Cloud Contracting Engineer.”
Kinds of clouds • IAAS Infrastructure as a Service. EG Amazon’s E2C • Hardware provided for you • Quick to create new machines • Attractive for seasonal growth and un-growth. • Attractive if space is expensive • OS and hardware maintained for you.
Kinds of clouds • PAAS Platform as a service. • The OS and middleware there for you • Develop custom applications without worrying about the rest.
Kinds of clouds • SAAS Software as a service EG GoogleDocs, email • Very rapid deployment. • No maintenance/upgrades/patching. • Just about everything imaginable is out there
Kinds of clouds • SAAS • PAAS • IAAS • The lower Security responsibility : you • The higher Security responsibility : them.
Things to think about • Your neighbors • Breaches • Your data/processes • Authentication • Authorisation • Monitoring • Auditing • E-discovery
Things to think about • image • Physical Security • DNS issues • Laws regulations • Risk evaluation • Business continuity
Your Neighbors • In house, would you run your business systems on the same VMWare cluster which has open student shell access? • Why? why not? • Defense in depth?
Your Neighbors • Do you know your neighbors • Do you care? • Do you know how you are kept separate from them? • First recognizable group to use IAAS were the spammers. • Your neighbors may not be your friends
Breaches and attacks • All the OWASP things still hold • Other concerns as well
Breaches and attacks • What if your neighbor is breached? • Will you be notified? • What if the cloud infrastructure is breached? • Will you be notified. • What about an attack from a neighbor? • What does a vulnerability in VMWare mean?
Know your data? • Understand what it is, and any regulations/laws • Know how it may change • Relatively easy with a database • More difficult with something like GoogleDocs. • Similar for processes • People have a way of using things in a way which was never intended.
New exposure risks • To the world • Cloud employees • Other cloud customers. • Data or process changed • Lack of access for a period of time
