1 / 25

ENISA

ENISA – Cloud Computing Security Strategy Dr Steve Purser Head of Technical Department European Network and Information Security Agency (ENISA) OGF28 2010 Munich March, 2010. ENISA. Created in 2004 Centre of Expertise Supports EU institutions

ryo
Download Presentation

ENISA

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. ENISA – Cloud Computing Security StrategyDr Steve PurserHead of Technical DepartmentEuropean Network and Information Security Agency (ENISA)OGF282010MunichMarch, 2010

  2. ENISA • Created in 2004 • Centre of Expertise • Supports EU institutions • Facilitator of information exchange between EU institutions, public sector & private sector. • Advising and assisting • Collecting and analysing • Promoting methods • Raising awareness

  3. ENISA’s Understanding ofCloud Computing • Cloud computing is a new business model that allows: • Highly abstracted HW and SW resources • Rapidscalability and flexibility • Near instantaneous provisioning • Shared resources (hardware, database, memory, etc...) • ‘Service On demand’, usually with a ‘pay as you go’ billing system • Programmatic management (e.g. through Web Services API)

  4. ENISA Cloud Computing Objectives • Help governments and businesses to leverage the cost benefits of cloud computing taking due consideration of security requirements. • Improve transparency on security practices to allow informed decisions • Creating trustand trustworthiness by promoting best practice and assurance standards

  5. Reaching the objectives ENISA Deliverables and Ongoing Activities: • Cloud Computing: Benefits, Risks and Recommendations for Information security 2009 • Assurance framework 2009 • Research Recommendations 2009 • Gov-Cloud security and resilience analysis (2010) • Cloud Assurance Framework (CAM) consortium 2010 • 2011 (proposed) procurement and monitoring guidance for government cloud contracts.

  6. Cloud Computing: Benefits, Risks and Recommendations for Information security

  7. Security Benefits

  8. Economies of scale • The same amount of investment in security may result inbetter protection • Manysecurity measures are cheaper when implemented on a larger scale. • (e.g. filtering, patch management, hardening of virtual machine instances and hypervisors, etc)

  9. The Risks

  10. Very high value assets • More Data in transit (Without encryption?) • Management interfaces are interesting targets for attackers. • Trustworthiness of insiders. • Hypervisors- hypervisor layer attacks on virtual machines are very attractive

  11. Loss of Governance • The client cedes control to the Provider on a number of issues effecting security: • External penetration testing may not be permitted. • Very limited logs available. • Usually no forensics service offered • No information on location/jurisdiction of data. • Outsource or sub-contract services to third-parties (fourth parties?) • SLAs may not offer a commitment to provide the above services, thus leaving a gap in security defences.

  12. Compliance Challenges • Cloud Provider may not be able toprovide evidence of their own compliance to the relevant requirements. • Cloud Provider maynot permit audit by the Cloud Customer. • In certain cases, using a cloud implies certain kind of compliance cannot be achieved

  13. Legal and contractual risks • Data may be stored in multiple jurisdictions, some of which may be risky. • Lack of compliance with EU Data Protection Directive • Potentially difficult for the customer (data controller) to check the data handling practices of the provider • Multiple transfers of data exacerbated the problem • Subpoena and e-discovery • Confidentiality and Non-disclosure • Intellectual Property • Risk Allocation and limitation of liability

  14. Cryptographic Key Management • Key management is (currently) the responsibility of the cloud customer. • Distributed key management is difficult. • Therefore key provisioning and storage is usually out of band – i.e. off-cloud • Some models, e.g. one key per account, do notscale to multiple accounts/account holders • Hardware security modules are difficult to implement in the cloud.

  15. Vendor Lock in • Few tools, procedures or standard formats for data and service portability • Difficult to migrate from one provider to another, or to migrate data and services to or from an in-house IT environment • Potential dependency of service provision on a particular Cloud Provider.

  16. Resource Exhaustion • Overbooking • Underbooking • Caused by • Resource allocation algorithms • Unpredictable peaks in legitimate demand. • Denial of Service

  17. Cloud Computing Information Assurance Framework

  18. Cloud Information Assurance Framework • Aims at increasing transparency by defining a a minimum baseline for: • Comparing cloud offers • Assessing the risk to go Cloud • Reducing audit burden and security risks

  19. Cloud Information Assurance Framework An example • Network architecture controls • Well-defined controls are in place to mitigate DDoS (distributed denial–of-service) attacks e.g. • Defence in depth (traffic throttling, packet black-holing, etc..) • Defences are in place against ‘internal’ (originating from the cloud providers networks) attacks as well as external (originating from the Internet or customer networks) attacks. • Measures are specified to isolate resource usage between accounts for virtual machines, physical machines, network, storage (e.g., storage area networks), management networks and management support systems, etc. • The architecture supports continued operation from the cloud when the customer is separated from the service provider and vice versa (e.g., there is no critical dependency on the customer LDAP system).

  20. Framework 2010 – Cloud Assurance Metric Provider comparison on security features

  21. 2010 – Supporting EU Governments in Cloud Migration • Government in the Cloud: impact on service security & resilience • ENISA aims to: • Analyze and evaluate the impact of cloud computing on the resilience and security of GOV services • Provide recommendations and good practices for European Members State planning to migrate to cloud computing

  22. USA DK ... Japan UK Singapore Governments and the Cloud • Gov Agencies and Public Organizations around the globe are moving non-critical applications towards a "cloud approach". • In Europe we have some fast adopters, i.e. Denmark and UK, announcing/planning to move into the cloud. • In the short-medium term (1 to 3 years) an increasing number of Public Organizations, in EU Member States, will consider/adopt cloud computing. Australia

  23. 2011 procurement and monitoring guidelines CERT, ISAC Procurement Criteria Monitoring and Supervision Information security procurement criteria and monitoring of government cloud contracts.

  24. Conclusions • Cloud computing can represent an improvement in security for non-critical applications and data. • But transparency is crucial: customers must be given a means to assess and compare provider security practices. • In the current state of the art, migrating critical applications and data to the cloud is still very risky (even private clouds) • It is not currently clear to what extent the Cloud Computing model can be applied to applications that require high levels of security.

  25. http://www.nis-summer-school.eu/ Subscribe to the NIS'10 Newsletter at http://www.nis-summer-school.eu/

More Related