Security in the Cloud
This blog was written in response to the article on CNN.com - http://money.cnn.com/2011/06/22/technology/dropbox_passwords/index.htm
A cloud software company’s worst nightmare came true for Dropbox this past weekend when a software bug allowed anyone to login to an account (over a four hour time period) using any password. It’s unknown if or how many accounts were accessed inappropriately. So far there are no reports of data breaches.
This recent occurrence, coupled with other non-cloud, but seemingly similar themed data breaches as reported by Citi Bank, Sony and LulzSec, has moved the “can the cloud be secure” conversation into the spotlight. The short answer is yes, the cloud is secure, and here is why.
Defining responsibility
Data security in the cloud is a combination of “inherited responsibilities” between the cloud infrastructure provider (Amazon, Rackspace, Softlayer, etc.) and the independent software vendor (ISV), i.e. Dropbox, and the customer.
Data security in the cloud is really two components: resiliency and privacy. Resiliency means when a customer stores data in the cloud, the cloud vendor should not lose that data. Privacy means nobody but the customer should be able to “see” the data stored in the cloud.
Securing the Cloud
The cloud vendor is responsible for data resiliency. Cloud vendors provide Service Level Agreements (SLA) that provides a measure of resiliency so that customers can compare one cloud versus another. For example Amazon Web Services (AWS) provides an “eleven-nines” of cloud storage resiliency, while SoftLayer offers “five-nines.” These SLAs are far better than what a typical enterprise can achieve in their own data center.
Secondly, the ISV is responsible for data privacy. This means any number of methods for encrypting or obfuscating the data contents (a photo, a word processing file, etc.) There are different use cases for the various privacy methods available. In some examples, data is encrypted before it is uploaded to the cloud. This method works well for “backup to the cloud” where the cloud software vendor doesn’t need to be able to open the contents. In this case the data is “black box” to the software and infrastructure. Black box data isn’t useful much beyond a backup system. To make the data more useful in the cloud requires a multi-layered security approach.
An alternative security implementation uses two or more encryption layers. As data moves “over the wire” from customer to cloud, Secure Socket Layers (SSL) will protect the contents as the data packets fly through the Internet. This is the same protection used for credit card numbers, online banking and e-commerce. Once the data is securely transmitted to the cloud, a second encryption layer takes over and secures the data “at rest.” This two-stage approach allows the data to be useful in the cloud, while at the same time offering a high degree of privacy.
For example, Sonian implements the multi-layer encryption method for archiving content to the cloud. SSL is used for “over the wire” and AES-256 is used for “data at rest.”
The customer takes the final, yet very important role in cloud security. The customer is responsible for choosing “strong” passwords. It’s a simple request, but amazingly enough, many cloud customers do not take the time to generate a sufficiently unique password for their accounts.
Sonian’s web application actually enforces strong passwords, allowing the customer to create password rules. Sonian also uses per-customer encryption keys, and a method of securing data that allows for key rotation, key deprecation and rapid re-encryption. Each customer has its own unique login URL in addition to a username and password combination. In addition, all login and user interface interactions are logged and audited. Customers can view their own unique audit trail to ensure no unauthorized access has occurred.
Future of Cloud Security
Cloud computing’s great potential is to apply “on-demand” scale to big data crunching. Having “trusted access” to contents means being able to create full-text indexes on terabytes of data, analyzing hundreds of gigabytes for business intelligence, or running sophisticated analytics on thousands of virtual computers all at once.
There is no limit to the cloud, but there is an implicit trade off of each method for securing data in the cloud. For data to be useful beyond simple backup and restore, it requires a multi-layer approach and this next wave of security innovation will make this approach even stronger. Start to look for software supporting multi-factor authentication (MFA) and support for customer-owned encryption keystores. MFA means access to data requires two or more authentication factors, for example a password and a code from a secure ID time token. This will virtually eliminate “hacking” potential because a physical device has to be present at login.
A second innovation will allow customers to manage their own keystore. This concept will allow customers to “revoke” access to their data in the cloud from the software and infrastructure layers. The customer will maintain a small file with encryption key information and the software must have access to this file in order to open the contents for indexing and other value added activities. If the customer is uncomfortable with the cloud vendor(s), then the customer can cut off access to the remote keystore.
Overall, the main components of cloud security are resiliency and privacy, both of which, cloud vendors, software developers and customers all play a role in. However, the future holds great innovations for the cloud and the security it can attain.
blog comments powered by