1. Cloud computing provides flexibility and economies of scale but introduces new security risks as sensitive data and infrastructure are placed outside traditional secure perimeters. 2. Traditional security measures like firewalls and intrusion detection become more difficult in cloud environments where virtual machines are dynamically allocated across shared physical servers. 3. Ensuring data integrity, updating security software, complying with regulations, and monitoring administrator access require new solutions to prove security and respond to vulnerabilities in cloud infrastructure and virtual environments.

1. Security of cloud computing
Thirty-nine years of my life had passed
before I understood that clouds were not my enemy.
Iimani David
Paul Neumann
pneumann@umt.edu.al

2. Infrastructure as a Service
Flexibility.
Economy of resources.
Free choice of computing power.
New risks to providers and enterprises.

3. Economy
1. IT infrastructure on demand – more cost-effective.
2. No redundant IT infrastructure, staff, and/or
investments.
3. Flexible response to the needs in computing
power.
No restraining factor to innovations.
Flexibility, scalability, configurability, mobility.

4. Flexibility
1. Outsourcing hardware infrastructure; retaining IT
management.
2. Outsourcing all aspects of IT management.
3. Mixed model; outsourcing some segments of IT
management where applicable.
Most often implemented
on demand of enterprise administrative branches.

5. IDC market research
International Data Corporation
Surveyed
top managers of
244 leading
IT companies
world-wide.
As early as in 2008.

6. Primary concerns
Will I have the same level of control over the IT
infrastructure and the data?
Does the IT infrastructure comply with the Law?
How can I demonstrate it to the auditors?
How will I prove to my company that the IT system
is secure?
How do I know that Service-Level Agreements will
be observed?

7. Data-Processing Centre
Risk 1:
Placing sensitive data outside the secure perimeter
may expose them to security risks.
Risk 2:
Placing sensitive data outside the secure perimeter
may be incompatible with the Law.

8. Secure perimeter
Firewall.
DMZ.
Network segmentation.
Intrusion Detection & Prevention Systems.
Network monitors.

9. Virtualization
More computing power from physical servers'
redundant capacities.
Individual services; diversified configuration of
applications.
Smaller DPC's, server consolidation, reduced costs of operation.

10. Virtualization kills secure perimeter
Impossible to build and apply secure perimeter:
Many servers are installed on one hardware platform.
Generally low level of security.
Data security has to be built around the data themselves and each
server.
Secure perimeter loses its sense.
Only application of new line of defence allows for
transferring IT operations to the cloud.

11. Difficulties of cloud security
Means of cloud security in principle the same as
traditional means of system security.
Providers of cloud services install virtual machines
on the same physical servers.
Increases efficiency of virtualization, compromises security.
Traditional means of system security can't protect
from attacks on virtual machines from within the
same physical server.

12. Access to the servers
System administrators have access via Internet.
Additional challenges to the system security.
Unlike traditional systems with access control on physical level.
Strict control of the administrators' access – critical.
So is control and transparency of changes on the
system level.

13. VM state and volatility
Virtual machines are dynamic.
Can be easily
– shut down and/or restarted;
– cloned and moved between servers.
– rolled back to a previous state;
Vulnerabilities and/or misconfigurations can spread
uncontrollably.

14. Vulnerabilities & attacks from within
The same level of risk to be hacked or infected.
In fact it's even higher: A number of VM's working at the same
time on a physical server increases the attacked space.
New challenge: hacking or infecting from within.
On the same physical server one virtual machine may attack
another virtual machine.
Intrusion Detection and Prevention systems now
must be capable of working on the VM level,
regardless of the location of that VM in the cloud.

15. Idle virtual machines
A VM may be compromised even if turned off.
Enough if the perpetrator has access to the images storage.
VM defenceless while turned off:
No security software is operating.
It's responsibility of the provider of cloud services to
scan idle virtual machines regularly.
Companies should control if providers enable scanning on
regular basis in their cloud environment.

16. Efficiency
Security solutions designed for x86 platform.
Without the virtualization in mind.
Massive scanning of multiple resources will cause a
dramatic decrease in efficiency of the whole cloud
structure.
Solution is in scanning on the hypervisor level:
No concurrency for resources on the VM level.
Companies should control if providers enables scanning on
regular basis in their cloud environment.

17. Data integrity
In a cloud attacked space is bigger and under
greater risks than in traditional environment.
It's critically important to prove that the data were
not compromised to internal and external auditors.
Logs must be analyzed for system integrity, file
integrity, as well as internal activities.
Compliance with security standards (PCI DSS, HIPAA, etc.)
provides “safe haven” in case of data security breach.

18. Update management
Once a company subscribed to a cloud service,
updating their applications is not provider's
responsibility.
About 90% of data security breaches occurred due to
misunderstanding of update management.
If timely update is impossible or impracticable.
“Virtual patches”: Blocking vulnerability attacks on
the network level.

19. Laws and policies
Data security standards (PCI DSS, HIPAA, GLBA,
etc.) and security audit recommendations (ISO,
SAS70, etc.) require ability to prove compliance
with Law regardless physical loction of the cloud
system
Service-Level Agreements must provide for access
to physical servers, virtual servers, firewall
configuration, intrusion detection and prevention
systems, logs, and anti-viruses.

20. Firewalls
Reduce the attacked space.
Cloud firewalls must comprise:
– VM isolation;
– input/output traffic filtration;
– IP protocols coverage (TCP, UDP, ICMP, etc.);
– IP frameworks coverage (TCP, ARP, etc.);
– DoS attacks prevention;
– sniffing and spoofing prevention.
Also control over the physical location.

21. Intrusion detection & prevention
Primary task to screen operating system's and
applications' vulnerabilities until they will be
eliminated.
Must provide protection from known, as well as
unknown (zero-day) vulnerabilities.
Must provide protection from XSS and SQL
injection.

22. Data integrity
Detecting and preventing unauthorized changes
in the operating system, files, and/or registers.
Must include:
– scheduled scanning and scanning on demand;
– files' formats, properties, attributes and CRC;
– directories' properties and attributes;
– configurability of the scope of scanned objects;
– reports (for audit).

23. Log analysis
Detecting events, significant from the point of
view of the information security, in the logs.
Suspicious behaviour.
Administrators' actions.
Statistical analysis of events throughout the whole
cloud infrastructure.
Security of Information and Event Management (SIEM).

24. Measures against malicious s/w
Anti-viruses adpted for the cloud environment.
VMsafe: Software interface provided from the
hypervisor (Vmware).
Scanning active and idle virtual machines.
Checking integrity of the VM's as well as their
content (files, applications, and registers).
Guarantees economical use of the physical resources.

25. VMsafe
Protects active as well as idle virtual machines.
Prevents blocking and/or uninstalling anti-viruses.
Integrated with the cloud management control panel
(Vmware vCenter).
Automatic configuration of new virtual machines.

26. Any questions?
Thank you for your attention!