Service goes accessible_2013_sh


Published on

How to be safe when using "cloud services", social media

1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Service goes accessible_2013_sh

  1. 1. How to be safe in the cloud “AaltoCloud” • Cloud as a concept Workshop • Good to know before using cloud • Selecting the best suitable cloud • Using cloud safelyTomi JärvinenAalto-university IT • What Aalto can offer for cloud usersTwitter/tomppaj
  2. 2. What is ”Cloud”?•nothing new, really… –news groups, IRC, forums, web hosting... –marketing term, services are now in a fancy, easy to use package –IBM new product ”Blue Cloud” came 2007 *•there is no universally accepted definition –concept or metaphor, which refers to the services available through network –"only" a concept that combines old and new services –Cloud conputing Guru Simon Wardley found 67 marketing definitions for Cloud ** accessible scalable from “pay only for everywhere elastic , dynamic what you use” resources typically via browser * IBM, 2007 ** Simon Wardley, Cloud Guru, technology thinker, researcher at CSC Leading Edge Forum 4/26
  3. 3. ”Cloud” - corporate vs. individual users• IaaS (Infrastructure as a Service) “IT” is outsourced, customer pays only for the use.• PaaS (Platform as a Service) typically software development using tools and/or libraries from the provider.• SaaS (Software as a service ) application can be used with the browser. – For corporates, e.g. Office 365 – For consumers, e.g. Facebook, Gmail, Twitter• Today ‘anything as a service (NaaS, SaaS...)Definitions depend on the provider (remember, just marketing term...) 4/26
  4. 4. Why people like to use Cloud services? new”DropBox” service 4
  5. 5. Plenty to choose from 5
  6. 6. Pros and cons - “consumer tools”• ready to use/clientless • where is the data?• scalable • who gets it?• no IT help needed • provider employees?• all possible bells and whistles • network traffic?• low cost , • bottlenecks? free of charge • privacy policy? • Data collection and (not really free, privacy, destruction? addvertisement..) • terms of service? • investigation? (illegal content ,copyright etc.) • lock-in? * No Google Maps for Windows Phone 8? (at the moment 7.1.2013) seems that Maps WILL be available on Windows phone. 6
  7. 7. Discussion• What kind of cloud services are you using?• Which are the best ones and why?• Do you have any concerns about cloud services?15 min 7
  8. 8. Part 2• Good to know before using cloud, risks, material, providers, other issues• Selecting the best suitable cloud service• Using cloud safely• What Aalto can offer for cloud users
  9. 9. Risk is not a question, it is a fact2006 Major USA credit card processor leaked millions of credit card numbers The Register UK Magazine :“Amazon cloud fell from sky” details of 77 million PlayStation users leaked passwords leaked by hackers Windows Live Hotmail (Four days outage for 17 000) 9
  10. 10. Privacy costsSome services are collecting huge amount of data about user. However, theuser does not know what provider is collecting:• what data is being collected• for how long the data is stored,• for what purpose the data is being collected etc. – and the service provider usually is claiming right to use the data for future purposes. Sell data to other company in case of acquisitionhardware model, operating system version, unique device identifiers, mobilenetwork information, details of how you use the service, search queries, phonenumber, calling-party number, forwarding numbers, time and date of calls,duration of calls, SMS routing information and types of calls, system activity,hardware settings, browser type, browser language, the date and time of yourrequest and referral URL, migth collect and store information (including personalinformation) from your device using mechanisms such as browser andapplication data caches…(these are from one service) 10
  11. 11. ”Patriot act”, do I have to care?USA PATRIOT Act (commonly known as the Patriot Act) Law forfighting against terrorism. Government can ask data from anyUSA based company, including data located outside of USA.(Microsoft, Gmail, Facebook, Dropbox...)• 1,271 government organizations and 1,931 private companies Wikimedia commons• 854,000 people have security clearances• Data “for government use” might end to a third partyTake into consideration if you are working with the goverment,with something very innovative or when co-operating with externalpartners. 11
  12. 12. Material not suitable for cloud (1/3)Think about your work and information you are processing!All the material is not suitable for a public service.University data,• study attainments, student evaluations• research plans, development work• or, e.g., information which the university is obligated to retain long term in its records should not be processed using external servicesPublished intellectual property• copyright (e.g., digital-rights management, media)• patent (e.g., designs, processes)•• trademark (e.g., graphics, URLs, even Logos might need approval) 12
  13. 13. Material not suitable for cloud (2/3)Regulated information• HR and employment• medical• financial• technology and telecommunications data (usage)• other regulated informationIT information• activity and access logs (dynamic monitoring, audits)• policy, rules, and authorizations (some of those)• identity and authentication 13
  14. 14. Material not suitable for cloud (3/3)Confidential business information• trade secrets• financial, tax, and insurance records• operations data (e.g., enterprise resource planning, supply-chain management• other commercial information (e.g., marketing plans, customer lists, contracts, IT architecture) 14
  15. 15. First: choose the right service (1/3)• three basic models: Free – Advertisement – Freemium (business)• free service (often end up to advertisement or freemium model)• advertisement:, what is the motivation of the service provider? – money, money, money (Facebook)• Freemium, light free version, full with paying something (Yammer)• And, stay focused, service for one purpose usually fits the user needs better and lasts longer – users learn how to use – service does what it is supposed to do – probably easier to find alternative solution when needed 15
  16. 16. First: choose the right service (2/3)pay attention!• Documentation, widely used API:s• standard and multiple formats• anonymity (option to study without giving personal details to external marketing company)• EULA, terms of service, privacy policy (Good or Bad?)• integration to other same provider services (lock in vs. easy exit)More information about EULAs:open community ”Terms of service - didn’t read” 16
  17. 17. Security is not provider top priority (3/3) audit test resultCloud provider security audit 2011Context Information Security, 3- 2011; Assessing Cloud Node Security, White paper 17
  18. 18. Second: use service wisely (1/2)• you cannot get anything “back”• services may claim ownership of the information• “free” services often collect and disclose information to third parties such as advertisers or collaboration Trend micro partners. So, think what you share• malicious links, think before clicking• think where you buy from• "fakeware / scareware“, think before buying• be accurate, how and what you write• please do not comment on behalf of the University, unless it belongs to the job description :)• be careful, and specially with Android - > 18
  19. 19. Second: use service wisely (2/2)• keep your password / username combination safe, if the worst happens (serious illness, even death, or matters related to legislation) • material may be financially or for some other reason valuable (university or relatives, e.g. script, photos, new 7 brothers:)• use different password and user id, mnemonic?, software like "KeePass“ for password management• use "alias", Teemu courseX2012, etc... check if this is not against TOS.• keep copies of everything on your own computer• do not accept all friend requests!• if necessary, clear the browser cache• only "Sure" way to store files securely is an encryption cloud/ 19
  20. 20. Special cloud case, email in the cloud• actually the biggest real life risk, most incidents are related to email.• phishing emails/malware on a daily basis• identity thefts happen (monday mornings, stress, hurry)• proposals to make money• With ”SingleSignOn” Aalto-password , access to ALL you data• Aalto IT will NEVER close your account because of full disk space or malware, so don’t click those emails.• Aalto IT will NEVER ask your password, neither by phone nor by email• You will NEVER get any sanctions about accidental mistakes If you suspect something, contact immediately Aalto service desk or security team. Don’t panic! Don’t be afraid to contact
  21. 21. Special case, email• Actually biggest real life risk• On daily basis phishing emails• Identity theft• Proposals to make money• SingleSignOn Aalto-password provide access to ALL you data• IT will NEWER close you account becaouse of full disk space or malware, so don’t be scared and click those emails.• IT will NEWER ask your password, not by phone, not by email• You will NEWER get any sanctions about accidentsIf you suspect something contact immediately Servicedesk or
  22. 22. Aalto Cloud portal http://Pilvi.aalto.fiWhy we made it:• Aalto users were asking a lot about various kind of applications and providers• Users had concerns• Questions, which systems could be used for certain needs, policy?• recommend good/ secure/ reliable/ tested services to Aalto usersWho made it:• Aalto VIPU team* , Information security team, Aalto Web-team 22
  23. 23. – ”just use” cloud services for light useNeed is something for light use or forsmall group, just choose theappropriate service and start using!Grouped by Categories:•”Web presence”•collaboration•file synchronising•blogging•media share...You can also find:•feedback page•request form, for a new services•list about recommended andapproved services•instructions 23
  24. 24. Instructions about heavier use (1/2) IF the service use involves:• processing of personal data• processing of secret material• processing of bank details• administration requirements• requirements for high 24/7 usability• licences• large costs• a large number of users or several units involvedTHEN Please, contact the account managers - “asiakkuuspäälliköt” 24
  25. 25. Instructions about heavier use (2/2) 25
  26. 26. AccessibilityAccessibility, big yes!(from everywhere, with all the platforms, all needs)So USE cloud services.But, think first 
  27. 27. Questions? Thank you!security(at), tomi.jarvinen(at) 27