Slashdot Mirror
Cloud Security: What You Need To Know To Lock It Down
Nerval's Lobster writes "IT security writer Steve Ragan writes: 'The word "cloud" is sometimes overused in IT—and lately, it's been tossed around more than a football during a tailgating party. Be that as it may, organizations still want to implement cloud-based initiatives. But securing assets once they're in the cloud is often easier said than done.' He then walks through some of the core concepts of cloud security, along with the companies operating in the space."
the only safe cloud is a dead cloud.
Easy solution: Don't do it. There, I saved you having to RTFA which is just spam to drive hits to Slashdot's Cloud page.
If you want something to be secure, you have to store it in house.
There is no guarantee that once you put it out on "the cloud" that someone else won't reach for it.
From the article:
"When you sign a Business Associate agreement, there's a level of liability that the business associate accepts. They openly acknowledge they have to operate within the HIPAA security rule like any covered entity. Understandably, none of the current cloud providers are willing to do that."
That says it all. The major cloud providers won't accept responsibility for security in their own systems.
The cloud provider effectively has physical access to your machine, which is game over for any sort of security. Even if you use full disk encryption, you're going to have to decrypt it, and that means your key will be in RAM. A motivated spy in the cloud provider would have little trouble dumping your VM's RAM and decrypting everything.
You might be able to get away with running machines locally, and using the cloud for storage, if you encrypt everything locally and only store encrypted data in the cloud. But that removes most of the benefits of using the cloud in the first place.
Give me Classic Slashdot or give me death!
Is it my intranet-cloud managed by my IT department?
Is it a dedicated cloud that my company out-sources, but which is not used by anyone else? If the servers in this dedicated cloud are virtual, are the real servers also dedicated to just my company? To the extend that there is un-encrypted communication between virtual or real servers, is the physical network the traffic travels on dedicated only to me, as it might be if all the equipment was on the same rack?
If the servers are outside of my physical control, is all persistent storage encrypted? If not, do I care if it leaks?
If the network traffic is not encrypted, what assurance do I have that nobody who isn't on my company's payroll can snoop it, or that if they do I can live with the consequences?
That's just for security from leaks.
There's a whole other set of issues related to downtime and other issues that are different with "cloud" data storage vs. in-house data storage.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Don't use the cloud.
Step #2
We don't need no stinking step #2.
Locally-encrypted backup-to-the-cloud is a viable, marketable service. This works both on an "intranet" basis for departments that don't, or for legal reasons can't,* trust IT with access to their data but who want the physical security of their backups managed by IT as well as on the "internet" as an outsourced-backup arrangement.
* Human Resources and departments that have certain external contractual obligations may not want to allow anyone outside of their department to have access to un-encrypted data or encryption keys. In certain industries like defense or medical care, the entire business may function like this.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
It's been tossed around more than a Fiesta in a Ken Block video.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Yes indeed:
http://xkcd.com/908/
Aberrations have appeared in my destiny prognostication engine!
"The word “cloud” is sometimes overused in IT" = Understatement Of The Year
Unequivocally the realest of the realz...
(Go ahead and mod this flamebait. I just need to rant)
When I read the replies that always come up in these cloud discussions, I often wonder how many people on this forum are real IT professionals and how many are just people with opinions that were formed in a vacuum. When I read these cloud articles, I think about them in the context of large corporations with many divisions that are consolidating IT operations. I think of application silos, and business continuity/disaster recovery. I think of internal IT provisioning resources to departments and using technology like hardware and storage virtualization to be smarter about how they allocate resources. I think about rapid provisioning of test/dev and QA environments, or rapidly spinning up new servers to meet unanticipated growth or to address seasonal growth trends.
So many of the comments seem to be coming from people whose entire concept of IT revolves around their home music collections, or working in a very small company that handles everything in house. The idea of giving up control to a cloud provider in that context seems reasonable. But there are large uses for "cloud" technologies that far surpass the tiny use cases in the SMB market. Denouncing everything to do with "cloud" shows a really immature understanding of how the technology is being deployed in the real world.
If you are not up to speed on how virtualization and distributed computing environments can improve IT operations, your skills are probably stagnant and you either need to sharpen your skills, or pick another field. Whining about cloud being a buzzword is not doing you any good. It just making you look irrelevant and out of touch. Having said that, I will be the first to admit that it is an annoying buzzword. But pointing it out is lame at this point. Even a broken clock tells the right time twice a day. If you cannot see how cloud technologies are relevant to IT, you are probably in the wrong discipline.