Cloud Security: FUD

FUD stands for Fear Uncertainty and Doubt.  Big vendors scare the heck out of most customers - "you don't have any security and you need this, this and that ..." - to some extent it is true, but, many customers can't afford the cost as no simple solutions are proposed.  With different view points and ideologies customers face lot of uncertainty in buying solutions or architectural philosophy.

An article on Cloud Security: Good Bad and Ugly highlights some of the FUD.  The questions asked are very much valid (I have updated a few with my interpretation):

• Who audits (security, data storage and use, updates to provider infrastructure may change security threat model, etc) a Cloud provider?
• Are background checks done on the Cloud provider operators?
• How is data stored on Cloud provider protected - from hackers, Governments, disaster, etc?
• Some Cloud providers have teamed up with boutique security consulting firms.  What does it really mean?

It is wrong to state **anything** is insecure - these blanket statements are harmful.  Exact scenarios on how a service is used must be clearly determined and security testing must be appropriately applied.  Security is not black or white - it is Risk Management.

OpenID and Credit Cards

Lets take a quick look at how Credit Cards (CCs) work - they are primarily provided by Visa, MasterCard, Discover, AmEx, etc which are issued via various banks.  When someone swipes a CC at a merchant location, the information is sent to a authorized payment gateway which further talks to the network (Visa, MasterCard, etc) which the card belongs to for authorization.  Today, the security weak points are at merchant locations, payment gateways.  Security issues include - loss of CC data, privacy info, Identity fraud and so on.

If we apply the CC analogy to OpenID distributed authentication model, then we may have some similar (to CC data) and some much more security issues.  If we assume that we are going to get there, what kinds of laws and protection mechanisms need to be in place to make this a success?

OpenID, a disturbed authentication

You can read about OpenID and how it works here

Though OpenID is marketed and used as a distributed authentication system, there are very few players and these are the big ones - AOL, Google, Yahoo, Facebook, etc.  There is one thing common among them - they all portals relying on advertising revenue as their business model.  The business model relies on getting as much information about the user as possible.

Lets check this scenario out:
A corp relies on a OpenID provider to authenticate users.  So, when the user tries to access an application, the application checks if the user is authenticated and if not, he/she is redirected to the OpenID provider for authentication.  Once the OpenID provider performs the login ceremony and successfully authenticates the user, the user is redirected to his application for access.  Similarly, when the user logsoff, the OpenID provider is notified.
Here the OpenID provider is keeping track of user login/logoff events - time stamps, application access, location of access, role of users for various applications, change in user population on the corp side and so on.  This kind of information is a gold mine for providers relying on ad revenue.  The provider is also able to track user movement among corporations, corporation's user and application movement.  Role management is also a issue - how are policies applied on users and application and where are they applied - on the OpenID provider or on corporate side?  Both of these methods have impact - if it is on corp side - it will be a performance impact, but, if it is on the OpenID provider side, then we have information disclosure issue.

It would be good to understand what corporations are thinking about using OpenID.

Cloud & Virtualization Security

This blog is intended to share our experiences & expectations with Cloud & Vitrualization security.  But, before we go there, lets get some understanding what these mean and why it matters.

Today, the top issue for a CIO is Data Center consolidation using Server Virtualization techniques.  This is mainly driven by the need to reduce CAPEX (better use of server hardware & depreciation costs) & OPEX (power and cooling $ savings).   But, moving applications to virtualized platforms introduces a change in deployment model and hence threat model.  Threats associated with this is widely categorized as "Virtualization Security".

There is another phrase that is loosely talked about by IT - "Cloud enablement".  The way I would explain this is  accessing services such as Storage, application, etc using REST based protocols.  Many of them even consider "Platform or Infrastructure as a Service" as a part of Cloud.  Platform would include Virtualization and Infrastructure would be configuring hardware (network, memory, CPU) dynamically.  So, it will be necessary for us understand the differences amongst all of these.  Google Apps, SalesForce.com are some Cloud based applications - we never ask them if they are running on platform A or infrastructure X.  In terms of Infrastructure as a Service Amazon EC2 or RightScale are some examples where they provide tools to upload software.  These services run on virtualized platforms.

As I mentioned, Cloud Applications mostly use REST based protocols.  Added to this, they may be dynamically provisioned or de-provisioned.  These applications need be secured from traditional threats, denial of service attacks, application attacks, cross site scripting, session hijacking, etc.  Single Sign On is an absolute must.  If these Cloud applications are hosted on public service Infrastructures or Platforms (Amazon, RightScale, etc) then, the applications can be a multi-tenant platform and hence they need to secure themselves.  The platform also needs to provide that confidence to their cloud application customers that their platforms are secure.

The above would be the starting points in enabling security for Virtualization and Cloud environments.