The Two Biggest Lies About Cloud Security | Opinions | ChannelWorld.in

PARTNER HOTLINES

The Two Biggest Lies About Cloud Security

By Bernard Golden, CIO.com on May 30, 2011
Bernard Golden, About the author

Bernard Golden, CIO.com

Bernard Golden is CEO of consulting firm HyperStratus which specializes in virtualization, cloud computing and related issues. He is also the author of "Virtualization for Dummies," the best-selling book on virtualization to date.


Survey after survey note that security is the biggest concern potential users have with respect to public cloud computing. CA and the Ponemon Institute conducted a survey and found similar concerns. But they also found that deployment had occurred despite these worries.

Most of the concerns voiced about cloud computing relate to the public variant, of course. IT practitioners throughout the world consistently raise the same issues about using a public cloud service provider. For example, this week I am in Taiwan and yesterday gave an address to the Taiwan Cloud SIG. Over 250 people attended, and, predictably enough, the first question addressed to me was, "Is public cloud computing secure enough, and shouldn't I use a private cloud to avoid any security concerns?".

However, framing the cloud security discussion as a "public cloud insecure, private cloud secure" formula indicates an overly simplistic characterization. Put simply both are rooted in the radical changes this new mode of computing forces on security products and practices.

Cloud Security Lie #1

The first big lie is that private cloud computing is, by definition, secure merely by way of the fact that it is deployed within the boundaries of a company's own data center. This misunderstanding arises from the fact that cloud computing contains two key differences from traditional computing: virtualization and dynamism.

The first difference is that cloud computing's technological foundation is based on the presence of a hypervisor, which has the effect of insulating computing from one of the traditional tools of security: examining network traffic for inappropriate or malicious packets. Because virtual machines residing on the same server can communicate completely via traffic within the hypervisor, packets can be sent from one machine to another without ever hitting a physical network, which is where security appliances are typically installed to examine traffic.

Crucially, this means that if one virtual machine is compromised, it can send dangerous traffic to another without the typical organizational protective measures even being involved. In other words, one insecure application can communicate attacks to another without the organization's security measures ever having a chance to come into play. Just because an organization's apps reside inside a private cloud does not protect it against this security issue.

Of course, one might point out that this issue is present with vanilla virtualization, without any aspect of cloud computing being involved. That observation is correct. Cloud computing represents the marriage of virtualization with automation, and it's in this second element that another security shortcoming of private clouds emerges.

Cloud computing applications benefit from this automation to achieve agility and elasticity--the ability to respond to changing application conditions by moving virtual machines quickly and by spinning up additional virtual machines to manage changing load patterns. This means that new instances come online within just a few minutes without any manual interaction. This implies that any necessary software installation or configuration must also be automated so that when the new instance joins the existing application pool it can immediately be used as a resource.

It also implies that any required security software must, likewise, be automatically installed and configured without human interaction. Unfortunately, many organizations rely on security personnel or system administrators to manually install and configure necessary security components--often as a second step after the rest of the machine's software components are installed and configured.

In other words, many organizations have a mismatch between their security practices and the reality of what a cloud requires. Assuming that a private cloud is, ipso facto, secure, is incorrect.

Moreover, it's critical to get them aligned. Otherwise, you face the likelihood that your application automation will outstrip your security practices, which is not a good situation. For sure, one would not like to be in the position of trying to explain why the supposedly-secure private cloud ended up exposing a vulnerability because the automation characteristics of cloud computing had not been extended through all parts of the software infrastructure.

So, the first big lie about cloud computing is that private clouds are inherently secure. What is the second?

Cloud Security Lie #2

The second lie about cloud computing security relates to assumptions about public cloud security; specifically, the assumption that security in public cloud computing rests solely with the CSP. The reality is that security in a service provider world is a responsibility shared between the provider and the user, with the former responsible for security in the infrastructure up through the interface point between application and hosting environment, and the user responsible for security with respect to interfacing with the environment, and importantly, within the application itself.

Failing to configure the application properly with respect to the environment security interface or failing to take appropriate application-level security precautions exposes the user to issues for which no provider can possibly be expected to take responsibility.

Let me provide an example. One company we worked with had placed its core application in Amazon Web Services . Unfortunately, it had not implemented appropriate security practices with respect to how it used AWS security mechanisms, nor with simple application design issues.

Amazon provides what is, in effect, a virtual machine-level firewall (called a Security Group) which one configures to allow packets to access specific ports. The best practice with respect to Security Groups is to partition them, so that very fine-grained port access is available per virtual machine. This ensures that only traffic appropriate for that type of machine goes to an instance. For example, web server virtual machines are configured to allow traffic on port 80 into the instance, while database virtual machines are configured to disallow traffic on port 80 into the instance. This blocks attacks on database instances (containing crucial application data) from the outside using web traffic.

To construct a secure application, one must use Security Groups properly. This organization had not. It used one Security Group for all traffic to all instances, which meant that every type of instance was exposed to any type of traffic destined for any instance.

Regarding the organization's application itself, it had implemented poor security practices. Instead of partitioning application code among different types of machines, it had loaded all application code into a single instance, which meant the same instance that received traffic for its corporate website also had code containing proprietary algorithms running on it as well.

The important fact about this situation: If this organization assumed that all security responsibility lay with the CSP (Amazon Web Services, in this case), it would be extremely negligent, because it had not taken important steps to address security issues for which no CSP could be responsible. This is what shared responsibility implies--both parties have to step up to the security aspects in their control, and failing to do so means the application is not going to be secure. Even if the CSP does everything correctly for portions of the cloud application within its control, if the application owner fails to implement its security responsibility correctly, the application is going to be insecure.

I have been in meetings with security personnel discussing security about public CSPs, who refused to consider their company's responsibility in these environments, insisting on redirecting every security topic back to concerns about the CSP's responsibility.

This struck me, frankly, as reckless, as it insinuated a refusal to seriously grapple with the necessary work of creating as secure a public CSP-based application as possible. It was as if the very attitude that all security responsibility lay with the CSP insulated the security person, and by extension, his company, from any liability for security failures in an application running in a CSP environment. It may not come as a surprise that the individual in question was a staunch advocate of private clouds, asserting their far superior inherent security.

The reality is that organizations are increasingly going to deploy applications in public CSP environments. It is vital that security groups step forward to ensure their organizations take every step possible to implement applications that are as secure as possible, and that means what steps the organization itself needs to take in that regard.

Security is, so to speak, the third rail of cloud computing. It is constantly cited as an inherent benefit of private clouds and a fundamental shortcoming of public cloud computing. Actually, the truth is far more ambiguous than these positions imply. Asserting the putative security shortcomings of public cloud environments without seriously considering how to mitigate them seems irresponsible and evidence of a belief that assertion implies dismissal with no further need to investigate mitigation techniques.

A poorly managed and configured private cloud application can be quite vulnerable, and a properly managed and configured public cloud application can achieve very good security. Characterizing the situation as black and white is simplistic and does a disservice to the discussion.

 

Latest Opinions

Budget 2015 Special

Budget 2015: Technology Vendors are a Happy Lot

Positive, bold, pragmatic: That’s what the Union Budget 2015 means to India’s top technology vendors.

Budget 2015: By the Numbers

This year's budget has been a mixed bag for the IT industry. Here's a look at the numbers that matter to you.

An Inclusive Budget Focused on IT and Growth: Bhaskar Pramanik, Microsoft

The Chairman of Microsoft India says the budget has made technology the backbone for government processes and systems.

MAIT: The Budget Promotes Domestic Manufacturing in India

The association believes that, from an IT industry perspective, the Union Budget 2015-2016 is a mixed bag with the inverted duty structure being finally addressed with the removal of SAD on all components.

NASSCOM: The Budget’s Good for IT, But Concerns Remain

The industry body says the budget is comprehensive, but it still hasn’t addressed concerns like dual levy on software and high rate of TDS.

A Budget for Innovation and Growth: Partha Iyengar, Gartner

This is a pragmatic and growth-oriented budget which incorporates the ‘rising tide lifts all boats’ philosophy, says Partha Iyengar, Country Manager (Research)-India, Gartner.

Getting Started on GST: What CIOs Should Start Doing Now

GST could impact the way you manage IT. Here's what you can do today to get started, according to Vivek Pachisia, Partner Tax and Regulatory Services, EY.

GST Could Radically Affect the IT Department

GST is coming, so what? What effect could it have on IT and IT strategy? Plenty, says Vivek Pachisia, Partner Tax and Regulatory Services, EY.

TECHNOLOGY DIRECTIONS 2015

Enhancing Digital User-Experience in 2015: Karthik Ananth,Zinnov

How digital transformation is impacting the way companies engage with their customers.

Collaborating To Outcome Based World: Priyadarshi Mohapatra, Avaya

Priyadarshi Mohapatra, Managing Director, India and SAARC, Avaya, on how IT is transitioning from a keep-the-lights-on role to one that enables customers to deliver results.

Journey to the Third Platform in 2015: Rajesh Janey,EMC

Rajesh Janey, President, EMC, India and SAARC, says that flash storage will accelerate the growth of the third platform.

Fostering New Relationships in 2015: Partha Iyengar, Gartner

In order to adopt a digital business strategy, channel partners need to establish relationships with LoBs.

Combating a New Breed of Cyber Attacks in 2015: FireEye

Ramsunder Papineni, Regional Director, India and SAARC, FireEye, on the paradigm shift in today’s threat landscape and how organizations can combat new threats.

The Dawn of the Digital Age: Akhilesh Tuteja, KPMG

The development of digital infrastructure will be a key growth driver for technology and solution providers. 

Paradigm Shift from End-Users to User-First : Parag Arora,Citrix

Parag Arora, Area Vice President and India Head, India Sub-continent, Citrix, says new technologies will force organizations to take a user-first approach in 2015.

HP's Blueprint for 2015 - SDN and Cloud Computing : Neelam Dhawan

Neelam Dhawan, VP and General Manager, Enterprise Group and Country MD, HP India,  on why a combination of cloud computing and SDN will dominate 2015.

SAP Banks on HANA for 2015 : Ravi Chauhan

Ravi Chauhan, Managing Director, India and Sub- continent, SAP, on becoming a cloud company powered by HANA.

Mobile and Cloud Are Gamechangers of the Future: Karan Bajwa,Microsoft

Karan Bajwa, Managing Director, Microsoft India, says, in  2015, organizations will adopt a mobile-first and cloud-first strategy to get ahead of competition.  
 

Ready to Fight 2015's Threats : Jagdish Mahapatra,McAfee

Jagdish Mahapatra, Managing Director, McAfee, India and SAARC, part of Intel Security, says the company is armed with new solutions to beat sophisticated threats.

A Network for the Internet of Everything : Dinesh Malkani,Cisco

Dinesh Malkani, President, India and SAARC, Cisco, talks about IoT and the significant technology transitions in the networking world.
 

Moving to the Third Platform: Jaideep Mehta, IDC

Cloud and mobility are the two technologies that will fuel the rapid adoption of the third platform in India.

Envisaging a Holistic Security Strategy For 2015: Sanjay Rohatgi,Symantec

Sanjay Rohatgi, President–Sales, Symantec India, says the company has a set of holistic solutions in place to secure organizations from security threats. 

Intel's 2015 Plan: Taking the Digital India Story Forward

Debjani Ghosh, VP-Sales and Marketing Group and MD, South Asia, Intel, is banking on innovative technology to make the Digital India dream a reality.

Embracing SDN in 2015: Ashish Dhawan,Juniper Networks

Ashish Dhawan, Managing Director, India and SAARC, Juniper Networks, talks about the company’s well-etched roadmap to ride the SDN wave.

Beating the Bad Guys: Sivarama Krishnan, PwC

Organizations will need to turn inwards to establish robust information security strategies.

Hybrid Cloud is 2015's Biggest Gainer: Sunil Gupta,Netmagic

Sunil Gupta, Executive Director and President, Netmagic, an NTT Communications company, expects the hybrid cloud to be the biggest gainer in 2015.

2015 is the Year of SDDC: Arun Parameswaran,VMware

Arun Parameswaran, Managing Director, VMware India, says 2015 will be the year of software-defined datacenter.

Enterprises Surging Ahead with Hybrid Cloud in 2015 : Anil Valluri,NetApp

Anil Valluri, President, NetApp, India and SAARC, says, in 2015, enterprise platforms will start encompassing hybrid cloud architectures.
 

Armed for 2015's Security Threats: Anil Bhasin,Palo Alto Networks

Anil Bhasin, Managing Director, Palo Alto Networks India, says new threats weaken an organization’s network but advanced security tools can change that.

Building Capabilities for a Digital Tomorrow: Alok Ohrie,Dell

Alok Ohrie, President and Managing Director, Dell India, on the company’s investments to build end-to-end solutions and delivery capabilities for a digital world.

Going Truly Mobile in 2015: Vikram Sehgal, Forrester Research

India is embracing mobile faster than mature economies. Here’s what it needs to watch out for to do it well.

VIDEOS | FORECAST 2015

SAP Cloud Strategy Powered by HANA: Ravi Chauhan

CIOs will rapidly adopt SMAC in 2015, and SAP has innovative solutions to provide business advantage and competitive edge to India Inc., says Ravi Chauhan, MD, SAP India.

Dell to Dominate Converged Infrastructure Market in India: Alok Ohrie

From a PC manufacturer to an end-to-end solutions provider, we are gaining India market share through a strong partner ecosystem: Alok Ohrie, MD & President, Dell India.

Citrix Will Catalyze Shift From End-user to User-First: Parag Arora

Parag Arora, Area VP and India head, India Sub-continent, Citrix, talks about the company’s vision to drive a paradigm shift in enterprise IT: From an end-user approach to a user-first approach powered by mobile and cloud computing and enabled by competent channel partners.

Mobility to Boost Collaboration and Conferencing in 2015: Priyadarshi Mohapatra, Avaya

Avaya delivers great value as an end-to-end communications solutions provider across data, audio and video, says Priyadarshi Mohapatra, MD India and SAARC, Avaya

Securing Organizations Against Modern Day Threats: Sanjay Rohatgi, Symantec

We have proven that we can manage and secure an organization’s data from within and outside a network, which is a vital requirement by CISOs today, says Sanjay Rohatgi, President-Sales, India, Symantec.

We are the Apple of Network Security World: Anil Bhasin, Palo Alto Networks

Anil Bhasin, Managing Director, Palo Alto Networks India, says new threats weaken an organization’s network but advanced security tools can change that.

Software Defined Networking to Rule in 2015: Ashish Dhawan, Juniper Networks

Networking is definitely moving towards a software-defined paradigm and we continue to dominate the India market with an extensive portfolio, and well-entrenched channels, says Ashish Dhawan, MD, India and SAARC, Juniper Networks.

EMC to Dominate 3rd Platform Across India Inc.: Rajesh Janey

In the last year, EMC has refreshed its entire product line to enable customers take advantage of the 3rd platform, says Rajesh Janey, president, India and SAARC, EMC.

IoT Vital for Digital India Initiative: Debjani Ghosh, Intel

The tons of data that will be generated in the coming years will open opportunities in storage, and analytics, says Debjani Ghosh, VP, sales and marketing group, and MD-South Asia, Intel.

VDI, Flash and Hybrid Cloud to Propel Storage Market: Anil Valluri, NetApp

We are witnessing a movement from traditional data storage systems to a hybrid cloud environment says Anil Valluri, president, India and SAARC, NetApp.

SDDC is the Big Shift for 2015: Arun Parameswaran, VMware

Arun Parameswaran, MD, VMware, says that in India, unlike other countries, there is still a huge untapped opportunity to virtualize existing infrastructure in 2015.

Go Cloud for Business Advantage: Sunny Sharma, Foetron

Sunny Sharma, CEO and Founder, Foetron, speaks about the company's focused roadmap to ride the public cloud wave.

FireEye to Combat APTs Across Multiple Vectors in 2015: Ramsunder Papineni

Going into 2015, organizations need to think of security more holistically, including ways to defend end points, e-mail, Web, file, and mobile security, says Ramsunder Papineni, regional director, India and SAARC, FireEye.

Retaining IT Talent in 2015: Shirish Anjaria, Dynacons

Shirish Anjaria, CMD, Dynacons Systems & Solutions, speaks about how partner companies can enhance the talent pool of skilled IT staff.

New Style of IT to Gather Traction in 2015: Neelam Dhawan, HP

SDS, SDN and software defined infrastructure will play a key role across Indian organizations in 2015, says Neelam Dhawan, VP and GM, enterprise group, country MD India, HP.

Building Strong Vendor-Partner Relationships: Pawan Khurana, QuantM

Pawan Khurana, CEO, QuantM, on what he expects from technology vendor companies in 2015.

IoE to be Biggest Market Disruptor in 2015: Dinesh Malkani, Cisco

We continue developing innovative solutions in IoT and cloud computing and help our partner ecosystem capitalize on market opportunities, says Dinesh Malkani, president, Cisco India and SAARC.

New Technologies For New Growth: Murtuza Sutarwala, Swan Solutions & Services

Deep selling and upselling emerging technologies to customers enhances our value proposition as a competent solution provider, says Murtuza Sutarwala, Swan Solutions & Services.

Analytics is a Goldmine for Channels in 2015: Anoop Pai Dhungat, Galaxy Office Automation

Analytics, mobility, and security are the technology megatrends for us in 2015, says Anoop Pai Dhungat, CMD, Galaxy Office Automation.

Smartphone Proliferation to Impact Mobile Strategies in 2015: Vikram Sehgal, Forrester

Enhancing customer experience through mobility will be key priority for organizations in 2015, says Vikram Sehgal, VP and Research Director, Forrester.

3rd Platform to Take Off in India: Jaideep Mehta, IDC

Jaideep Mehta, MD, India and South Asia, IDC, say cloud computing and mobility will be the fastest growing 3rd platform technologies in India.

Opex Model the Way Forward for Partners in 2015: Ajay Sawant, Orient Technologies

Ajay Sawant, Orient Technologies, talks about the massive shift as traditional system integrators move towards an Opex-led business model.

Digital India is Colossal Opportunity for Channels: Akhilesh Tuteja, KPMG

Channel partners should devise a vertical strategy with the right alliances and innovative solutions, says Akhilesh Tuteja, Partner-IT Advisory, KPMG India.

Going Digital the Way Ahead for India Inc: Karthik Ananth, Zinnov

Since India is a mobile -first market, Indian organizations that are turning digital should ensure that they deliver a uniform experience for their customers, says Karthik Ananth, Director, Zinnov.

EDITOR'S PICK

WatchGuard Fires its India Team, Explores ‘Master Disty’ Route

Industry reports indicate that executives in pre-sales, sales, and technical teams across India have been asked to go.

iValue Creates Real Value for Channels in India

Focused on niche vendor alliances around data, network and app management backed by a robust channel ecosystem marked iValue's success in 2014. What clicked for the seven-year-old VAD?

SDN, NFV are Huge Opportunity for Channels: Gabriel Breeman, Brocade

We make the best technologies available, but we need partners to address certain market segments and integrate end-to-end solution stacks, says Gabriel Breeman, OEM and Channel Partner director, Brocade.

Kamtron Systems

Transitioning towards a service-oriented company will boost our growth, believes Kavita Singhal, director, Kamtron Systems.

Facebook, Reliance Communications Cock a Snook at Net Neutrality

Reliance Communications and Facebook are trying to sugarcoat a blatantly biased and anti-net neutrality move as a socially responsible initiative. 

RAH Infotech Redefines Channel Ecosystem in India

Mutual trust and long lasting bond with vendor companies and channel partners helps VADs to evolve and succeed in today’s aggressively competitive market. Leveraging competent channel partners and forge niche vendor alliances marks RAH Infotech’s success in 2014.

Veritas Remains Powerful Brand for Channels, Customers: Sanjay Rohatgi

Winning in both the security and Information Management markets require distinct, focused strategies, says Sanjay Rohatgi, President –Sales, Symantec India.

How Macaws Infotech Enhanced Security Posture for Sesa Sterlite

Macaws Infotech implemented Trend Micro DLP to resolve end-point security threats and attain compliance level for Sesa Sterlite.

SLIDESHOWS

6 Leaders Who Headed for an Abrupt Exit

The abrupt exit of top leaders of Indian and global tech companies this year, with many of them citing ambiguous reasons, surprised the technology world.

Gartner Executive Summary Survey 2014

Gartner's Annual CIO Survey highlights the trends that will drive organizational IT spend in 2014.

10 Overhyped Tech Products That Crashed and Burned

The demos blew everyone away. Then reality hit.

Gartner Executive Summary Survey 2014

Gartner's Annual CIO Survey highlights the trends that will drive organizational IT spend in 2014.

ChannelWorld Survey: State of the Market 2014

Partners poll their sentiments, expectations, pain points, and challenges for the coming year.

FAST TRACK

Kamtron Systems

Transitioning towards a service-oriented company will boost our growth, believes Kavita Singhal, director, Kamtron Systems.

TIM Infratech

Delivering ‘best of breed’ technologies to enterprises is key to success, says Monish Chhabria, MD, TIM Infratech

Mudra Electronics

A vendor-agnostic strategy helped us sustain business, says Bharat Shetty, CMD, Mudra Electronics.

Systematix Technologies

Our USP is a customer-friendly approach backed by services, says Akhilesh Khandelwal, Director, Systematix Technologies.

CorporateServe Solutions

Our ability to turnaround complex ERP projects in record time is what gets us customer referral, says Vinay Vohra, Founder & CEO, CorporateServe Solutions.

KernelSphere Technologies

We are emerging as an end-to-end systems integrator, says Vinod Kumar, MD, KernelSphere Technologies.

Uniware Systems

We constantly validate emerging technologies for first-mover advantage, says Vergis K.R., CEO, Uniware Systems.

Astek Networking & Solutions

An innovative approach helps us stay successful, says Ashish Agarwal, CEO, Astek Networking & Solutions.

CSM Technologies

Our approach is backed by innovation and simplicity, says Priyadarshi Nanu Pany, CEO, CSM Technologies.

EMC PARTNER SHOWCASE

Partnering for Profitability

Atul H. Gosar, Director, Network Techlab, shares how the company’s association with EMC has provided it with a competitive edge and a wide customer base, leading to increased profitability.

Sponsored Content

Promising Pipeline

Venkat Murthy, Prime Mover, 22by7 Solutions, shares how EMC brings in competitive edge by enabling technology, GTM and lead generation, helping 22by7 acquire new customers and retain old ones.

Sponsored Content

Powerful Performance

Deepak Jadhav, Director, VDA Infosolutions, says initiatives by EMC around training and certification have helped the company’s staff improve its performance and enhance customer experience.

Sponsored Content

Performance Booster

Rajiv Kumar, CEO, Proactive Data Systems, says that the solution provider’s association with EMC has helped expand its customer base and added value to existing offerings.

Sponsored Content

Pursuit of Profitability

Santosh Agrawal, CEO, Esconet Technologies, shares insights on how the systems integrator’s association with EMC has spelled sustained success over the years.

Sponsored Content

Non-Performance is Not an Option

Nitin Aggarwal, Director, Trifin Technologies, shares insights on how the association with EMC has helped the system integrator stand out and empowered its personnel to deliver consistent performance.

Sponsored Content

SOCIAL MEDIA @ CW India
SIGNUP FOR OUR NEWSLETTER

Signup for our newsletter and get regular updates.