The Two Biggest Lies About Cloud Security | Opinions | ChannelWorld.in

The Two Biggest Lies About Cloud Security

Added on May 30, 2011 by Bernard Golden
Bernard Golden, About the author

Bernard Golden

Bernard Golden is CEO of consulting firm HyperStratus which specializes in virtualization, cloud computing and related issues. He is also the author of "Virtualization for Dummies," the best-selling book on virtualization to date.


Survey after survey note that security is the biggest concern potential users have with respect to public cloud computing. CA and the Ponemon Institute conducted a survey and found similar concerns. But they also found that deployment had occurred despite these worries.

Most of the concerns voiced about cloud computing relate to the public variant, of course. IT practitioners throughout the world consistently raise the same issues about using a public cloud service provider. For example, this week I am in Taiwan and yesterday gave an address to the Taiwan Cloud SIG. Over 250 people attended, and, predictably enough, the first question addressed to me was, "Is public cloud computing secure enough, and shouldn't I use a private cloud to avoid any security concerns?".

However, framing the cloud security discussion as a "public cloud insecure, private cloud secure" formula indicates an overly simplistic characterization. Put simply both are rooted in the radical changes this new mode of computing forces on security products and practices.

Cloud Security Lie #1

The first big lie is that private cloud computing is, by definition, secure merely by way of the fact that it is deployed within the boundaries of a company's own data center. This misunderstanding arises from the fact that cloud computing contains two key differences from traditional computing: virtualization and dynamism.

The first difference is that cloud computing's technological foundation is based on the presence of a hypervisor, which has the effect of insulating computing from one of the traditional tools of security: examining network traffic for inappropriate or malicious packets. Because virtual machines residing on the same server can communicate completely via traffic within the hypervisor, packets can be sent from one machine to another without ever hitting a physical network, which is where security appliances are typically installed to examine traffic.

Crucially, this means that if one virtual machine is compromised, it can send dangerous traffic to another without the typical organizational protective measures even being involved. In other words, one insecure application can communicate attacks to another without the organization's security measures ever having a chance to come into play. Just because an organization's apps reside inside a private cloud does not protect it against this security issue.

Of course, one might point out that this issue is present with vanilla virtualization, without any aspect of cloud computing being involved. That observation is correct. Cloud computing represents the marriage of virtualization with automation, and it's in this second element that another security shortcoming of private clouds emerges.

Cloud computing applications benefit from this automation to achieve agility and elasticity--the ability to respond to changing application conditions by moving virtual machines quickly and by spinning up additional virtual machines to manage changing load patterns. This means that new instances come online within just a few minutes without any manual interaction. This implies that any necessary software installation or configuration must also be automated so that when the new instance joins the existing application pool it can immediately be used as a resource.

It also implies that any required security software must, likewise, be automatically installed and configured without human interaction. Unfortunately, many organizations rely on security personnel or system administrators to manually install and configure necessary security components--often as a second step after the rest of the machine's software components are installed and configured.

In other words, many organizations have a mismatch between their security practices and the reality of what a cloud requires. Assuming that a private cloud is, ipso facto, secure, is incorrect.

Moreover, it's critical to get them aligned. Otherwise, you face the likelihood that your application automation will outstrip your security practices, which is not a good situation. For sure, one would not like to be in the position of trying to explain why the supposedly-secure private cloud ended up exposing a vulnerability because the automation characteristics of cloud computing had not been extended through all parts of the software infrastructure.

So, the first big lie about cloud computing is that private clouds are inherently secure. What is the second?

Cloud Security Lie #2

The second lie about cloud computing security relates to assumptions about public cloud security; specifically, the assumption that security in public cloud computing rests solely with the CSP. The reality is that security in a service provider world is a responsibility shared between the provider and the user, with the former responsible for security in the infrastructure up through the interface point between application and hosting environment, and the user responsible for security with respect to interfacing with the environment, and importantly, within the application itself.

Failing to configure the application properly with respect to the environment security interface or failing to take appropriate application-level security precautions exposes the user to issues for which no provider can possibly be expected to take responsibility.

Let me provide an example. One company we worked with had placed its core application in Amazon Web Services . Unfortunately, it had not implemented appropriate security practices with respect to how it used AWS security mechanisms, nor with simple application design issues.

Amazon provides what is, in effect, a virtual machine-level firewall (called a Security Group) which one configures to allow packets to access specific ports. The best practice with respect to Security Groups is to partition them, so that very fine-grained port access is available per virtual machine. This ensures that only traffic appropriate for that type of machine goes to an instance. For example, web server virtual machines are configured to allow traffic on port 80 into the instance, while database virtual machines are configured to disallow traffic on port 80 into the instance. This blocks attacks on database instances (containing crucial application data) from the outside using web traffic.

To construct a secure application, one must use Security Groups properly. This organization had not. It used one Security Group for all traffic to all instances, which meant that every type of instance was exposed to any type of traffic destined for any instance.

Regarding the organization's application itself, it had implemented poor security practices. Instead of partitioning application code among different types of machines, it had loaded all application code into a single instance, which meant the same instance that received traffic for its corporate website also had code containing proprietary algorithms running on it as well.

The important fact about this situation: If this organization assumed that all security responsibility lay with the CSP (Amazon Web Services, in this case), it would be extremely negligent, because it had not taken important steps to address security issues for which no CSP could be responsible. This is what shared responsibility implies--both parties have to step up to the security aspects in their control, and failing to do so means the application is not going to be secure. Even if the CSP does everything correctly for portions of the cloud application within its control, if the application owner fails to implement its security responsibility correctly, the application is going to be insecure.

I have been in meetings with security personnel discussing security about public CSPs, who refused to consider their company's responsibility in these environments, insisting on redirecting every security topic back to concerns about the CSP's responsibility.

This struck me, frankly, as reckless, as it insinuated a refusal to seriously grapple with the necessary work of creating as secure a public CSP-based application as possible. It was as if the very attitude that all security responsibility lay with the CSP insulated the security person, and by extension, his company, from any liability for security failures in an application running in a CSP environment. It may not come as a surprise that the individual in question was a staunch advocate of private clouds, asserting their far superior inherent security.

The reality is that organizations are increasingly going to deploy applications in public CSP environments. It is vital that security groups step forward to ensure their organizations take every step possible to implement applications that are as secure as possible, and that means what steps the organization itself needs to take in that regard.

Security is, so to speak, the third rail of cloud computing. It is constantly cited as an inherent benefit of private clouds and a fundamental shortcoming of public cloud computing. Actually, the truth is far more ambiguous than these positions imply. Asserting the putative security shortcomings of public cloud environments without seriously considering how to mitigate them seems irresponsible and evidence of a belief that assertion implies dismissal with no further need to investigate mitigation techniques.

A poorly managed and configured private cloud application can be quite vulnerable, and a properly managed and configured public cloud application can achieve very good security. Characterizing the situation as black and white is simplistic and does a disservice to the discussion.

 

Latest Opinions

  • Accessibility and Apple Watch apps

    MG Siegler shares his thoughts on Apple Watch "three months in." He writes:

    Steven Aquino
  • Flawsome software: Making educated platform choices

    The internecine warfare between Android and iOS continues to rage, leaving no one unscathed. This week brings another volley as researchers discovered a Major Flaw In Android Phones Would Let Hackers In With Just A Text.

    The Macalope
  • Talkler iOS app reads email aloud so you can be (nearly) hands-free

    The freemium iOS app Talkler bills itself as "email for your ears." By reading messages aloud, the app enables you to catch up on email while exercising, driving, cooking, or otherwise busy. The app works as promised, though I ran into issues with setup and voice commands.

    James A. Martin
  • Comparing Apples to lemons: Windows Phone beats Apple Watch

    As the artist formerly knowns as Prince and is possibly again known as Prince (who can keep up?) once wrote: Oh, no, let's go crazy.

    The Macalope
  • Cell phone alerts are dangerous to drivers

    I know. You've been nagged and nagged by writers, including me and my colleague, Al Sacco, to put down your phone and other devices when you're behind the wheel. But before you stop reading note this: A new study from Florida State University indicates that even putting your phone on vibrate while you drive doesn't make you all that much safer.

    Bill Snyder
All About Windows 10

The Windows 10 upgrade: Who should do it, who could wait

The day is finally here: Windows 10's launch. And if you haven't been participating in Microsoft's Windows Insider previews, you have a single, simple question: Should I upgrade to Windows 10?

Windows 10 vs. Windows 8: Performance benchmarks show a close battle for fastest

Windows 10 performance is one of the hardest things to nail down right now. Here are some initial tests.

Windows 10 installation files already sneaking onto Windows 7 and 8 PCs

Starting around midnight Eastern time on Wednesday, June 29, 2015 Windows 10 will start rolling out to Windows Insider members.

Windows 10: Fact vs. fiction

It's a few days before Windows 10 is officially slated to drop, and still, confusion abounds. Worse, many fallacies regarding Microsoft's plans around upgrades and support for Win10 remain in circulation, despite efforts to dispel them.

IT hears the siren call of free Windows 10 upgrades

Even enterprise IT professionals are taken with Microsoft's free upgrade offer to Windows 10, according to a recently-released survey by Spiceworks.

ChannelWorld Research

Why Channels Have Changed Their Go-to-Market Strategy in Six Months

According to our SOTM Mid-Year Survey, a majority of Indian channels said their top go-to-market strategy was to offer services in a recurring revenue model—not introducing new technologies, like SMAC, which was their top GTM strategy six months ago.

SOTM Mid-Year Survey 2015: Your Roadmap for the Next 6 Months

According to the survey, the next six months of the year are going to be eventful. Here are the challenges, emerging technologies and trends that will shape the rest of the year for you.

Big Data, Mobility Top Partners’ Wish List: SOTM Mid-Year Survey 2015

According to the ChannelWorld's State of the Mart Mid-Year Survey (SOTM) 2015, big data is the way to go for the enterprise channels for the second half of this year, with 34 percent partners planning to invest in it.

Private Cloud Still Remains a ‘Safe Bet’ for Partners: SOTM Survey 2015

According to the STOM 2015 survey, channel partners who are into cloud computing feel that 42 percent of their business will be generated by private cloud.

Partners Pin Hope on Government, Expects IT Spend to Grow: SOTM Mid-Year Survey 2015

According to the ChannelWorld's State of the Mart Mid-Year survey (SOTM) 2015, 30 percent of the channel partners believe that IT spend in the government sector is likely to increase in next six months.

No More Baby Steps, Partners Ready to ‘Risk’ Gambling with Disruptive Tech: SOTM Survey 2015

According to ChannelWorld’s State of the Mart Survey (SOTM) 2015, 43 percent of channel partners say their business will have a ‘high risk appetite’ in the second half of this year.

Channels’ 3 Great Expectations from Tech OEMs

Introduced as an individual category under ‘Expectations from tech OEMs’ list in SOTM Mid –Year Survey, ‘transparent deal registration’ emerged as the biggest concern for channel companies in India.

Latest Videos

Why We Believe in Servicing a Single Vertical: Satish Pendse, Highbar Technologies

The biggest pro of taking a vertical approach is that you put all your efforts into one thing and this excessive focus helps you succeed, says Satish Pendse, President, Highbar Technologies.

Fortinet Geared to Enhance Visibility: Rajesh Maurya

Fortinet will engage in intense dialogue with customers and partners through events, roadshows, POCs and various other initiatives, says Rajesh Maurya, Country Manager- India & SAARC, Fortinet

Hybrid SDN is a Big Opportunity for Channels: Subhasish Gupta, Allied Telesis

Subhasish Gupta, Country Manager India & SAARC, Allied Telesis, says hybrid SDN and surveillance solutions can open new doors for channel partners in India.

EDITOR'S PICK

The Windows 10 upgrade: Who should do it, who could wait

The day is finally here: Windows 10's launch. And if you haven't been participating in Microsoft's Windows Insider previews, you have a single, simple question: Should I upgrade to Windows 10?

Windows 10 vs. Windows 8: Performance benchmarks show a close battle for fastest

Windows 10 performance is one of the hardest things to nail down right now. Here are some initial tests.

Windows 10 installation files already sneaking onto Windows 7 and 8 PCs

Starting around midnight Eastern time on Wednesday, June 29, 2015 Windows 10 will start rolling out to Windows Insider members.

Windows 10: Fact vs. fiction

It's a few days before Windows 10 is officially slated to drop, and still, confusion abounds. Worse, many fallacies regarding Microsoft's plans around upgrades and support for Win10 remain in circulation, despite efforts to dispel them.

IT hears the siren call of free Windows 10 upgrades

Even enterprise IT professionals are taken with Microsoft's free upgrade offer to Windows 10, according to a recently-released survey by Spiceworks.

SLIDESHOWS

7 Apps By The Indian Government You Need to Use

There are over hundreds of government initiated apps for Android, Apple and Windows devices. With Narendra Modi’s Digital India initiative, the government has released several new feature-rich smartphone applications.

SOTM Mid-Year Survey 2015: Your Roadmap for the Next 6 Months

According to the survey, the next six months of the year are going to be eventful. Here are the challenges, emerging technologies and trends that will shape the rest of the year for you.

The State of the Internet

Akamai's Q1 2015 state of the internet report provides insights into key global statistics including connection speeds, broadband adoption (fixed and mobile networks), and IPv4 exhaustion and IPv6 implementation.

India Software Market on an Upswing

According to IDC, the Indian software market has witnessed consistent growth of 10 percent since the second half of 2014, showing signs of growth and revival. 

7 Jobs Technology Has Replaced

Albert Einstein said once that it has become appallingly obvious that our technology has exceeded our humanity. With every invention of technology some poor soul becomes vulnerable to losing his or her job in some corner of the world. Here are few jobs that will cease to exist soon.

India's Leading VADs

Why Channels Want to Partner With Inflow Technologies

Inflow Technologies’ tie up with 39 vendor companies, an extensive tech portfolio, and a services play, are great value propositions for enterprise channels, says its President and CEO, Byju Pillai.

iValue Creates Real Value for Channels in India

Focused on niche vendor alliances around data, network and app management backed by a robust channel ecosystem marked iValue's success in 2014. What clicked for the seven-year-old VAD?

RAH Infotech Shows Channels the Way Ahead

Mutual trust and long lasting bond with vendor companies and channel partners helps VADs to evolve and succeed in today’s aggressively competitive market. Leveraging competent channel partners and forge niche vendor alliances marks RAH Infotech’s success in 2014.

How Satcom Infotech is Adapting to New Security Landscape

As a leading value added distributor, Satcom Infotech is emerging as an end-to-end security player, helping both customers and partners grow.

How ComGuard Shields Channel Partners

As emerging technologies introduce new threats to the enterprise landscape, they are making channel partners anxious. But VADs like ComGuard are putting their worries to rest. Here's how.

Tech Chat

Collaborating To Outcome Based World: Priyadarshi Mohapatra, Avaya

Priyadarshi Mohapatra, Managing Director, India and SAARC, Avaya, on how IT is transitioning from a keep-the-lights-on role to one that enables customers to deliver results.

The Dawn of the Digital Age: Akhilesh Tuteja, KPMG

The development of digital infrastructure will be a key growth driver for technology and solution providers. 

Paradigm Shift from End-Users to User-First : Parag Arora,Citrix

Parag Arora, Area Vice President and India Head, India Sub-continent, Citrix, says new technologies will force organizations to take a user-first approach in 2015.

Mobile and Cloud Are Gamechangers of the Future: Karan Bajwa, Microsoft

Karan Bajwa, Managing Director, Microsoft India, says, in  2015, organizations will adopt a mobile-first and cloud-first strategy to get ahead of competition.

A Network for the Internet of Everything : Dinesh Malkani,Cisco

Dinesh Malkani, President, India and SAARC, Cisco, talks about IoT and the significant technology transitions in the networking world.

Moving to the Third Platform: Jaideep Mehta, IDC

Cloud and mobility are the two technologies that will fuel the rapid adoption of the third platform in India.

Envisaging a Holistic Security Strategy For 2015: Sanjay Rohatgi,Symantec

Sanjay Rohatgi, President–Sales, Symantec India, says the company has a set of holistic solutions in place to secure organizations from security threats. 

Beating the Bad Guys: Sivarama Krishnan, PwC

Organizations will need to turn inwards to establish robust information security strategies.

Building Capabilities for a Digital Tomorrow: Alok Ohrie,Dell

Alok Ohrie, President and Managing Director, Dell India, on the company’s investments to build end-to-end solutions and delivery capabilities for a digital world.

FAST TRACK

Kamtron Systems

Transitioning towards a service-oriented company will boost our growth, believes Kavita Singhal, director, Kamtron Systems.

TIM Infratech

Delivering ‘best of breed’ technologies to enterprises is key to success, says Monish Chhabria, MD, TIM Infratech

Mudra Electronics

A vendor-agnostic strategy helped us sustain business, says Bharat Shetty, CMD, Mudra Electronics.

Systematix Technologies

Our USP is a customer-friendly approach backed by services, says Akhilesh Khandelwal, Director, Systematix Technologies.

CorporateServe Solutions

Our ability to turnaround complex ERP projects in record time is what gets us customer referral, says Vinay Vohra, Founder & CEO, CorporateServe Solutions.

KernelSphere Technologies

We are emerging as an end-to-end systems integrator, says Vinod Kumar, MD, KernelSphere Technologies.

Uniware Systems

We constantly validate emerging technologies for first-mover advantage, says Vergis K.R., CEO, Uniware Systems.

Astek Networking & Solutions

An innovative approach helps us stay successful, says Ashish Agarwal, CEO, Astek Networking & Solutions.

CSM Technologies

Our approach is backed by innovation and simplicity, says Priyadarshi Nanu Pany, CEO, CSM Technologies.

SOCIAL MEDIA @ CW India
SIGNUP FOR OUR NEWSLETTER

Signup for our newsletter and get regular updates.