Some raw concepts about security in the clouds, taken form a conference I attended in Washington DC

These are big picture ideas the panelist shared.

 Where the data resides?

The essence of cloud computing is Virtualization, the core of Virtualization is the hypervisor, what if it is compromised?

Cloud providers use premade OS what if the OS is tainted

 Clouds are multi tenancy systems, other customers could lead to intrusion or be the intruders.

 Who owns the data, it is not clear or at least it is not regulated

 Cloud providers work at the Petabyte level, is it possible to keep up with the traffic.

Can they properly administer the amount of images they deal with

 We need to understand that we are outsourcing security

 You are also buying cyber security operations, do they comply, do they share the protocols and policies you require about security?

 DOD is focusing in private clouds, public cloud is a bridge too far.

 DOD sees too many challenges at the operations level, remember all corporate network challenges also apply to the cloud model.

 We need a security profile on a service by service basis, there is no such thing as a global security protocol.

 Cloud providers do not provide the adequate security, they are working on it, but it proved to be very expensive.

 The infrastructure should be built around security we are not there yet.

 51% of the companies interviewed are not going to the public cloud computing model due to security concerns.

49% think the technology is immature

 Government have a lot of Cloud computing initiatives but they are not implementing yet.

 There are no standards, no compliance HIPAA SOX404, etc.

 Security is a journey not a destination

 Security is about risk management

 No one is really using the cloud, the number of users is way lower than the perception, and this is because of security concerns.

 Cloud services in collocations are more expensive in the long run than building them yourself

 DOD thinks we have 5 years to do research and to perfect the public cloud computing model, no government agency will use it before that.

 There is one exception, government and governmental agencies in general have tons of public data, public clouds are good for that purpose.

 They defined the cloud as science fiction not fantasy, when asked about the difference, they said science fiction means it is possible but in the future.

 Risk can be accepted, mitigated or transferred

 Remember the cloud is also a single point of failure

 Everything is commerce driven and they will be always security issues

 What works now in terms of security will not necessarily work on the new model, it is not about technology is about the human element, security is about the men element, security issues are human issues, they are man driven.

 A DOD problem is how to transform and secure legacy apps into virtualized web based systems.

 Public clouds need time to mature, we need time to develop new standards based on lesson learned, early adopters will become the case studies.

 DOD see information based on a need to share and not on a need to know model. Is not who owns the data but what do you do with it.

 Cloud computing is the industrialization of IT, we are putting the IT infrastructure on the Internet

 Cloud computing model

SAAS – Software as a service

PAAS – Platform as a service

IAAS – Infrastructure as a service

 Best model right now, Public data goes to the public clouds, private data goes to the private cloud

 As we create bigger systems, we create bigger targets

 Connecting systems between clouds is a major challenge due to the lack of standards

We need more expertise

 Do not open your Active Directory to the cloud!

 In the cloud there are no boundaries, no certainty where data resides, when they cross boundaries, who has access.

Your data can be stored and managed overseas

 Government expect to have an open security model by 2012

 Analyzing security in the cloud just from the data flow angle require database sizes that reach unmanageable levels

 Scaling is a big issue

 DOD proactive security approach means using modeling scenarios through simulation

 Cyber security evolve at the speed of policy and not at the speed of knowledge.

 Information assurance is a technical issue not a policy one.

 There are no defined metrics in public cloud computing, there are no standards to evaluate risk parameters

 There is no transparency no regulated security protocols, no audits.

 Governmental agencies have no idea how to address compliance

 This is a paradigm shift, the idea is to embrace the technology, but a new model needs to be developed.

This is what my field IT network engineer emailed our folks in Central America in regards to the use of Outlook as an email when using Google apps.

We realized there is no longer a good reason to keep on using it, I know his email sounds like a commercial but it is genuine.

As you know Outlook implies PST files, that need to be backed up, copied once we reformat a computer, if it grows too big becomes a problem, if they are popping and the connection is slow or get interrupted they run the risk of Outlook restarting the download process again so they get duplicate emails and well i can continue naming issues. We are going to enforce the use of the Gmail interface since there is no excuse now that the offline feature is available. Here is the email he sent. 

Hello,

 

Speaking of Outlook...the best option available would be to not use it and use instead the Google Apps web interface (start.yourdomain.com).  Google Apps provides so many options and features and is constantly getting even better-you already have shared and private contact lists, shared and private calendars, high-speed secure email, shared docs and spreadsheets, intra-office chat and video, excellent search and organize capabilities, etc. and most of this is now available on mobile devices as well, and it is all synchronized.  Google Apps gives you full and secure access to all of your emails, appointments, contacts, docs, spreadsheets, etc. from any Internet-connected computer in the world, most handheld devices as well--and you aren't tied to the computer that Outlook is installed on.  Gmail has an Offline feature now that allows you to open Google Apps, read and compose emails, check your calendar, etc. on your computer with no Internet connection, and the way that Gmail allows you to organize and search emails is also superior.