Cloud Infrastructure

Security

Presented by
Y Vijay Kumar(197)
Vivek V Reddy(195)
Vivek V Nimje(196)
Vivek Prakash(194)
Vivek Gautam(193)
 Basics of the “cloud”
• “Cloud computing” refers to the shared software and information
that users access via the web. Rather than storing information on
their own physical servers or computer hard drives, users rely on
servers that are maintained by the cloud computing software
provider (like Apple’s iCloud offering).
• Cloud computing is an umbrella that covers both the applications
that are delivered as services in a “Software as a Service” (SaaS)
model via the web and the hardware and systems software
(together known as the actual “cloud”) used to run those
applications that companies access and use online.
• There are no servers to maintain, no IT infrastructures to set up, no
upfront licensing fees, and no software programs to install and
maintain on premise.
 Not without challenges
• Cloud computing also comes with its own set of
challenges

Will I lose control over the data that was previously

housed on my internal servers and/or computer
hard drives?

Will my data be safe on the web?

What happens if there are service outages?

 Introduction
• In today’s fast-moving business environment, most
companies are striving to operate a more dynamic supply
chain to respond to rising volatility in customer demands
and market conditions. Because supply chains are
increasingly powered by information technology, flexible IT-
based solutions are an increasingly important part of a
supply chain design. Against this background, it is no
surprise that the topic of "cloud computing" is generating
intense interest.
• Cloud computing promises to enable a wide and powerful
range of capabilities; yet its potential uses are exceptionally
broad and difficult to foretell. What is certain is that—in the
years to come—it will radically reshape how computing
power is sourced and managed, how information is
controlled, and the economics of supply chain information
technology.
 Key processes best suited to cloud
computing
• Planning and Forecasting: Cloud-based tools are now available for
capturing itemized spend data, performing basic analytics,
planning manufacturing runs . Applications focused solely on retail
supply chains are also prevalent, with capabilities that include
planning and allocation, assortment and space, pricing and
promotion and forecasting.
• Logistics: Some core warehouse and transportation management
applications already are available online from cloud providers.
• Sourcing & Procurement: Cloud computing represents a great
opportunity to reduce total cost of ownership—the most
commonly cited success metric in sourcing and procurement. A key
reason is that cloud-based tools are inherently collaborative and
accessible, creating major benefits for companies that deal
routinely with thousands of suppliers.
 Why use cloud for Logistics ?
SME dominated industry
 Limited or no IT-competence and/or investment
Specialization ( 3PL 4PL)
 Need to focus on business competence (rather than IT)
Need for individualized solutions (process) on-the-
fly
 Time to build (12-18 months) is too long
 Refresh time (3-5 years) too short for strategic investments
Serve more customers
 Without the up-front investments in IT
 IT Infrastructure - Challenges
• To achieve and maintain a competitive
advantage, enterprises today must be
innovative while carefully controlling costs
• Technology is a key enabler of innovation, but
it can also drive up costs if not well managed.
 Cloud Deployment - Solution
• A cloud-based quick start for rapid-
deployment solutions supports fast innovation
adoption at a reduced cost to better align IT
practices
• Use Rapid Deployment solutions that have
been preassembled for your environment.
 A Massive Concentration of
Resources
• Also a massive concentration of risk
– expected loss from a single breach can be
significantly larger
– concentration of “users” represents a
concentration of threats
• “Ultimately, you can outsource responsibility but
you can’t outsource accountability.”
 Cloud Models
• Delivery Models
– SaaS
– PaaS
– IaaS
• Deployment Models
– Private cloud
– Community cloud
– Public cloud
– Hybrid cloud
Delivery Models
 Infrastructure as Service (IaaS)
• Provides virtual machines and other abstracted
hardware and operating systems which may be
controlled through a service Application
Programming Interface (API).
• Clients have control over memory, CPU, IP
addresses, operating systems, storage, deployed
applications.
• Clients do not manage or control the underlying
cloud infrastructure.
• Example of IaaS providers are Amazon EC2 and
S3, Sun Microsystems and Dropbox .
 Platform as a Service (PaaS)
• Allows customers to develop new applications using APIs,
implemented and operated remotely.
• The platforms offered include development tools,
configuration management and deployment platforms.
• Provider facilitates the clients with the programming
language platforms and software such as but not limited to
Java, Python or .Net
• Clients have control over the deployed applications and
possibly application hosting environment configurations.
• clients don’t have control over the underlying cloud
infrastructure including network, servers, operating
systems or storage
• Example of PaaS providers are Google App Engine,
Force.com, and Microsoft Azure
 Software as a Service (SaaS)
• It is software offered by a third party provider,
available on demand, usually through a Web
browser, operating in a remote manner.
• Examples include online word processing and
spreadsheet tools, CRM services and Web
content delivery services.
• Clients are not required to manage or control the
underlying cloud infrastructure including
network, servers, operating systems or storage
• SaaS is provided by several vendors such as Zoho
Suite, Apple’s MobileMe and Google Docs
 Delivery Models

While cloud-based software services are maturing,

Cloud platform and infrastructure offering are still in their early stages !

15 From [6] Cloud Security and Privacy by Mather and Kumaraswamy

 Impact of cloud computing on the
governance structure of IT organizations

16
From [6] Cloud Security and Privacy by Mather and Kumaraswamy
Cloud Deployment Models
 Public Cloud
• The cloud infrastructure is made available to the general
public or large industry group and is owned by an
organization selling cloud services.
• Public cloud provides an elastic, cost-effective way to
deploy IT solutions.
• Public cloud involves applications such as customer
relationship management (CRM), messaging and office
productivity
• The main risk associated with the public cloud option is
workload segmentation. An organization opting for the
public cloud model is placing their data in the hands of a
third party. Because of that, the organization needs
assurances its workload is separated from that of other
customers.
 Private Cloud
• The cloud infrastructure is operated entirely for a single
organization.
• It may be managed by the organization or a third party,
and may exist on-premises or off-premises.
• In private cloud there are no additional security
regulations, legal requirements or bandwidth
limitations that can be present in a public cloud
environment.
• The clients have optimized control of the infrastructure
and improved security.
• The main risk associated with private cloud is exposing
sensitive information to internet or unwanted access.
 Community Cloud
• The cloud infrastructure is shared by several
organizations and supports a specific community.
• It may be managed by the organizations or a third
party, and may exist on-premises or off-premises.
• Community cloud offers higher level of privacy,
security and policy compliances.
• Examples of community clouds include Google’s
“Gov Cloud”.
 Hybrid Cloud
• The cloud infrastructure is a composition of two
ormore clouds (private, community or public)
that are bound together by standardized or
proprietary technology that enables portability of
data and application.
• Organizations may host critical applications on
private clouds and applications with relatively
less security concerns on the public cloud.
• The main risk associated is with data
communication. A secure channel has to be
ensured between the private and public clouds.
Hybrid cloud
 Problems
• Abuse and Unallowed Use of Cloud Computing
• Insecure Application Programming Interfaces
• Malicious Insiders
• Shared Technology Vulnerabilities
• Data Loss and Leakage
• Account, Service and Traffic Hijacking
• Unknown Risk Profile.
 Auditing, monitoring and risk
management
• How can organizations provide assurance to
relevant stakeholders that privacy requirements
are met when their PII is in the cloud?
• Are they regularly audited?
• What happens in the event of an incident?
• If business-critical processes are migrated to a
cloud computing model, internal security
processes need to evolve to allow multiple cloud
providers to participate in those processes, as
needed.
24 From [6] Cloud Security and Privacy by Mather and Kumaraswamy
 Common Risks
• The cloud provider takes responsibility for information
handling which is a critical part of the business. Failure to
perform to agreed service levels can impact not only
confidentiality but also availability.
• The dynamic nature of cloud computing may result in
confusion as to where information actually resides. This
may create delays when information retrieval is required.
• Third-party access to sensitive information creates a risk
of compromise to confidential information. This can pose
a significant threat to ensuring the protection of
intellectual property and trade secrets.
 Common Risks
• Due to the dynamic nature of the cloud, information may
not be located in the event of a disaster immediately.
Business continuity and disaster recovery plans must be
well documented and tested. Recovery time objectives
should be stated in the contract.
• Transparency - Service providers must provide for the
existence of effective and robust security controls, assuring
customers that their information is properly secured
against unauthorized access, change
• Privacy – Privacy controls should demonstrate their ability
to prevent, detect and react to breaches in a proper
manner. Information and reporting communication lines
need to be organized and agreed before service
provisioning starts. These communication channels should
be tested periodically during operations.
 Common Risks
• Compliance - Most organizations must comply with a wide
set of laws, regulations and standards. There are concerns
with cloud computing that data may not be stored in one
place and may not be easily retrievable. Audits completed
by legal, standard and regulatory authorities demonstrate
that there can be plenty of problems. When using cloud
services there is no guarantee that a certain company can
get its information when needed, and even some providers
are reserving the right to withhold information from
authorities.
• Transborder information flow - When information can be
stored anywhere in the cloud, the physical location of the
information can become an issue. Physical location rules
jurisdiction and legal obligation. Country laws governing
personally identifiable information may vary significantly.
Cloud Computing: who should use it?

• Cloud computing definitely makes sense if your own security is weak,

missing features, or below average.
• Ultimately, if
– the cloud provider’s security people are “better” than yours (and
leveraged at least as efficiently),
– the web-services interfaces don’t introduce too many new
vulnerabilities, and
– the cloud provider aims at least as high as you do, at security
goals,
then cloud computing has better security.
Cloud Security Principles
 Cloud Security –Responsibility

The following figure below highlights the layers,

within a cloud service, that are secured by the
provider versus the customer.
 Cloud Security Threats and Mitigation
Public/Hybrid Cloud -Threats Private Cloud -Threats Mitigation

IaaS · OWASP Top 10 · OWASP Top 10 · Testing apps and API for OWASP
· Data leakage (inadequate ACL) · Data theft (insiders) Top 10 vulnerabilities
· Privilege escalation via management console · Privilege escalation via · Hardening of VM image
misconfiguration management console · Security controls including
· Exploiting VM weakness misconfiguration encryption, multi-factor
· DoS attack via API authentication, fine granular
· Weak protection of privileged keys authorization, logging
· VM Isolation failure · Security automation - Automatic
provisioning of firewall policies,
privileged accounts, DNS,
application identity (see patterns
below)

PaaS [In addition to the above] [In addition to the above]

· Privilege escalation via API · Privilege escalation via
· Authorization weakness in platform services such as API
Message Queue, NoSQL, Blob services
· Vulnerabilities in the run time engine resulting in
tenant isolation failure
 Cloud Security Principles

A business-application cloud service

is secure if (and only if) it meets your
requirements in the following key
areas
 Key Areas
• Hardening
• Identity and Access Management
• Auditing
• Testing
• Compliance
• Privacy
• Education
 Hardening
• Depends on not only the integrity of the application
itself but also all the software and hardware that
supports it.
• The latest security patches have been applied and
that there are no viruses, malware, or unknown
software lurking in your storage management,
operating systems, databases, or middleware. If the
application, right down to the network, is not
hardened, then all bets are off.
 Identity and Access Management
• The implementation of any security policy is
dependent upon knowing the identity of an
individual.
• Your requirements for identity and access
management must start from the mobile device and
extend through the application into the supporting
software, hardware, data center, and networks.
• There are operations-management cloud services
such as Okta and TrendMicro that will do this for you.
 Auditing
• A key principle in building a secure system, auditing
records all the changes that happen to an application
and the underlying technology.
• Intrusion-detection solutions from such providers as
Hewlitt-Packard and Raytheon use real-time auditing
to sound the alarm when a breach occurs.
• New Securities and Exchange Commission rules
concerning cybersecurity-risk disclosures make
auditing even more critica
 Testing
• There’s a wide variety of tests that can be run to
determine whether the security of an application
and its underlying technology can be compromised.
• This class of operations-management cloud services
is available from a number of companies, including
McAfee, Perfecto, SecNap, and WhiteHat.
 Compliance
Two of the more well-known compliance standards are
PCI DSS and HIPAA. (Payment Card Industry Data Security
Standards, Health Insurance Portability and accountability act)
• PCI DSS provides guidance for the credit-card
industry as to a minimum required set of security
controls.
• Under HIPAA, the federal government developed
privacy principles and security guidelines for health-
care patients, health-care organizations, and service
providers.
 Privacy
• Privacy entails the ability of individuals or
groups to control information about identity
and behaviour and thereby reveal it
selectively.
• Clearly, any consumer-facing application must
be able to both protect the privacy of personal
information and offer the individual choice
over its use.
 Education
• The final pillar is education.
• Since the days of the Great Wall, the individual is the
weakest point in any security system.
• Clicking on e-mails or links that you shouldn’t, putting
your passwords on sticky notes, giving up control of
your PC to someone who sounds important.
• The only way to prevent these dangerous practices is
by training; by education.
• So whether it’s your own staff or the personnel of your
cloud service provider, make sure they’re educated
about security
Infrastructure Security Risks
 Basic Public IaaS Structure

Compute Storage Network

Proce Mem Intern Public

Volume Object VPC
ssor ory al Ip’s

Management, Web Interface, API’s

How IaaS works
 IaaS vs SaaS

Source: Gartner Research

Infrastructure Security – The Network Level

Ensuring confidentiality
Ensuring proper access
organization’s data-in-
control of resources
transit to and from a
used at public cloud
public cloud provider
service by provider

Ensuring availability of
Replacing the
internet-facing
established model of
resources in a public
network zones and tiers
cloud that are used by
with domains
an organization
 Infrastructure Security – The Host Level

• When reviewing host security and assessing

risks, the context of cloud services delivery
models and deployment models public,
private, and hybrid) should be considered

• Eg. For SaaS and Paas

Cloud Service
Customer Host Security Responsibilities
Provider
Infrastructure Security – The Application Level

 Application-level security threats;

• DoS
• EDoS(Economic Denial of Sustainability)
– An attack against the billing model that underlies the cost of
providing a service with the goal of bankrupting the service
itself.
• End user security
• Who is responsible for Web application security in the
cloud?
• xaaS application security
• Customer-deployed application security
• Customer-deployed application security
Measures to improve security
 Possible Solutions
• Minimize Lack of Trust
• Minimize Loss of Control
• Minimize Multi-tenancy
 Minimize lack of trust
• Consumers have specific security needs but don’t
have a say-so in how they are handled

• Standard language to convey one’s policies and

expectations
– Agreed upon and upheld by both parties
– Standard language for representing SLAs
– Can be used in a intra-cloud environment to realize
overarching security posture

• Certification and Risk Measurement

 Minimize lack of control
• MONITORING
- UTILIZING DIFFERENT CLOUDS
- ACCESS CONTROL MANAGEMENT
- IDENTITY MANAGEMENT (IDM)
 Monitoring
• Requires an application-specific run-time monitoring and
management tool for the consumer
– The cloud consumer and cloud provider have different views of
the system
– Enable both the provider and tenants to monitor the
components in the cloud that are under their control
• Provide mechanisms that enable the provider to act on attacks he
can handle.
– infrastructure remapping (create new or move existing fault domains)
– shutting down offending components or targets (and assisting tenants
with porting if necessary
– Repairs
• Provide mechanisms that enable the consumer to act on attacks
that he can handle (application-level monitoring).
– RAdAC (Risk-adaptable Access Control)
– VM porting with remote attestation of target physical host
– Provide ability to move the user’s application to another cloud
 Access Control
• Many possible layers of access control
– E.g. access to the cloud, access to servers, access to services, access to
databases (direct and queries via web services), access to VMs, and
access to objects within a VM
– Depending on the deployment model used, some of these will be
controlled by the provider and others by the consumer
• Regardless of deployment model, provider
needs to manage the user authentication and
access control procedures (to the cloud)
– Federated Identity Management: access control management burden
still lies with the provider
– Requires user to place a large amount of trust on the provider in terms
of security, management, and maintenance of access control policies.
This can be burdensome when numerous users from different
organizations with different access control policies, are involved
 Access Control

Cloud Provider in Domain A Cloud Consumer in Domain B

1. Authn request
3. Resource request (XACML Request) + SAML assertion IDP
2. SAML Assertion

PEP 4. Redirect to domain of resource owner 5. Retrieve policy

. (intercepts all
resource
for specified resource
PDP
resources

. access requests
from all client 7. Send signed and encrypted ticket
for cloud
resource
ACM
. domains) on Domain A
(XACML
policies)

6. Determine whether user can access

specified resource
7. Create ticket for grant/deny
8. Decrypt and verify signature
9. Retrieve capability from ticket
10. Grant or deny access based on capability
 Identity Management

User on Amazon
Cloud
1. Name
2. E-mail
3. Password
4. Billing Address 1. Name
5. Shipping Address 2. Billing Address
6. Credit Card 3. Credit Card
1. Name
2. E-mail
3. Password
4. Billing Address
5. Shipping Address
6. Credit Card
1. Name
2. E-mail
3. Shipping Address

1. Name
2. E-mail
3. Shipping Address
 Minimize Multi-tenancy
– Increase isolation between tenants
• Strong isolation techniques (VPC to some degree)
• QoS requirements need to be met
• Policy specification

– Increase trust in the tenants

• Use SLAs to enforce trusted behavior
 Conclusion
• The cloud is a major challenge in how computing resources will be
utilized since aim of the cloud computing is to change the
economics of the data centre, but before sensitive and regulated
data move into the public cloud.
• Issues of security standards and compatibility must be addressed
including
• strong authentication,
• delegated authorization,
• key management for encrypted data,
• data loss protections and regulatory reporting
• All are elements of a secure identity, information and
infrastructure model and can be applied to private and public
clouds as well as to IAAS, PAAS and SAAS services .In the
development of public and private clouds the service providers will
need to use these guiding principles to adopt and extend security
tools and secure products to build and offer end-to-end
trustworthy cloud computing and services.
Maat International Cloud Services offering is based on an “end to end”
Cloud Infrastructure and Value Added Services under the brand
“ennCloud”.
Glimp Platform Services is a Cloud enabled Solution that support the Containerization
-Intermodal freight transport using standard intermodal containers as prescribed by
the International Organization for Standardization (ISO), planes, ships, railroad cars,
and trucks.

GLIMP provides corporate and end- users with the specific data, security,
alerts and reporting capability for exception management, audit and
analytics information, and operating system integration (ERP, TOS, TMS)
 Cloud Computing, Logistics & Supply Chains
Intra-company (fleet management)
• Web Services implement the abstraction of physical devices (temperature,
pressure, position) placed on the container of dangerous goods (and not on
the truck)
• Web services as resources that provide information on the status of the
container
Inter-company
• Interoperable exchange of data among companies and risk management
agency
• Web services for seamless integration of Enterprise Information Systems
• Better coordination among companies
 Joint and efficient schedule of routes
 Provide updated information to customers
• Better coordination with goods and risk managers
 Centralized (inter-company) monitoring systems
 Timely detection of emergencies
 Easier collection of information about damaged containers and detection of
accidents
 Glimp Platform Services is a Cloud enabled Solution that support the Containerization -
Intermodal freight transport using standard intermodal containers as prescribed by the
International Organization for Standardization (ISO), planes, ships, railroad cars, and trucks.
Thank You