Taking the Smoke out of the Cloud

What Cloud technologies promise vs. what they currently deliver

June 9, 2014

These are a series on securing cloud computing environments and a brief overview of various cloud environments their strengths and weaknesses. "The Cloud" is a marketing term that describes the current trend in web hosting, which allows a customer to configure their own network and also allows a provider or hosting company to allow multiple customers to concurrently use the same pieces of technology. This will cover how a cloud platform is defined, logically how a cloud platform is built and their advantages.

The National Institute of Science and Technology (NIST) describes cloud computing as "a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction." (NIST-800-145)

Characteristics of a cloud environment are the following: On-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Rapid deployment in a cloud platform means that creating a new server and pushing that new server into production is usually as easy as creating a file, however a specially formatted file.  That file will contain attributes of your server and will be booted and run in your network. Most cloud platforms use virtualized servers and virtualized networks to facilitate this ease of deployment. Broad Network Access means that these cloud platforms have always present network access for their service, so they are always "ON". This access is considered to be more of the service provider environment than the actual customer's cloud, but an integral part of a customer's service. Resource Pooling is allowing multiple customers to use the same hardware for their servers, same network hardware and same storage hardware, for example. This allows from a service provider perspective more customers per square foot. Resource sharing also creates new interesting security issues. Elasticity is similar to rapid deployment, only meaning new services can be deployed or expanded easily. Measured Service is where a hosting company can charge for the resource usage per customer whether that resource is network data bandwidth, server processing cycles or data storage, for example.

Finally NIST defines Service and Deployment models. I will review these to complete this introduction to cloud computing and cloud platforms, or just "The Cloud".

The most useful NIST Service models are Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). SaaS is where a process that previously was sold as a shrink wrap package can be deployed to customers as an always available cloud service. Usually a customer will access this type of software via a web browser or software client. PaaS is where a service provider gives their customer access to create and manage their own cloud services by using a preset selection of development tools, and the resulting application will reside on a cloud network and servers. IaaS is where a hosting company allows a customer to provision network equipment and servers to create a customized cloud presence, though usually virtualized. SaaS products generally reside on PaaS and PaaS generally is built upon IaaS.

There are three deployment models of interest. These deployment models are characterized by whether a cloud infrastructure is located internally (private) to a customer, externally (public) or services are run both externally and internally (hybrid).

I will continue with describing cloud technologies and information security issues.

.wdnii.

© 2014 Norris Proprietaries Inc.

Securing and Creating Chaos

Information Security and Software Engineers

July 8, 2013

As a security professional I am frequently asked “Which piece of the enterprise do you secure first?” As a developer, I am asked on a new platform “Which software do you port first?” These questions are both sides of the same coin.

In Information Security, coming into a startup whose focus is being fast, energetic and agile they look at me like alcoholics at an intervention. Like I am trying to take away their fix, their juice, their addiction. But in reality, I am trying to give them more. I just want to make sure they are drinking what they really like, so the beer drinkers get more beer, and the whiskey drinkers get more single malt. That metaphor holds.

My answer to the security question, which piece do you secure first, is also a question, “Which strand of spaghetti do you eat first when served a bowl?” Exactly, the easiest piece to come out. You look at the bowl, stick your utensil in, twist and pull. then things seem to line up, and slowly the chaos is clean.

Perhaps with Information Security there are some of the usual suspects, Identity Management, Role Assignments, Intrusion Detection, Intrusion Response, Services Protection, Information Loss Prevention to name a few. And  I find that organizations are stronger or weaker in some of these areas. Which to address first? Find which piece can be done the fastest, cheapest  and has the best return on investment. An old qualitative rule of thumb that I distill and discuss with co-workers, from engineers to the C-Levels.

As a developer on a new platform, I liken that to a new whiteboard waiting to be defaced. But the tools are easy, first an editor, to build a compiler and then I can write whatever software is needed, like a better editor. I imagine the process is like an architect, some just dump in the same foundations and build the same box in a different spot or others are artistic and the buildings seem to float.

So, with development the problem that needs to be solved is the opposite of security. With security you try to remove pieces without breaking the whole, with development you build a foundation and then the following levels, until you have a finished product.

But I find that rarely do I work on a new platform, instead I am thrust in the middle of a digital urban landscape, with various routes from where I am, to where my project needs to be. And I have to decide how to exist within the past digital environment, that others have left. Some developers don’t know how, or do not wish to learn, so they demolish and just build where they landed, and expect the corporate enterprise to come to them, others are immersed in the legacy systems and never try to build something new. But I envision the system as a whole, see the connections and move my project so I can take advantage of what exists while extending and making something more. This is how my development and security experience intertwine.

wdnii.

© 2013 Norris Proprietaries Incorporated.