My Security Planet » Tags » Cloud and Security

4 items tagged "Cloud and Security"

Justice League

Cloud Risks When You Become A Service Provider

Posted: January 18th, 2010, 12:45pm CST by scott

Tags: Software Security Cloud Computing Cloud [edit]

The European Network and Information Security Agency (ENISA) published their analysis of security risks from cloud computing. It’s a well thought through paper and it complements the work on cloud security guidance being written by the Cloud Security Alliance. What I like about both the ENISA report and the CSA Guidance (I’m an author of one of the sections and, yes, I like my eating my own cooking) is that both documents take the point of view that Cloud Computing is going to happen and that security is going to have to deal with it.

There are certainly security risk for applications migrating to the cloud. These risks involve both security concerns such as the confidentiality of the information stored in cloud services as well the legal implications concerning the liabilty if a system is unavailable. This focus of cloud computing risks on the consumers of cloud services by both of these organizations seems justified. After all, how many companies are going to be cloud service provides?

Well, that’s what I thought.

Now, I’m thinking that if Cloud Computing really catches on (beyond everyone writing about it and attaching the word “Cloud” to any product or service that’s connected to a network) then I suspect that most “consumers” of Cloud Computing will want to be service providers too.

What caused this change in thinking was the article I read about how Larry Ellison “created” the network computer back in the 90s. The network computer really is what we call Cloud Computing today. Combine that with how SOAs evolve within an enterprise. They start as disparate web services, but then eventually the business units provide services that are their key data to the organization. With Cloud Computing it will be your business (not just your business unit) providing services (data) to other businesses.

The question is how you’re going to do that. I suspect that youll be exposing some kind of PaaS environment that your partners will write application-lettes in. These application-lettes are going to be doing the combining of data from your two systems. On which PaaS the application-lette runs is going to depend on which the amount and sensitivity of the data.

AI had a second coming in the 80s, aren’t we ready for a second coming of “The Internet is the Computer” in the 10s?

Technorati Tags: software security, cloud computing
Marketing Will Kill Federated Identity on the Web

Posted: March 18th, 2009, 10:18am CDT by scott

Tags: federated identity Cloud Software Security [edit]

Warning: a fair amount of cynicism occurs in this post.

Some of my buddies have been exchanging ideas of what keeps us interested and one friend was thinking about how he could use a user’s Facebook login on his site. This nudge along with some work I’m doing with federated identity and Amazon SSO all have brought this federated identity stuff onto the foreground thread in my brain.

It’s all very interesting stuff and I think there’s some great technology behind all of this. I’m not worried about the technology part. It’s whether the technology can ever get implemented that worries me.

Why? Well on the internet audience and the audience demographics are the currency of the realm. If there’s federated identity, then providing all of my identity information to the relying part is redundant. There’s no way marketing is going to let THEIR site be the relying party. Marketing will want THEIR site to be the IdP. That’s because they want the users to sign up and provide all of the contact and demographic information since that’s the only business model that has been proven to work last time I checked.

I can imagine a conversation going like this:

Me: We should implement federated identity so our users don’t have to log in a gazillion times.
Marketing: Good idea.
Me: Whose identity should we use? LiveID? Amazon?
Marketing: Huh? What do you mean? Ours of course. We need the user to sign up to give us their email address.
Me: Well, we can get that. It’s part of the claim that we’ll get as part of SAML.
Marketing: Sam who? When does the user give us his email?
Me: They don’t give us the email directly. They give it to the identity provider and then…
Marketing: No, no, no, no (just like your mom used to do) – this doesn’t sound like a good idea…

So maybe all we really need is an identity selector and we’ll be the digital equivalents of the janitor with the massive key ring on our belts.

Technorati Tags: federated identity, cloud
Do Cloud-based Apps Destroy Web App Security?

Posted: February 13th, 2009, 10:07am CST by scott

Tags: Cloud Computing Security Software [edit]

My colleague, Ben Walther, pointed me at this post about Cloud applications and Web-app security by Rich Mogull. The title is “How the Cloud Destroys Everything I Love (About Web App Security)”. The post talks about running Web apps on a cloud platform like EC2. I’m not sure I buy into everything they say.

First, I’m not sure what Rich means by a “Web App”. To me, the term Web App describes an n-Tier application with a browser front end and some kind of backend SQL database. There are maybe some web service calls thrown into the mix. It’s the kind of applications that everybody’s been writing for the last 10 years. So, what’s going to change if I’m running this same application architecture on infrastructure that I’m buying as a service? Sure, I have to worry about all of the inter-machine communication channels because I don’t have the nice data center supplied network security. But what else?

Now when we move to cloud-based applications (environments like AppEngine or 10gen), ones that take advantage of the highly distributed nature of the code as well as the virtual environments, then we have changed the application architecture. I buy that security for these apps changes, but it’s no longer “web app” security. In these cloud-based applications, there are some different fundamental assumptions about the architecture, like no transaction serializability. But for these legacy web apps running in a virtualized infrastructure, I’m less convinced that there is a drastic change.

There are a couple of specific points made in the article that I don’t agree with:

Secure development (somewhat) breaks because the underlying platform can’t be locked down.
Just because you can’t lock it down yourself doesn’t mean that it can’t be locked down. This seems like an argument for secure deployment breaking and not secure development. Even then, the PAAS or IAAS may actually lock the platform down better than you can. It does shift the problem from looking at technical artifacts (configuration files, patch logs, etc) to looking at legal and audit artifacts (SLAs and certifications).

Static analysis tools (mostly) break.
The contention is that there’s less code you program yourself. I don’t see this as true for IAAS platforms like EC2, how much code is provided that you really need to worry about. Besides, static tools are language based and if it’s the same language, it doesn’t really matter whether it’s running on a virtual OS or a physical one. The change that breaks static analysis is the move to dynamically typed languages.

My take is that the infrastructural changes of a cloud computing have a more drastic effect on an organization’s ability to deploy securely. Being able to develop securely is based on the application architecture. I really see these as independent levers rather than a single “cloud” lever.

Technorati Tags: Cloud Computing, Security
Security And Market Forces

Posted: March 6th, 2008, 5:04pm CST by jOHN

Tags: Software Security Software Security [edit]
Gunnar Peterson wrote an excellent post lamenting the lack of market forces in the security space.

I don’t know when we’ll see such market forces affecting companies but do agree they would have a positive impact. Certainly, I get why the security space hasn’t been subject to market forces yet though:
- People haven’t historically been ready to pay for it
- Companies haven’t entered the market with something valuable enough to invest in
First: what people are willing to pay for. Simple question: if a development team has a $10M budget, how much does it, say, spend on quality? 10-40%? OK. How much does it spend on software security?

Second: The security space, at least with respect to Software or Application Security, has indeed moved beyond its purely missionary roots: people know they face a problem. People do not, however, know what to do about it.

Lack of direction hasn’t resulted from the vendors’ failed productization of a tool set or services though. No, it’s resulted from the lack of mature solutions in the space. Penetration testing companies were gobbled up last year but my experience has been that, for the most part, customers haven’t been willing to invest in these tools far beyond their initial purchases and the smallest amount of shepherding.

In fact, most organizations I’m working with have seen either a reduction in reliance on or an outright backlash towards penetration testing. Use of static analysis tools and code review, while on the rise, has not reached ubiquity in response (We’ve yet to see what will happen in a broader context, having only completed what I consider to be the early-adopter phase).

What do we do about it? Partnering more closely with customers has been something I’ve felt very strongly about. Listening more closely to them remains crucial. Even involvement at this level can be tricky to fund at all but the most interested customers.

There’s work to do as vendors too. Because, while we’re through the missionary phase, we’re not through the education phase in security. We must spend more time helping clients understand what attainable next steps look like for them. Moreover, I think we have to work with them to solve some of the problems we’ve avoided: we need to clarify salient next steps ;-)

How are we really going to get enough security knowledge in the hands of developers to change their behavior in a sustainable way? How are we going to scale code analysis so that it has some of depth of expertise, manually applied, but all of the consistency and speed of automation?

Technorati Tags: software security

My Security Planet » Tags » Cloud and Security

Feeds

4 items tagged "Cloud and Security"

Justice League

Cloud Risks When You Become A Service Provider

Posted: January 18th, 2010, 12:45pm CST by scott

Tags: Software Security Cloud Computing Cloud [edit]

Marketing Will Kill Federated Identity on the Web

Posted: March 18th, 2009, 10:18am CDT by scott

Tags: federated identity Cloud Software Security [edit]

Do Cloud-based Apps Destroy Web App Security?

Posted: February 13th, 2009, 10:07am CST by scott

Tags: Cloud Computing Security Software [edit]

Security And Market Forces

Posted: March 6th, 2008, 5:04pm CST by jOHN

Tags: Software Security Software Security [edit]