Cloud Security: Critical Threats and Global Initiatives Jim Reavis, Executive Director July, 2010

What is Cloud Computing? Compute as a utility: third major era of computing Mainframe PC Client/Server Cloud computing: On demand model for allocation and consumption of computing Cloud enabled by Moore’s Law: Costs of compute & storage approaching zero Hyperconnectivity: Robust bandwidth from dotcom investments Service Oriented Architecture (SOA) Scale: Major providers create massive IT capabilities 2

Top Threats to Cloud Computing Cloud Security Risks / Threats Shared Technology Vulnerabilities Data Loss/Data Leakage Malicious Insiders Account Service or Hijacking of Traffic Insecure APIs Nefarious Use of Service Unknown Risk Profile 3

Shared Technology Vulnerabilities Description Exposed hardware, operating systems, middleware, application stacks and network components may posses known vulnerabilities Impact Successful exploitation could impact multiple customers Example Cloudburst - Kostya Kortchinksy (Blackhat 2009) Arbitrary code execution vulnerability identified in VMware SVGA II device, a virtualized PCI Display Adapter Vulnerable component present on VMware Workstation, VMware Player, VMware Server and VMware ESX 4

Data Loss / Data Leakage Description Data compromise due to improper access controls or weak encryption Poorly secured data is at greater risk due to the multi-tenant architecture Impact Data integrity and confidentiality Example Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds (UCSD/MIT) Research detailing techniques to ensure that images are deployed on the same physical hardware as a victim and then leveraging cross-VM attacks to identify data leakage 5

Malicious Insiders 6 Description Employees of the cloud vendor may abuse privileges to access customer data/functionality Reduced visibility into internal processes may inhibit detection of the breach Impact Data confidentiality and integrity Reputational damage Legal repercussions Example Google Investigates Insider Threat After China Hack (eWeek) “Google is investigating whether some of its own staff are behind the repeated attempts to hack into the Gmail accounts of Chinese human rights activists” 6

Interception or Hijacking of Traffic Description Intercept and/or redirect traffic destined for the clients or cloud Steal credentials to eavesdrop or manipulate account information / services Impact Confidentiality and integrity of data Damage to reputation Consequences (legal) from malicious use of resources Example Twitter DNS account compromise Zeus botnet C&Cs on compromised Amazon EC2 accounts 7

Insecure APIs 8 Description APIs designed to permit access to functionality and data may be vulnerable or improperly utilized, exposing applications to attack Impact Data confidentiality and integrity Denial of service Example P0wning the Programmable Web (Websense – AusCERT 2009_ 80% of tested applications not using available security in APIs (e.g. unencrypted traffic and basic authentication) Demonstrated CSRF, MITM and data leakage attacks 8

Nefarious Use of Service Description Attackers are drawn to the cloud for the same reasons as legitimate consumers – access to massive proceesing power at a low cost Impact Password cracking, DDoS, malware hosting, spam, C&C servers, CAPTCHA cracking, etc. Example Current search of MalwareDomainList.com for ‘amazonaws.com’ returns 21 results “In the past three years, ScanSafe has recorded 80 unique malware incidents involving amazonaws” – ScanSafe blog Amazon's EC2 Having Problems With Spam and Malware - Slashdot 9

Unknown Risk Profile Description Impact Example A lack of visibility into security controls could leave cloud consumers exposed to unnecessary risk. Impact Significant data breaches could occur, possibly without the knowledge of the cloud consumer. Example Heartland Payment Systems was “willing to do only the bare minimum and comply with state laws instead of taking the extra effort to notify every single customer, regardless of law, about whether their data [had] been stolen.” http://www.pcworld.com/article/158038/heartland_has_no_heart_for_violated_customers.html 10

How will Cloud Computing play out? Much investment in private clouds for 3-5 years Rise of mobile clouds Eventual 80/20 rule favoring public clouds Cloud assurance ecosystem being built Virtual private clouds compromise between public and private Long legacy of hybrid clouds Disruption to markets, IT, security best practices Challenges public policy and critical infrastructure

About the Cloud Security Alliance Global, not-for-profit organization 10,000+ individual members Fast growing – chapters, translations, alliances Inclusive membership, supporting broad spectrum of subject matter expertise: cloud experts, security, legal, compliance, virtualization, etc We believe Cloud Computing has a robust future, we want to make it better “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.” 12

CSA Research Projects Go to www. cloudsecurityalliance. org/Research CSA Research Projects Go to www.cloudsecurityalliance.org/Research.html for Research dashboard and Working Group signup 13

Released Research CSA Guidance for Critical areas of Focus Popular best practices V2.1 CSA Cloud Controls Matrix Security controls framework mapped to existing regulations and standards Top Threats Released 2x annually Identity & Access Management “Dom12” paper Supporting Trusted Cloud Initiative

Research & Initiatives in Progress Certificate of Cloud Security Knowledge (CCSK) Individual competency testing and certificate Trusted Cloud Initiative Interoperable IAM, reference models, cert criteria CSA Cloud Controls Matrix V2 Controls refinement, automation, increased mappings Consensus Assessments Initiative Common question sets to measure providers’ security capabilities

Research Initiatives being Scoped CloudCERT Best practices research for emergency response in Cloud Standardized processes Hosted Community Cloud Security Metrics Library of recommended measurements & surveys Cloud Security Use Cases Document real world lessons learned

Third Party Initiative Participation CloudAudit Common Assurance Maturity Model (CAMM) ENISA eGovernment Cloud-Standards.org NIST

Schedule CSA Summit at BlackHat, July 28-29, Las Vegas CSA Congress, Nov 16-17, Orlando CSA Summit at RSA 2011 (tentative), SF Participating in most major events Several chapter launch events Other Summits as research requires 18

Thank you!