Jim Stikeleather Chief Innovation Officer November 22, 2010 Technical Exchange: Defending the Cloud in a Hostile Environment

Security Cloud Security Legacy Issues Security Technology –Point solutions, Point processes, Physicality –Standards “nice to have” –Interoperability HW/SW –Maginot Line approach Governments –Economic risk / reward balance –Jurisdictional conflict (internal and external) –Geopolitical boundaries in cyberspace Enterprise –Parochialisms – image; legal; technology; competitive –ROI – Ford Pinto Approach –Secrecy – Unsafe at any Speed (Nader) The Jungle (Sinclair) Individuals –Reasonable, rational, prudent –Consumerization of IT/ Reversing the technology innovation flow 2

Unique to Cloud The multi-tennent problem –Bad news – larger suspect list (insiders) / lowest common denominator –Good news – distributed risk on break in / more focused resources The role collapse problem –Good news – fewer points of intersection (cracks) –Bad news – loss of separation of duties Shared Technology –Good news – Focus on quality, fix once fixed everywhere –Bad news – Break once, broken everywhere Outdated compliance rules Rewriting applications – stateless / ReSTful Cloud attack factories 3

Approaches Model checking, formal methods, and software analysis detect errors and, in the case of very simple systems, rigorously verify behavior as long as the foundational assumptions are correct. Most realistic cyber systems are too complex for rigorous verification, but can benefit from non-exhaustive analysis that will find a few of the straightforward vulnerabilities. Encapsulation, sandboxing, and virtual machines provide a way to “surround” otherwise unpredictable software, hardware, and networks with software or hardware that is more trusted. A common but often ineffective example is a network firewall. Complexity science drawing on biological and other analogues is the least exploited but possibly the most promising approach. Biological metaphors are part of the cyber lexicon: virus, worm, etc. Models of complex cyber systems and their emergent behavior are needed to understand the cybersecurity problem. 4

5 Thank you Jim Stikeleather, Chief Innovation Officer