cloud privacy and security (Risk Assessment)
Sangeeth08
ITC568_201860_Wk3_ThreatsAndRisks.pptxITC568 Cloud Privacy and Security
Threats and Risks
Week 3
Dr Peter White
Data centres and security models
Threats and Risks
Considerations
Agenda
© P White 2017
2
Our data and applications are stored in, and run from, data centres
Characteristics of a data centre include:
Network
Storage
Compute resources
Reliability
Maintenance
But, Yang sees the essential characteristics as:
On-demand access
Measured service
Network access
Resource pooling
Virtualization
Reliability
Maintenance
Notice how Yang’s characteristics align with the NIST Cloud characteristics?
Data Centres
Yang, Li; “Network-aware Job Placement in Data Center Environments,” University of Calgary, 2014
© P White 2017
3
Internal: a data centre run by a single enterprise for its own operations
Network – dedicated internal network, perhaps some external access available
Storage – Internal storage on SAN, NAS or similar
Compute resources – can be physical or virtualised
Reliability – multiple copies of data, backup to tape, DR plan, UPS and environment controls
Maintenance – dedicated internal IT team
Internal data centres
© P White 2017
4
Hybrid: a data centre that is split across two or more geographically diverse locations
Network – dedicated internal network, external access available, spanned between multiple DCs, more bandwidth and channels required
Storage – storage on SAN, NAS, etc, replicated between DCs, data tiering between DCs,
Compute resources – few physical, mostly virtual, spanned between DCs, some automation, some VDI infrastructure
Reliability – multiple copies of data in both DCs, data tiering backup to tape, DR plan, UPS and environment controls
Maintenance – dedicated internal IT team, external provider in remote DCs
Hybrid data centres
© P White 2017
5
External: a data centre that is run for an enterprise by an external provider
Network – dedicated internal network with external access to DC (Cloud?), more bandwidth and channels required
Storage – StaaS in external DC,
Compute resources – IaaS, PaaS, SaaS from external provider, move to VDI for users
Reliability – multiple copies of data in different locations, data tiering, backup to Cloud, DR plan
Maintenance – external provider
External data centres
© P White 2017
6
Internal
Concentric layered defence
Essentially firewall based
Hard exterior shell with trusted internal traffic
Hybrid
Concentric layered defence with VPN tunnels between DCs
Modified version of Internal
External
Shared responsibility model
Ability to deploy different security models and techniques
Scalable approach
Security models
© P White 2017
7
The Cloud Security Alliance (CSA) describe the current top threats in the Cloud ecosystem
Data breaches
Insufficient identity, credential and access management
Insecure interfaces and APIs
System vulnerabilities
Account hijacking
Malicious insiders
Advanced persistent threats
Data loss
Insufficient due diligence
Abuse of cloud services
Denial of service
Shared technology issues
Threats
© P White 2017
8
The CSA document is essential reading as it gives you:
A description of the security concern and the cloud service models it affects,
A threat analysis
Business impacts
Anecdotes and examples,
Cloud Control Matrix (CCM) control IDs to assist in applying controls
Links to further information
Download the CCM from https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3-0-1 /
© P White 2017
9
Threats
The Australian Signals Directorate (ASD) has a paper on cloud security considerations which is essential reading. It covers:
Maintaining availability & business functionality
Protecting data from unauthorised access
Handling security incidents
© P White 2017
10
Cloud Security Considerations
The ASD also put out a series of strategies to mitigate Cyber Security incidents known as the Essential Eight:
Application whitelisting
Patch applications
Disable MS Office macros
User application hardening
Restrict admin privileges
Patch operating systems
Multi-factor authentication
Daily backup of data
© P White 2017
11
Cloud Security Considerations
Johnson defined threats and vulnerabilities as follows:
Threat: Who might attack against what assets, using what resources, with what goal in mind, when/where/why, and with what probability. There might also be included some general aspect of the nature of the attack (e.g., car bombing, theft of equipment, etc.), but not details about the attack or the security measures that must be defeated and the Vulnerabilities to be exploited.
Vulnerability: a specific weakness in security (or a lack of security measures) that typically could be exploited by multiple adversaries having a range of motivations and interest in a lot of different assets.
© P White 2017
12
Threats and Vulnerabilities
Threat: Adversaries might install malware in the computers in our Personnel Department so they can steal social security numbers for purposes of identity theft.
Vulnerability: The computers in the Personnel Department do not have up to date virus definitions for their anti-malware software.
Threat: Thieves could break into our facility and steal our equipment.
Vulnerability: The lock we are using on the building doors is easy to pick or bump.
© P White 2017
13
Threats and Vulnerabilities
Taxonomy of attacks
Juliadotter & Choo’s taxonomy allow us to look at the type and breadth of attacks
The goal with such a taxonomy is to allow us to quickly determine both the type of the attack and then the appropriate countermeasures
This provides some background information that is valuable when you are initially planning your security measures
It is a bit cumbersome, in it’s present format, for use in countermeasures
These taxonomies contain valuable information for planning your security approach
© P White 2017
14
Attacks and Taxonomy
© P White 2017
15
Cloud Security challenges
Ali, M., Khan, S., & Vasilakos, A. (2015). Security in Cloud Computing: Opportunities and challenges. Information Sciences, 305(2015), 357-383
Khan’s paper also takes a taxonomic approach to attacks
Like Juliadotter & Choo, he concentrates on the technical aspects of attacks against the cloud
His tables in section 3 of his paper are also valuable sources of information on various attacks and their countermeasures.
© P White 2017
16
Cloud Security Challenges
Social engineering is defined as:
the use of social disguises, cultural ploys, and psychological tricks to get computer users to assist hackers in their illegal intrusion or use of computer systems and networks
Abraham, S., & Chengalur-Smith, I. (2010). An overview of social engineering malware: Trends, tactics, and implications. Technology in Society, 32(3), 183-196.
Social engineering is one of the strongest weapons in the armoury of hackers and malware writers, as it is much easier to trick someone into giving his or her password for a system than to spend the effort to hack into the target system
We need to recognise in our plans that social engineering of our users may defeat our technical & technological plans and countermeasures
© P White 2017
17
Social engineering
Read:
The CSA’s treacherous 12
The ASD Cloud Considerations
The ASD Essential 8
Download and read the CMM from https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3-0-1/
© P White 2017
18
Tasks
