Heading To The Cloud? A Security Roadmap

November 15, 2011 Off By David
Grazed from FINalternatives.  Author:  Mary Beth Hamilton.

Cloud computing is gaining popularity within the alternative investment space as firms look to capitalize on the efficiencies, resiliency and cost advantages cloud-based services can deliver. From application hosting to delivering a firm’s complete information technology infrastructure via the cloud, this technology delivery model is here to stay…

When considering a move to the cloud, security is typically a hot topic and often a concern. In truth, a cloud infrastructure can be as secure—or insecure—as a traditional in-house infrastructure. It all comes down to the cloud architecture, security policies, management practices and the service provider’s track-record and experience. 

Understanding Threats

Let’s first look at the top threats facing infrastructure and application services as identified by the Cloud Security Alliance, a non-profit dedicated to promoting best practices for providing security assurance within cloud computing. The CSA’s key threats include:

• Shared technology considerations: Cloud computing centers on the concept of sharing underlying infrastructure components across multiple users and systems. This shared structure demands that security requirements and protocols be deeply engrained into the shared infrastructure at multiple levels (i.e., computing resources, storage, networking, etc.).  Incorporating security best practices, including those established by the CSA, is essential to eliminating vulnerabilities that could provide openings to attackers.

• Data leakage or loss:  Data leakage or loss is a real and unacceptable risk for any firm, as the impact can be significant and far-reaching. Examples of this threat include accidental deletion of data without a backup, unauthorized access to information, or the corruption of a database. Whether using a cloud-based service or traditional in-house systems, it is important to have strong access controls, data encryption and data protection processes in place.

• Risk of the unknown:  Ignorance is not bliss when it comes to the cloud and service providers. A lack of knowledge about a cloud provider’s security protocols and policies can inadvertently leave a firm to accept unknown risks. Be sure to inquire about a cloud provider’s overall security design and policies, security software, update and patch procedures, and intrusion monitoring/alerting practices.

Locking Down the Cloud

With an understanding of the threats facing cloud services and the questions to ask, you can ensure your cloud provider has the appropriate safeguards in place. Proper security in a cloud infrastructure requires specialized measures and processes at both the physical and virtualization level. Let’s take a look at these starting from the outside.

Looking Outside the Box: Physical Security

Before evaluating how a cloud service is architected, you need to ensure that the actual facility housing and delivering the cloud service is rock solid. From a physical security perspective, this means ensuring the data center has the following in place:

• 24x7x365 manned lobby that requires visual verification of visitors’ identities;
• Two-phase authentication of visitors  that includes ID card/badge and biometric;
• Secured access points including doors and elevator banks;
• Comprehensive security cameras;
• Door, motion and camera sensors;
• Visitor logs for cages, which should be periodically reviewed and cross-checked;
• and key-locked cages and cabinets.

Inside the Box: Virtualization Security

A multi-tenant architecture is a key principle in cloud environments that allows for the sharing of one or more computing resources, databases or applications across many customers. In the Infrastructure-as-a-Service model, multi-tenancy allows for customers to control processing power, networking components, operating systems, storage and deployed applications, but they do not control the underlying physical infrastructure. When an application is delivered as a service via the cloud, customers share all or part of the application, but do not control the underlying infrastructure.

Key characteristics of a secure multi-tenant environment include:

• Highly Available: The cloud provider must build the cloud environment so that both planned and unplanned downtime is virtually eliminated. This means building redundancy into every layer of the cloud infrastructure from computing resources to network to storage.   

• Secure separation: Cloud users will (and should) only use a cloud service if the provider can guarantee that one customer will not have access to another’s environment. Enter secure separation.  This design principle ensures that each customer’s silo and computing resources are completely isolated and protected from other customers.

In addition to secure separation, role-based access controls should also be implemented on storage and networking infrastructure for added security.

• Top service levels and assurance: As with an on-premise solution, in the cloud, users’ computing resources must always be available and operating at top performance levels.  Following service assurance best practices, a cloud provider can guarantee that resources, including computing, network and storage, will be available as needed to deliver top performance and accommodate fluctuations in user demands.

• Management, monitoring and control: A cloud provider must have comprehensive control and deep visibility over its cloud infrastructure to ensure the highest levels of security, performance and availability.  When considering a move to the cloud, customers should ask providers about the cloud management and monitoring practices they utilize.

The way a service provider approaches these four elements will have a direct impact on the security of the cloud environment and the user experience.  When evaluating a new service, customers should inquire about the cloud provider’s practices to each of these areas.

We’ve Got Questions (for your cloud provider)

Here is a handy list of questions to ask your cloud services provider as part of the evaluation process:

• How do you guarantee computing, network and storage resources are available for customers?
• Does the cloud environment use a multi-tenant architecture?
• Does the cloud infrastructure feature an N+1 configuration to tolerate any single equipment failure and ensure high availability?
• What security standards are used to ensure data and application integrity?
• What is the process to ensure strong authentication and access control?
• Does the cloud services provider maintain a log that captures a record of system access?
• How do you prevent a security breach and/or prohibit sharing of account credentials between users and services?
• What are your backup and retention procedures?  How long is data retained?
• What is the disaster recovery strategy, and how frequently is it tested?
• How is support handled?  What is the response commitment time on service issues?
• Are your cloud data centers SAS70 certified?