Practical tips for securing your cloudJames Turner, IBRS AdvisorAugust 2012

Building a smarter planet

Warning

This presentation has a lot of pictures of clouds

2

Building a smarter planet

Practical tips to securing your cloud

Defining the cloud What IBRS clients are asking &

What the experts say Four interesting areas of risk Summary A glimpse of the future Questions

3

Building a smarter planet

Defining cloud

The most widely accepted definition of cloud comes from the National Institute of Science and Technology (NIST) :

1. On demand self-service

2. Broad network access

3. Resource pooling

4. Rapid elasticity

5. Pay-per-use measured service

I’m talking about SaaS

4Morning Glory clouds – Gulf of Carpentaria. Source: NASA. Credit: Mick Petroff

Building a smarter planet

What IBRS clients are asking & what the experts say

“Review our SaaS contracts for technical risks”

– Defence Signals Directorate (DSD)•availability of data and business functionality;•protecting data from unauthorised access; and,•handling security incidents.

– Australian Government Information Management Office (AGIMO)

•Liability•Performance management•Ending the arrangement

– National Archives of Australia

5

Building a smarter planet

Four SaaS vendor contract reviews

Findings – there are 4 core areas of risk in these vendor MSAs:

1. Light on specifics

2. Heavy on indemnity

3. Default customer referencing

4. Flimsy data portability

6

Building a smarter planet

Light on specifics

Will protect customer data “in a manner consistent with general industry standards reasonably applicable”

Will use “commercially reasonable efforts to make the purchased services available 24 hours a day, 7 days a week”.

Impact: nothing to hold them to!

7 Light and wispy cirrus clouds

Building a smarter planet

Heavy on indemnity

They will not be held liable for any loss of data, or revenue, or profits.

Service credits, if available, are like eating lettuce

– You expend more energy chewing than you get from the consumption

Impact: nothing to hold them to!– (and look at how well that worked in the

software industry!)

8

Building a smarter planet

Customer reference by default

“Customer agrees to work with <vendor’s> Marketing Department to produce a news release to Customer’s use of the Service”

Risks of being outed as a customer:– “kick me”– Collateral damage– Target rich environment– Economy of effort for attackers

Impact: what has this done to your risk profile?

9

Building a smarter planet

Flimsy data portability

Only 1 of the 4 mentioned a format Proprietary data formats help create

lock-in One source of truth? Migrating to another vendor?

– Who owns the metadata?

– Can you access security logs?

Impact: Vendor lock in, paying for migration, rivals being sold your work

10 Storm front over Phillip Island, Nov 11, 2011. Source: ABC.net.au

Building a smarter planet

Conclusion: Practical tips to securing your cloud

Understand the risks– Create a list of the technical risks

– War game different scenarios, attacks, or failures

– Walk these through with business stakeholders

Contract management– involved vs. committed?

– Be biased toward vendors who commit to standards

– Note: Take-it-or-leave-it contracts are positively viewed by some

11Asperatus Cloud, New Zealand, undated photo. Source: National Geographic

Building a smarter planet

An interconnected world...

12

... leads to exponential complexity and unforeseen interdependencies!

Building a smarter planet

Questions?

13

Building a smarter planet

References

“Cloud Computing Security Considerations”, Defence Signals Directorate (Australian Department of Defence), April 2011. “Better Practice Guide: Negotiating the cloud – legal issues in cloud computing agreements”, Australian Government Information Management

Office, February 2012. “A Checklist for Records Management and the Cloud”, National Archives of Australia, 2011. IBRS research:

– "The Next Perfect IT Storm: The Red Shift, Utility Computing", IBRS, April 2008.– "Cloud computing, you may need a parachute", IBRS, April 2009.– "Legal considerations that apply in cloud computing", IBRS, May 2009.– "Cloud computing and the law - data considerations", IBRS, June 2009.– "Cloud computing and the law - business implication", IBRS, July 2009.– "A legal checklist before taking off into the cloud", IBRS, August 2009.– "APRA offers timely advice against losing your head in the cloud", IBRS, November 2010.– "Two tests to evaluate Cloud economics", IBRS, March 2011.– "A matrix for cloud computing risk analysis", IBRS, October 2011.– "Cloud security - the real risks", IBRS, January 2012.– “How do you catch a cloud and pin it down? Part 1”, IBRS, May 2012– “How do you catch a cloud and pin it down? Part 2”, IBRS, July 2012

14