ENISA – Cloud Computing
Security Strategy
Dr Steve Purser
Head of Technical Department
European Network and Information Security Agency (ENISA)
OGF28 2010
Munich March, 2010
www.enisa.europa.eu
ENISA
•
•
•
•
•
•
•
•
Created in 2004
Centre of Expertise
Supports EU institutions
Facilitator of information
exchange between EU
institutions, public sector
& private sector.
Advising and assisting
Collecting and analysing
Promoting methods
Raising awareness
www.enisa.europa.eu
2
ENISA’s Understanding of Cloud Computing
• Cloud computing is a new business model that
allows:
• Highly abstracted HW and SW resources
• Rapid scalability and flexibility
• Near instantaneous provisioning
• Shared resources (hardware, database,
memory, etc...)
• ‘Service On demand’, usually with a ‘pay as
you go’ billing system
• Programmatic management (e.g. through Web
Services API)
www.enisa.europa.eu
ENISA Cloud Computing Objectives
• Help governments and businesses to leverage the
cost benefits of cloud computing taking due
consideration of security requirements.
• Improve transparency on security practices to allow
informed decisions
• Creating trust and trustworthiness by promoting best
practice and assurance standards
www.enisa.europa.eu
4
Reaching the objectives
ENISA Deliverables and Ongoing Activities:
• Cloud Computing: Benefits, Risks and
Recommendations for Information security 2009
• Assurance framework 2009
• Research Recommendations 2009
• Gov-Cloud security and resilience analysis (2010)
• Cloud Assurance Framework (CAM) consortium
2010
• 2011 (proposed) procurement and monitoring
guidance for government cloud contracts.
www.enisa.europa.eu
5
Cloud Computing: Benefits, Risks and
Recommendations for Information security
www.enisa.europa.eu
6
Security
Benefits
www.enisa.europa.eu
7
Economies of scale
• The same amount of investment in security
may result in better protection
• Many security measures are cheaper when
implemented on a larger scale.
o
(e.g. filtering, patch management, hardening of virtual
machine instances and hypervisors, etc)
www.enisa.europa.eu
The Risks
www.enisa.europa.eu
Very high value assets
• More Data in transit (Without
encryption?)
• Management interfaces are
interesting targets for attackers.
• Trustworthiness of insiders.
• Hypervisors- hypervisor layer
attacks on virtual machines are very
attractive
www.enisa.europa.eu
Loss of Governance
• The client cedes control to the Provider on a
number of issues effecting security:
o External penetration testing may not be
permitted.
o Very limited logs available.
o Usually no forensics service offered
o No information on location/jurisdiction of data.
o Outsource or sub-contract services to thirdparties (fourth parties?)
• SLAs may not offer a commitment to provide the
above services, thus leaving a gap in security
defences.
www.enisa.europa.eu
Compliance Challenges
• Cloud Provider may not be able to provide
evidence of their own compliance to the relevant
requirements.
• Cloud Provider may not permit audit by the Cloud
Customer.
• In certain cases, using a cloud implies certain kind
of compliance cannot be achieved
www.enisa.europa.eu
Legal and contractual risks
• Data may be stored in multiple jurisdictions, some
of which may be risky.
• Lack of compliance with EU Data Protection
Directive
o
o
•
•
•
•
Potentially difficult for the customer (data controller) to
check the data handling practices of the provider
Multiple transfers of data exacerbated the problem
Subpoena and e-discovery
Confidentiality and Non-disclosure
Intellectual Property
Risk Allocation and limitation of liability
www.enisa.europa.eu
Cryptographic Key Management
• Key management is (currently) the responsibility
of the cloud customer.
• Distributed key management is difficult.
• Therefore key provisioning and storage is usually
out of band – i.e. off-cloud
• Some models, e.g. one key per account, do not
scale to multiple accounts/account holders
• Hardware security modules
implement in the cloud.
are
difficult
www.enisa.europa.eu
to
Vendor Lock in
• Few tools, procedures or standard formats for
data and service portability
• Difficult to migrate from one provider to
another, or to migrate data and services to or
from an in-house IT environment
• Potential dependency of service provision on
a particular Cloud Provider.
www.enisa.europa.eu
Resource Exhaustion
• Overbooking
• Underbooking
• Caused by
o Resource allocation algorithms
o Unpredictable peaks in legitimate demand.
o Denial of Service
www.enisa.europa.eu
Cloud Computing Information
Assurance Framework
www.enisa.europa.eu
17
Cloud Information Assurance Framework
• Aims at increasing transparency by defining a
a minimum baseline for:
• Comparing cloud offers
• Assessing the risk to go Cloud
• Reducing audit burden and security risks
www.enisa.europa.eu
Cloud Information Assurance Framework
An example
•
•
•
•
Network architecture controls
Well-defined controls are in place to mitigate DDoS (distributed denial–of-service)
attacks e.g.
o
Defence in depth (traffic throttling, packet black-holing, etc..)
o
Defences are in place against ‘internal’ (originating from the cloud providers
networks) attacks as well as external (originating from the Internet or customer
networks) attacks.
Measures are specified to isolate resource usage between accounts for virtual
machines, physical machines, network, storage (e.g., storage area networks),
management networks and management support systems, etc.
The architecture supports continued operation from the cloud when the customer is
separated from the service provider and vice versa (e.g., there is no critical
dependency on the customer LDAP system).
www.enisa.europa.eu
Framework 2010 – Cloud Assurance Metric
Provider comparison on security features
Score Provider 1
Score Provider 2
Legal and compliance
requirements
Asset Management
Personnel security
5
4.5
4
3.5
3
2.5
2
1.5
1
0.5
0
Physical and
Environmental Controls
Business Continuity
Management
Supply chain security
Operational Security
Identity and Access
Management
Data and Service
Portability
Example Provider Comparison Chart
www.enisa.europa.eu
2010 – Supporting EU
Governments in Cloud Migration
Government in the Cloud: impact on service security &
resilience
ENISA aims to:
• Analyze and evaluate the impact of cloud computing
on the resilience and security of GOV services
• Provide recommendations and good practices for
European Members State planning to migrate to
cloud computing
www.enisa.europa.eu
21
Governments and the Cloud
UK
...
DK
• Gov Agencies and Public Organizations around the globe
are moving non-critical applications towards a "cloud
approach".
• In Europe we have some fast adopters, i.e. Denmark and
UK, announcing/planning to move into the cloud.
USA
Australia
• In the short-medium term (1 to 3 years) an increasing
number of Public Organizations, in EU Member States,
will consider/adopt cloud computing.
Japan
Singapore
www.enisa.europa.eu
22
2011 procurement and monitoring guidelines
CERT, ISAC
Procurement
Criteria
Monitoring
and
Supervision
Information security procurement criteria and monitoring of government
cloud contracts.
www.enisa.europa.eu
Conclusions
• Cloud computing can represent an improvement in
security for non-critical applications and data.
• But transparency is crucial: customers must be given a
means to assess and compare provider security
practices.
• In the current state of the art, migrating critical
applications and data to the cloud is still very risky
(even private clouds)
• It is not currently clear to what extent the Cloud
Computing model can be applied to applications that
require high levels of security.
www.enisa.europa.eu
http://www.nis-summer-school.eu/
Subscribe to the NIS'10 Newsletter at
http://www.nis-summer-school.eu/
www.enisa.europa.eu