DAT605 Web & Cloud Computing

Cloud computing is the concept of providing services over the Internet whereby shared resources (infrastructure and platform), software and information are provided to users on demand.

There are 5 characteristics;

• 1) Broad network access
• 2) Rapid elasticity (scalability)
• 3) Measured services (pay as you go)
• 4) On-Demand self-service
• 5) Resource pooling

National Institute of Standard and Technology

"Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.  This cloud model is composed of five essential characteristics, three services models, and four deployment models."

5 characteristics are outlined;

• 1) Broad network access
• 2) Rapid elasticity (scalability)
• 3) Measured services (pay as you go)
• 4) On-Demand self-service
• 5) Resource pooling

3 service models are outlined;

• 1) (Exploiting) Software as a Service (SaaS)
• 2) (Delivering) Platform as a Service (Paas)
• 3) (Deploying) Infrastructure as a Service (IaaS)

4 Cloud Service Delivery Models

PPHC

• 1) Public Cloud
• 2) Private Cloud
• 3) Hybrid Cloud
• 4) Community Cloud

"Capabilities are available over the network and accessed through standard mechanism that promote use by heterogenous thin or thick client platforms (e.g., mobile phones, tablets, laptops and workstations)."   This is important for anytime/any device access.

"Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand.  To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity of time."  Scale up, scale out, easy up, easy down, easy in and easy out.

Scale up, scale out, easy up, easy down, easy in and easy out.

Rapid elasticity is important to compensate for;

• 1) Peaks due to periodic increased demand
• 2) IT complexity and poor capacity planning
• 3) Installed capacity is wasted when not being used, but lack of sufficient capacity at key moments could discourage or kill business
• 4) Without rapid elasticity innovation can be discouraged until a time when installed capacity can be upgraded
• 5) Sudden and unexpected demand can discourage end-users or sales if it is not possible to gain access to a site due to sudden and unexpected demand

• 1) Successful services need to grow/scale
• 2) Keeping up with growth is a large IT challenge with local dedicated server farms
• 3) Deployment of local resources requires complex lead time
• 4) Capital is necessary for software development and/or expanding data centers
• 5) Scaling lags can stunt growth at key critical moments

• 1) Cloud systems automatically control and optimize resource use
• 2) Resource use is leveraged allowing a metering capability at some level of abstraction
• 3) Resource use can be monitored, controlled and reported providing transparency for both the provider and the consumer of the utilized service

A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

• 1) The providers computing resources are pooled to serve multiple consumers using a multi-tenant model
• 2) Different physical and virtual resources are dynamically assigned and reassigned according to consumer demand
• 3) There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction
• 4) Examples of resources include; storage, processing, memory and network bandwidth

• *  A single instance of a software is designed to virtually partition its resources to run on a server, serving multiple clients as opposed to multi-instance architectures where separate software instances (or hardware systems) operate on behalf of different clients.
• *  Each client works with a customized virtual application.
• *  The ability to isolate customer-specific traffic, data and configuration of resources using the same software and interfaces.

• 1) Lower upfront costs
• 2) Agility
• 3) Scalability and Elasticity
• 4) Reliability
• 5) Performance that is automatically adjusted for need
• 6) Ease of maintenance
• 7) Security and compliance

• 1) Application Layer
• 2) Infrastructure Layer
• 3) Operating System Layer
• 4) Virtualization Layer
• 5) Physical Servers
• 6) Networking and Storage
• 7) Mechanical and Electrical

• IaaS = Upper Tier
• PaaS = Middle Tier
• SaaS = Lower Tier

SPI = SaaS, PaaS, IaaS

• IaaS = Upper Tier
• PaaS = Middle Tier
• SaaS = Lower Tier

SPI = SaaS, PaaS, IaaS

IaaS = Infrastructure as a Service

Customers pay for the usage of processing, storage, network bandwidth and other IT resources.

SaaS = Software as a Service

Customer uses a service providers application over a network.  Companies host applications in the cloud that many users access through Internet connections.  The service being sold is offered as a complete end-user application.

PaaS = Platform as a Service

Developers can design, build, and test applications that run on the cloud providers infrastructure and then deliver those applications to end-users from the providers servers.

SaaS = Software as a Product

Dropbox runs on Amazon S3 which is a IaaS.

IaaS = Infrastructure as a Service

IaaS = Infrastructure as a Service

PaaS = Platform as a Service

PaaS = Platform as a Service

IaaS = Infrastructure as a Service

IaaS = Infrastructure as a Service

PaaS = Platform as a Service

SaaS = Software as a Product

SaaS = Software as a Product

SaaS = Software as a Product

• MS Outlook
• Google Docs
• MS 365
• Salesforce
• Dropbox
• Quickbooks Online
• Expensify
• Netdocuments
• Zoho

• MS SQL Server
• Java
• Microsoft.net

• Xen
• MS Hyper-V
• KVM

No.  Virtualization is not synonymous with cloud computing and not required when building a cloud environment but it is used in a majority of cloud implementation.  Virtualization can increase the ability to deliver the characteristics required in a cloud environment.  Virtualization enables resource pooling and shared storage.

• Type-1: Bare Metal
• Type-2: Hosted

Type-1:  Sits directly on top of the bare-bone hardware.  It acts as it's own operating system and has complete control over the hardware.  It doesn't have to fight the OS and it allows more efficient use of physical resources.

Type-2: Sits on top of another operating system which controls access to hardware resources and acts as a control system between the host OS and the guest OS.  Is installed, for example, on your regular desktop (an advantage) and avoids duplicate code since there is no need to code a process scheduler or memory management system since the OS already does that.  It can run native processes alongside virtual machines (VMs).

A) Public

True

A. SAAS 

C. IAAS

False.  The terms "Parallel Computing" and "Distributed Computing" have a lot of overlap and no clear distinction exists between them.  Parallel computing may be seen as a particularly tightly-coupled form of distributed computing and distributed computing may be seen as a loosely-coupled form of parallel computing.

Public Cloud

Private Cloud

Community Cloud

Hybrid Cloud

Any combination of two or more delivery models; Private, Community or Public clouds.

Any time, Any where, Any device

• Scale up, scale out
• Easy up, easy down
• Easy in, easy out

Multi-Tenant

Measured Services

True

True

True

2) Computer Hardware, network, internet connectivity, virtualization environment.  

False

True

True

IaaS is also known as the "IT Layer".

False.  With multi-tenancy and virtual instances, system density is increased.

True

False    Type 1 Hypervisor, also known as "bare metal" sits on top of the hardware and therefore makes direct and better use of system resources than Type 2 since Type 2 sits on top of the operating system.

False  Type-2: (Hosted) Sits on top of another operating system which controls access to hardware resources and acts as a control system between the host OS and the guest OS. Since it has to go through the OS to access hardware resources, it has indirect access and control.

True.   AWS and Windows Azure are examples of Public Clouds.  A hybrid cloud is any combination of the 3 other deployment models; Public, Private or Community clouds.

A) SaaS    The Software as a Service model includes the application layer meaning that the subscriber does not need to provide their own applications.  Outlook.com was given as an example of this.  Outlook is a proprietary application that is already installed in the cloud service.  Googles Docs and Dropbox are other examples.  You do not upload applications to use them although you could use them to distribute applications to other subscribers.

• • A single instance of a software is designed virtually partition its resources to run on a server, serving multiple clients as opposed to multi-instance architectures where separate software instances (or hardware systems) operate on behalf of different clients. 
• • Each client works with a customized virtual application. 
• • “The ability to isolate customer-specific traffic, data, and configuration of resources using the same software and interfaces. “

• • Lower upfront cost; Staff, Training, Hardware, Space, license 
• • Agility 
• • Scalability and elasticity 
• • Reliability 
• • Performance (automatically adjusted to provide more capacity if falls below a certain level) 
• • Ease of maintenance 
• • Security and compliance 
• • All you need is an Internet connection
• • Quicker implementations and deployment
• • Easily expand
• • Easy customization
• • Painless Upgrades

• •Ambiguity/lack of understanding 
• •Concerns over maturity (does not meet needs, does not offer the right level of services and support, etc.) 
• •Not robust enough 
• •SLAs (many cloud providers cannot provide truly substantive SLAs, SLAs are not suitable, etc.) 
• •Integration between on premise and cloud-based systems (application and data integration) 
• •Security 
• –Multi-tenancy 
• •Ownership of data 
• –Data reside on cloud-based system 
• –what happens if the service provider goes out of business? 
• •The ability to perform audit (do you have direct access to the systems and applications?) 
• •Privacy, legal, and compliance 
• –Cloud provider has direct access to your data 
• –Located in U.S. but cloud providers in Europe. Which regulations/laws apply? 
• •Lack of customization 
• •Compatibility issues 
• •Corporate policies need to be changed

• 1. Broad Network Access - Any time, Anywhere, Any Device. Access is available 24 hours a day, globally and from laptops, tablets, mobile devices or workstations.
• 2. Rapid Elasticity - Scalable instantly; scale up, scale out, easy up, easy down, easy in, easy out. As a companies needs expand or contract the cloud service adapts instantly to meet those needs.
• 3. Measured Service - Pay as you go. Instead of paying for a 24-hour service that is under utilized, companies pay for only what they use as in the example of electrical suppliers and transparency is included to understand usage billing.
• 4. On-Demand Self-Service - Services can be increased or decreased as customer demands change. Services can be expanded or contracted as needed by the subscriber.
• 5. Resource Pooling - Allows for multi-tenant service so that system resources can be immediately allocated and moved from tenant to tenant as demands change for each tenant. Processing power, network activity and storage capability can be instantly increased across multiple hardware resources for each tenant depending on their needs at any given moment.

Computer security refers to the methods used to ensure a system is secure, including both hardware and software.  Includes authentication, access control and network security.

Information security focuses on the data stored on computer hardware and in software rather then the hardware and software itself.

The availability of the systems and information when needed.

Spoofing makes data look like it is coming from a different source than where you think.  Destination and source IPs are included in packets however source information can be altered.  Also known as 'IP Spoofing' and 'Email spoofing'.

Attacker intercepts communication and views or modifies it before sending it on to it's destination.

A replay attack is when an attacker captures a transaction and retransmits it.  According to Microsoft, "A replay attack occurs when an attacker copies a stream of messages between two parties and replays the stream to one or more of the parties. Unless mitigated, the computers subject to the attack process the stream as legitimate messages, resulting in a range of bad consequences, such as redundant orders of an item."

Session hijacking attacks are attacks on encryption.  Weak or poor keys are intercepted and the attacker seizes and takes control of a session by using an exhaustive search of key space.  Key length becomes important as longer keys take longer to hack.

• 1) Poor password choices, easy to guess
• 2) Dictionary attack where scripts try combinations of words and numbers in order to find the right password
• 3) Brute-Force attack:  a simple brute-force attack may have a dictionary of all words or commonly used passwords and cycle through those words until it gains access to the account. A more complex brute-force attack involves trying every key combination in an effort to find the correct password that will unlock the encryption. Due to the number of possible combinations of letters, numbers, and symbols, a brute force attack can take a long time to complete. The higher the type of encryption used (64-bit, 128-bit or 256-bit encryption), the longer it can take.
• 4) Birthday attacks:  Among a group of 23 people, the probability that 2 people having the same birthday is about 50%; the same for a password.  With a list of known passwords they test other accounts for access.

D) The computers subject to the attack process the stream as legitimate messages, resulting in a range of bad consequences, such as redundant orders of an item.

C) Weak or poor keys are intercepted and the attacker seizes and takes control by using an exhaustive search of key space.  Key length becomes important as longer keys take longer to hack.

A) Sniffing

B) Logic bombs

D) Software exploitation;

• •Taking advantages of bugs, design flaws, special features (e.g., debugging features)
• •Example: buffer overflow –a program is provided with more input data than designed to handle. If not checked, the extra characters will fill memory and overwriting portions of program
• –System crashing
• –Commands supplied by attackers will be executed

A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application, such as the entering of a password or login. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.

D) Software exploitation

• •Taking advantages of bugs, design flaws, special features (e.g., debugging features)
• •Example: buffer overflow –a program is provided with more input data than designed to handle. If not checked, the extra characters will fill memory and overwriting portions of program
• –System crashing
• –Commands supplied by attackers will be executed

A) Social engineering

• •Lies and misrepresentation to trick someone to give away sensitive information
• –Pretending to be someone else

C) Mobile code

Owner.    An owner is required for accountability, to ensure appropriate protection is maintained and is not personally responsible for implementing these security measures, only insuring that protection is maintained.

• •Everyone who uses information technology is responsible for maintaining the security and confidentiality of information resources and must comply with security policies and procedures
• –Chief information security officer (CISO), information resources manager, information resources security officer, owners of information resources, custodians of information resources, technical managers (network

• •Confidentiality
• –ensure only those individuals who have authority to view a piece of information may do so
• –Prevent unauthorized disclosure of sensitive information
• •Integrity:
• –only authorized individuals can create or change information
• –keep data pure and trustworthy by protecting system data from intentional and accidental changes
• –the message received is the message sent and the message is not intentionally or unintentionally altered
• •Availability: system and data are available when needed by authorized individuals.

• Accountability/Auditing
• Assurance
• Availability
• Authentication
• Authorization

D) Assurance

E) Authorization

A) Availability

B) Authentication

• 1) Confidentiality
• 2) Integrity
• 3) Availability
• 4) Authorization and Authentication
• 5) Non-repudiation

–Non-repudiation of origin: provides the data sender with proof of delivery and it ensures the sender’s identity to the recipient. Neither party can later deny that the data was legitimately sent and received.  Commonly done with keys and also known as e-signing.

• D)    #1 There Is No Such Thing as Absolute Security
• •Given enough time, tools, skills, and inclination, a hacker can break through any security measure

D) The weaknesses of one security layer are offset by the strengths of two or more layers

–Security implemented in overlapping layers that provide the three elements needed to secure assets: prevention, detection, and response

12

The 5 A's;

• •Accountability/Auditing: the ability to trace actions to their sources
• •Assurance: processes, policies, and controls used to develop confidence that security measures are working as intended
• •Availability: system and data are available when needed by authorized individuals
• •Authentication: you are who you claim to be
• •Authorization: granting users and systems a predetermined level of access to computer/information resources

#2 -Three Security Goals (The "CIA" of Security)

Confidentiality, Integrity and Availability

• • Protect the confidentiality of data
• – ensure only those individuals who have authority to view a piece of information may do so.

• •Promote the availability of data for authorized use
• –system and data are available when needed by authorized individuals (network and system reliability and stability)

• •Preserve the integrity of data
• –keep data pure and trustworthy by protecting system data from intentional and accidental changes
• –the message received is the message sent and the message is not intentionally or unintentionally altered

• • Protect the confidentiality of data
• – ensure only those individuals who have authority to view a piece of information may do so.

Functional and Assurance Requirements

Functional requirements –Describe what a system should do

Assurance requirements –Describe how functional requirements should be implemented and tested

• Security Principle #6 Security Through Obscurity Is Not an Answer.
• – Although this seems logical, it’s actually untrue
• • Obscuring security leads to a false sense of security, which is often more dangerous than not addressing security at all

• Security Principles #8 –The Operation Model of Security
• •Security measures used to focus only on prevention: if we prevented someone from gaining access to computer systems and networks, then we assume that we have obtained security
• •Protection = Prevention was the model
• •However, no matter how well we seem to do in prevention technology, someone always finds a way to break in
• •Therefore, Protection = Prevention + (Detection + Response)

• Security Principles #10 Fear, Uncertainty, and Doubt (FUD) Do Not Work in Selling Security
• •Information security managers must justify all investments in security using techniques of the trade
• •When spending resources can be justified with good, solid business rationale, security requests are rarely denied

• •Guidelines –Keep It Simple –Security and complexity are often at odds with each other
• –many variables involved, various types of attacks and vulnerabilities, many types of resources to secure, etc
• –If it’s too simple, may not be effective
• –On the other hand, if it’s too complicated, then;
• »it is harder to understand and therefore to implement correctly
• »prone to errors
• »troubleshooting is more difficult when something went wrong
• –Therefore, security measurements and tools should be as simple yet elegant as possible.
• –Simple to troubleshoot, simple to use, and simple to administer

• #11 People, Process and Technology Are All Needed
• • People, process, and technology controls are essential elements of security practices including operations security, applications
• development security, physical
• security, and cryptography
• • Principle #3 – defense in depth

•Latest recommendations cover 14 domains/areas

C) 3rd party software applications

• What is an information asset?
• –Is a definable piece of information
• –Stored in any manner
• –Valuable to the organization
• –Examples
• •Database
• •Data files
• •Intellectual properties
• •Operational and support procedures
• •Research documentation
• •Archived information
• •Business plans
• •Basically, the terminformationincludes all forms of data, documents, communications,conversations, messages, recordings, and photographs. It includeseverything from digital data and email to faxes and telephoneconversations (ISO IEC 27002)
• •Information systems provide a way and a place to process, store, transit, and communicate information
• –People
• –Physical environment

• • Everyone who uses information technology is responsible for maintaining the security and confidentiality of information resources and must comply with security policies and procedures 
• –Chief information security officer (CISO), information resources manager, information resources security officer, owners of information resources, custodians of information resources, technical managers (network and system administrators, internal auditors, and users

• Non-repudiation
• –Non-repudiation of origin: provides the data sender with proof of delivery and it ensures the sender’s identity to the recipient. Neither party can later deny that the data was legitimately sent and received.

• Confidentiality
• –ensure only those individuals who have authority to view a piece of information may do so
• –Prevent unauthorized disclosure of sensitive information

• Functional requirements
• –Describe what a system should do
• –Security test to verify that the functions designed to meet a security requirement operate as expected 
• •Similar to software testing –functionality testing

Protection = Prevention + (Detection + Response)

People, Process and Technology

International Standards Organization or the International Organization of Standards.

International Electrotechnical Commission

• Policies are:
• •High-level, broad statements of what to accomplish.
• •Made by the management when laying out the position on some issues.

Standards, guidelines and procedures

• Program-Level Policy
• Program-Framework Policy
• Issue-Specific Policy
• System-Specific Policy

C) A company has to process their payroll actives at the end of each pay period in batch mode.

D) It shifts the bulk of the costs from capital expenditures and IT infrastructure investment to an utility operating expense model.

B) Saas

False

Active Server Pages or Classic ASP, as it is more commonly known, is Microsoft's first server side scripting engine that enables you to make dynamic and interactive web pages.Classic ASP uses server-side scripting to dynamically produce web pages that are not affected by the type of browser the website visitor is using.

B) Grid computing can run in a cloud computing environment.

A) A cluster computing environment can be deployed in a cloud computing environment.

F) All of the above

A) B, C

C) reduced cost

B) lower stress levels: less worry about normal daily activities like making back-ups

B) increased focus on service level agreements (SLAs)

B)  virtual machines

A) True

A) Negligible

B) It maximizes server utilization.

C) client, application, platform, infrastructure, server

CAPIS

A) It runs directly on server hardware to provide virtual machines with timesharing resources.

E) D,E

Platform and Application are cloud computing architectural layers.

D) In a SaaS environment, customers do not need to worry about installing patches in the virtual instances.

D) Security

A) host, guest

B) Hybrid Cloud.

C) The tasks are divided among the computers.

A) private cloud

A and B

• A) Optimizes IT investments. 
• B) Lower total cost of ownership and improved asset utilization.

B) a hypervisor

A) IaaS

D) Cloud computing can be delivered as utility computing.

C) It delivers computing resource as a metered service.

C) An application delivered to the client from the cloud which eliminates the need to install and run the application on the customer's own computers and simplifying maintenance and support.

B) In cloud computing, resources are treated independently; in cluster computing, the resources are seen as a single system.

C) IaaS

C) A company obtains an environment with a software stack from a cloud provider, develops a custom application, and makes that application available to its customers on the Internet.

True

C) Virtualization made it easier and cheaper to share resources between users.

D) Computer resources can be quickly provisioned.

There is no real difference but, In a traditional computing environment, great expense is involved with building and maintaining a centralized server room, farm and network infrastructure. Cabling has to be involved to connect client computers to the server infrastructure and expensive IT staff is hired and trained to maintain this infrastructure. This is very expensive even for small to mid-sized companies. Modern companies find it difficult to keep up with the fast pace of technological evolution for financial reasons as well as the ability of existing IT staff in regards to training and knowledge. Servers must be continually upgraded and emerging technological advances such as the inception of 'bring your own device', (BYOB), require continual upgrades to the existing traditional IT Infrastructure. As a company grows, IT infrastructure is expensive to expand both from a hardware perspective and from a training perspective for IT staff. Modern companies are finding it difficult to keep up with the pace of these challenges and this can cause financial loss when a company fails to quickly evolve to emerging technologies. With cloud computing these costs are greatly reduced. Server rooms, farms and network infrastructure are moved to the cloud and can be acquired as a utility with metered service that enables cloud customers to pay only for what they use. It staff do not have to worry as much about learning ways to incorporate newer technologies into existing architecture as cloud vendors strive to stay competitive by offering the latest and greatest capabilities. As a companies computing demands continue to grow, cloud computing allows a company to increase their computing needs on the fly. Broad network access allows a company to be more mobile in it's computing environment making it easier to reach out to it's customers with more robust and capable web presence and company employees can access the companies cloud from any location on any device.

Traditional file servers in a company's server room sit idle most of the time. Even during the busy work day companies with physical file servers, work stations and software find their infrastructure mostly unused. The expense of owning and maintaining this infrastructure and associated software licensing as well as staff training is very high. With emerging technologies companies cannot afford to change-up software and file servers or to incorporate the latest and greatest emerging technologies on the fly. Virtualization enables cloud computing and shared resources. The multi-tenant model is ecologically greener and allows infrastructure to be shared and used more fully than traditional on-site server farms/rooms. Fewer file servers serve a larger number of customers reducing the number of idle file servers in the world. The servers that are used by cloud providers are used more efficiently and serve a larger number of clients than private individual file servers. Less energy is lost maintaining idle file servers as well. The disadvantages are in terms of security and sharing resources. Companies are always concerned that their data is secure and not exposed to hackers. SLA agreements are very critical as well. Companies using cloud services worry about availability and network speed. What if there is a power outage at the cloud service end? Will the cloud service provider be capable of maintaining service levels at peak times? Will data be protected and backed up regularly to ensure no data loss? Will the cloud provider chosen keep up with new and emerging technologies to continue to provide a competitive service model?

100% Security. Even in a traditional onsite server/client environment security can never be achieved at 100%. The best a company can do is rely on layered security to try and achieve the highest level of security possible. The same is true of cloud service providers. They cannot guarantee 100% security and there are reports of hackers stealing highly-secured data from companies every day. Even government computers that are required to answer to the highest possible security standards are vulnerable. A layered approach to security is the best thing any computing environment can offer whether it is a cloud computing environment or a traditional physical server/client environment.

C) Sniffing

Mobile Code

• –Stored in any manner
• –Valuable to the organization
• –Examples
• •Database
• •Data files
• •Intellectual properties
• •Operational and support procedures
• •Research documentation
• •Archived information
• •Business plans
• •Basically, the terminformationincludes all forms of data, documents, communications,conversations, messages, recordings, and photographs. It includeseverything from digital data and email to faxes and telephoneconversations (ISO IEC 27002)
• •Information systems provide a way and a place to process, store, transit, and communicate information
• –People
• –Physical environment

• Confidentiality, Integrity and Availability
• The ‘CIA” of Security –the Goals of Computer Security
• •Confidentiality
• –ensure only those individuals who have authority to view a piece of information may do so
• –Prevent unauthorized disclosure of sensitive information
• •Integrity: 
• –only authorized individuals can create or change information
• –keep data pure and trustworthy by protecting system data from intentional and accidental changes
• –the message received is the message sent and the message is not intentionally or unintentionally altered
• •Availability: system and data are available when needed by authorized individuals.

• •Accountability/Auditing: the ability to trace actions to their sources
• •Assurance: processes, policies, and controls used to develop confidence that security measures are working as intended
• •Availability: system and data are available when needed by authorized individuals
• •Authentication: you are who you claim to be
• •Authorization: granting users and systems a predetermined level of access to computer/information resources

Assurance: processes, policies, and controls used to develop confidence that security measures are working as intended

Availability: system and data are available when needed by authorized individuals

• Confidentiality
• Integrity
• Availability
• Authorization and Authentication
• Non-repudiation
•    –Non-repudiation of origin: provides the data sender with proof of delivery and it ensures the sender’s identity to the recipient. Neither party can later deny that the data was legitimately sent and received.

Authentication is about making sure a user is who they say they are.

Authorization is about rights and privileges for users to access data and applications.

• #1 There Is No Such Thing as Absolute Security 
• -- Given enough time, tools, skills, and inclination, a hacker can break through any security measure

Confidentiality, Integrity and Availability.

• #2 Three Security Goals (The “CIA” of Security) 
• Confidentiality: Protect the confidentiality of data – ensure only those individuals who have authority to view a piece of information may do so.
• Integrity: Preserve the integrity of data –keep data pure and trustworthy by protecting system data from intentional and accidental changes–the message received is the message sent and the message is not intentionally or unintentionally altered
• Availability: Promote the availabilityof data for authorized use–system and data are available when needed by authorized individuals (network and system reliability and stability)

• #3 Defense in Depth as Strategy 
• •Defense in depth
• –Security implemented in overlapping layers that provide the three elements needed to secure assets: prevention, detection, and response
• –The weaknesses of one security layer are offset by the strengths of two or more layers

• #4 When Left on Their Own, People Tend to Make the Worst Security Decisions 
• •Takes little to convince someone to give up their credentials in exchange for trivial or worthless goods
• –Experiment: 75% of people exchanged their office password for a free pen at London’s Waterloo station
• •Many people are easily convinced to double-click on the attachment

• •Functional requirements
•   –Describe what a system should does
•   –Security test to verify that the functions  
•    designed to meet a security requirement
•    operate as expected 
• •Similar to software testing –functionality testing
• •Assurance requirements
•    –Describe how functional requirements
•    should be implemented and tested
•    –Security test to validate that the
•    implementation of the function is not flawed
•    or haphazard
• •In other words, does the system do the right things in the right ways?
• •Alternatively, the system does not do what it is not supposed to do
• •How can you prove?
• –Subject the system to brutal security testing
• Security Principles

Protection = Prevention + (Detection + Response)

• Security measures used to focus only on prevention: if we prevented someone from gaining access to computer systems and networks, then we assume that we have obtained security
• Protection = Prevention was the model
• However, no matter how well we seem to do in prevention technology, someone always finds a way to break in

• #10 Fear, Uncertainty, and Doubt (FUD) Do Not Work in Selling Security
• •Information security managers must justify all investments in security using techniques of the trade
• •When spending resources can be justified with good, solid business rationale, security requests are rarely denied

• –Focuses on designing and maintaining a secure physical environment to prevent unauthorized access, damage, and interference to business premises
• –Involves controlling the physical security perimeter and physical entry
• –Involves creating secure offices, rooms, and facilities
• –Provides physical access control
• –Provides protection devices to minimize risks ranging from fire to electromagnetic radiation
• –Provides adequate protection to power supplies and data cables, etc.

• 1.Security Policy Management 
• 2.Corporate Security Management 
• 3.Human Resources Security Management 
• 4.Organizational Asset Management 
• 5.Access Control 
• 6.Cryptography Policy Management 
• 7.Physical and Environmental Security 
• 8.Operations Security Management 
• 9.Communications (Network) Security Management 
• 10.System Security Management 
• 11.Supplier Relationship Management 
• 12.Security Incident Management 
• 13.Information Security Aspects of Business Continuity 
• 14.Security Compliance Management

• Security Policy Management 
• –Focuses on providing directions and support for the information security program 
• –stresses the importance of management involvement in establishing policy, the direction of the information security program, and a commitment to protecting both physical and logical information resources. 
• –Emphasizes the need for visible leadership and involvement of senior management

• Corporate Security Management 
• –Focuses on establishing and supporting a management framework to implement and manage information security within, across, and outside the organization 
• –Provides the structure for information security program 
• –Establishes a mobile device security risk management policy 
• –Establishes a teleworking security management policy 
• –Should be both inward and outward 
• •Inward – controls and policies concentrate on employees’ relationships to information systems 
• •Outward – controls and policies concentrate on third-party (vendors, customers, trading

• Supplier Relationship Management 
• – Establish security agreements with suppliers 
• •Expect suppliers to comply with risk mitigation agreements 
• •15.1.2 Expect suppliers to comply with information security agreements 
• •15.1.3 Expect suppliers to deal with their own supply chain security risks 
• –Manage supplier security and service delivery 
• •Manage supplier services and supplier security 
• •Manage changes to services provided by suppliers

• Information Security Aspects of Business Continuity 
• –Plans how information security will continue during a disaster 
• –Protects critical business processes from effects of major failures and disasters 
• –Minimizes interruptions to business 
• –Defines response, recovery, and continuity plan

System Security Management

Security Compliance Management

• •Secure the operating system 
• •Validate your image 
• •Plans for disaster recovery and business continuity 
• •Understand the contract/SLA 
• •Follow cloud provider security guidance 
• •Secure your admin panel

• •Understand the Contract/SLA 
• •PAAS provider using IAAS 
• •Follow SDLC 
• •Encrypt Sensitive Data 
• •Consider portability (Open standards) 
• •Follow cloud provider security guidance

• •Understand the Contract/SLA, include auditing 
• •Understand the providers SDLC 
• •Encrypt Sensitive Data 
• •Consider portability (Open standards) 
• •Integrate Identity and access management 
• •Follow cloud provider security guidance

C) The lower down the stack that the Cloud provider stops, the more security the consumer is tactically responsible for implementing and managing.

• 1. Governance and Enterprise Risk Management
• 2. Security as a Service
• 3. Virtualization
• 4. Identity and Access Management
• 5. Encryption and Key Management
• 6. Application Security
• 7. Data Center Operations
• 8. Legal Issues: Contracts and Electronic Discovery
• 9. Compliance and Audit
• 10. Information Management and Data Security
• 11. Portability and Interoperability
• 12.  Traditional Security, Business Continuity and Disaster Recovery

Compliance and Audit

Portability and Interoperability

Data Center Operations

• •Denial-of-service 
• –Cloud base solutions have an advantage in handling denial-of-service attacks due to its ability to scale 
• –So users may not be impacted 
• –The increased scaling will alarm the administrators so they can initiate responses

• •Packet Sniffing 
• –The Broad Network Access nature (anywhere, anytime, any device) of cloud computing increases potential risks; especially with wireless access 
• –The best defense is to use secured (encrypted) connections 
• •Man-in-the-Middle attack 
• –Same situation 
• •Session Hijacking 
• –Same situation

• “that it is possible to map the internal cloud infrastructure, identify where a particular target VM is likely to reside, and then instantiate new VMs until one is placed co-resident with the target.” 
• •“An attacker can place his VM on the same physical machine as a target VM (40% success for a few dollars).” 
• •“On EC2, VMs can be co-resident only if they have identical creation parameters: Region (US/Europe), Availability zone (data center), and Instance type (machine pool)”

Data wiping – overwrites a file’s content when it is deleted. 

• –Clients may share storage devices 
• –When a file is deleted, the appropriate directory entry is marked as a deleted file 
• –Area of the disk where the deleted file resides becomes unallocated disk space 
• –However, data in the file remains on the device 
• –Available to receive new data from newly created files or other files needing more space 
• –Someone can claim the space but do not write anything on it 
• –That person will then have access to your data

• –If the attacker gets the hypervisor he gets everything 
• –Best Practices 
• •Restricted access to only authorized admins 
• •Consider compensating controls for access (2 factor etc.) 
• –Remote admin is risky 
• •Use firewall 
• •Consider dedicated management Network 
• •FIPS (Federal Information Processing Standards) approved methods for encryption

• –Escaping VM 
• •“Attacker breaks out of a guest OS to gain access to the hypervisor, other guest OSs, or the underlying host OS” - NIST 
• •Side Channel Attacks 
• –“Attacker exploits the physical properties of hardware to reveal information about usage patterns for memory access, CPU use and other resources. The attacker typically uses these attacks to reveal cryptographic keys. Typically requires physical access to the host.” - NIST

• 1.Use Non-bypassable memory lockdown to “reliably protect the hypervisor’s code and static data from being compromised.” 
• 2.Use restricted pointer indexing to “introduce one layer of indirection to convert the control data into pointer indexes. These pointer indexes are restricted such that the corresponding call/return targets strictly follow the hypervisor control flow graph.” 
• –Prototypes have been developed on BitVisor and Xen.

• •Protects against Kernel rootkits in guest OSs 
• –Kernel rootkits – “hijack control flows by modifying control data or hooks in the kernel space.“ 
• –So need to protect kernel hooks from being hijacked. 
• •Observation 
• –“kernel hook, once initialized, may be frequently “read”-accessed, but rarely “write”-accessed.” 
• –Therefore, “relocate those kernel hooks to a dedicated a page-aligned memory space and then regulate accesses to them with hardware-based page-level protection.” 
• •A prototype has been developed and used to protect more than 5, 900 kernel hooks in a Linux guest. 
• –Prevented 9 real world rootkits from different attacks (6% overhead)

• •VMsafe is integrated inside the hypervisor 
• •“Prevents threats and attacks such as viruses, trojans and keyloggers from ever reaching a virtual machine.” www.vmware.com 
• •Provides APIs to enable segregation, isolation, and protection of VM resources 
• –Examine VM memory and CPU usages 
• –Monitor and control process executions 
• –Network packet filtering 
• –Virtual machine disk files

• 1. Applications
• 2. Operating Systems (Host and Guest)
• 3. Hypervisor
• 4. Host Computer Storage

• •Hardening 
• •Patching 
• •Turn Off File shares 
• •Turn off unused services

• •Restricted access to only authorized admins 
• •Consider compensating controls for access (2 factor etc) 
• •Use a firewall 
• •Consider dedicated management Network 
• •FIPS approved methods for encryption for remote access