Securing Cloud Services Part 1

Introduction

The use of the word “Cloud” to describe hosted IT services is somewhat of a misnomer. Even though its origin is from a diagram on paper it still conjures a vision of this floating entity over which you have no control and it may not be there in the morning.  However it is a very pervasive marketing term and has strong acceptance.   

Cloud is not so much a technology as a convergence of multiple streams of technology into a new service layer. It is categorised into three major service offerings which require different security considerations:

Infrastructure As A Service (IaaS) is the delivery of computer infrastructure (typically a platform virtualization environment) as a service. Rather than purchasing servers, software, data centre space or network equipment, clients instead buy those resources as a fully outsourced service. The service is typically billed on a utility computing basis and amount of resources consumed (and therefore the cost) will typically reflect the level of activity. Storage as a Service (remote backup) is often cited as a subset of IaaS.

Platform As A Service (PaaS) provides all of the facilities required to support the complete life cycle of building and delivering web applications and web services with no software downloads or installation for developers, IT managers or end-users.

Software As A Service (SaaS) is a model of software deployment whereby a provider licenses an application to customers for use as a service on demand. SaaS software vendors may host the application on their own web servers or download the application to the consumer device, disabling it after use or after the on-demand contract expires.

For SaaS and PaaS the primary security focus is around data integrity, availability and confidentiality whilst with IaaS the focus is on technical controls.

The Move to Cloud

Every day more organisations are moving their data into the Cloud, with increasing reliance on web applications and hosted services as core components of their business operations. 

More often than not the move to cloud services is driven by business divisions identifying a new solution they want now which is not dependant on internal IT resourcing or constraints. Unfortunately at times the value of the data or the issues around integration of cloud and on-premises data is overlooked. This can result in much post-implementation ad-hoc activities that can compromise data and system security.

Just as important the risks cannot be entirely outsourced. Servers go down, hardware fails, and networks lose connectivity. Underlying all these potential issues is the general risk of a business losing control over their own data and not being able to account for it if things go wrong.

 

Look out for Part 2...

 

Greg Starkey

Business Development Manager, Government & Commercial

www.cqr.com

Redirecting Your Physical Identity

One of my pet hates is when mail for other people is delivered to my personal post office box.  But something that isn't normally considered is how annoying it could be for the person who didn't get the mail in the first place?

I'll use a recent real example, and in this case the misdirected post was for yet another optometrist.  Seriously, what is it with optometrists and security failure?  It has never been more true that there are none so blind as those who will not see.

There are three different failure conditions, all with a cost and an impact.

#1  The sender doesn't know the receiver didn't get the message.  They are spending money posting paper that never gets delivered.

#2  The receiver doesn't know anything about the message at all.  They are paying for the message to be sent, but are getting no value from it.

#3  The sender has included enough information on the outside of the envelope to allow anyone who sees it to steal the identity of the receiver.  They've assumed that the communication is private and can't be intercepted.

It's #3 that is the most troubling.  The name, address, account number, contact details and a number of other pieces of interesting information were on the outside.  This is sufficient to be able to reset the password of the legitimate receiver at the organisation of the sender.  After that, identity theft becomes very easy.

We know that information is being snooped off our networks, but we forget that every piece of physical mail is scanned and photographed to allow automated delivery.  Those photos are metadata, and almost certainly end up with the security services.

It isn't enough to keep our identities secure online, we have to remember to keep them secure offline as well.

Phil Kernick @philkernick

www.cqr.com

Search Engine Optometrists

I had to see a new optometrist this month, and as is usual with every healthcare professional, I needed to fill in yet another client information form.  Everything was as expected until I came to the very last question:

Would you be happy for us to create a Google+ account in your name?  You can change your password anytime.  With this account you can review us or any other product or service at any time.  Yes / No

We've seen companies astroturfing for a very long time - using fake reviews to bolster their products – but I’ve never seen anyone be quite so blatant about it.  There is no information on how they will manage these accounts, who else they might share the passwords with, and what other services they might review at any time.  Truly it boggles the mind.

Perhaps someone thought that SEO stood for Search Engine Optometrists.

In a world where identity matters, where health data is considered sacrosanct personally identifiable information, who would ask such a question, and more importantly, who would ever say yes?

 

Phil Kernick @philkernick

www.cqr.com

The Value of a Human Life

While this sounds like a discussion better had after a few beers, we do seem to value human lives very differently depending on the source of the threat.

In the US in 2012:

° 440,000 people died from smoking related illness ° 33,000 people died from car accidents ° 32,000 people died from firearms ° 9 people died from terrorism

Wait, is that a typo?  No.  Let's go back further.  In the last decade 2003-2012, the total number of deaths in the US related to terrorism was 40.

More people die from firearms or car accidents every 10 hours than have died from terrorism in 10 years.

More people die from smoking related illness every 50 minutes than have died from terrorism in 10 years.

Imagine how many lives could have been saved if last year's $50B national surveillance budget had instead been spent on addressing common, well-known, real causes of deaths, rather than fear of the monster under the bed.

Phil Kernick @philkernick
www.cqr.com

10 years of CQR

We have just celebrated our 10th anniversary of the founding of CQR, and this gives us an opportunity to look back at the way the world was when we started the company, and compare it to the world we find ourselves in today.

In late 2003 almost everyone working in the information security industry in Australia either worked for a system integrator, who sold consulting services as a sideline to their hardware and software business; or for a large accounting firm who were branching out from their IT audit practices.  In both cases the advice given by the security consultants wasn't independent, it was seen as a vehicle to upsell their core services.  If you had a problem with network security, you were much more likely to be told that you needed a new firewall - one that was sold by the system integrator of course - than that you needed to improve your firewall configuration.

The four founders of CQR independently realised that there was a need in the market for genuine product-independent security advice, and that business focussed technical risk assessment was something that no-one else was offering.  A decade later this is still as true as it was back then, and we even see regression as independent security firms are being rolled back into system integrators and defence contractors.

It's one thing to have a vision, but quite another to put it into practice.  To make it happen required belief and commitment.  Belief that there was a need for the services that we were providing, and commitment to give up well paid jobs for 25% of a startup with no expectation of any pay for at least the first 6 months.  We have never wavered in the belief and commitment, and it has been rewarded year after year by our loyal clients and partners.  Our first year stretch target is now well below our average month.

Of course we had our detractors, who said that we would be out of business in a month.  Then three months.  Then a year.  When displacing an existing service delivery model, those displaced can either roll with the changes and grow, or waste time and focus looking at their competitors and stagnate.  Companies that were once our competitors are now no longer in business, new companies have sprung up following our lead, and we have adapted to meet the challenge.  But we have never taken our eye off our vision of being the largest independent security consultancy in Australia.

We were the first business in Australia to certify our operations to the international standard for information security management (then AS 7799, now ISO 27001).  We believed then, as we believe now, that we should be the number one client for our own advice.  We have never advised our clients to do what we say, but not do what we do.

Our success in our home town of Adelaide allowed us to open offices in Sydney and Melbourne to better service local businesses with local resources, rather than rely on a fly-in fly-out model which doesn't meet the flexibility needs of our clients and doesn't scale.  We also went international, opening an office in the UK which has now expanded to deliver services throughout Europe, Asia and the USA.

In 2013 we see cyber-security stories in the paper every day, there are nation-states spying on our companies, and information security certifications are seen as critical to the trust model of doing business.  Information security is no longer a nice-to-have, but a fundamental part of sustainable business practice.  The need for independent information security advice has never been greater.

In the next 10 years, we have detailed plans for the Australian operation to expand to open local offices to cover the rest of Australia as well as have a permanent presence in New Zealand and Singapore; while the UK operation will be delivering services both locally and in Europe and the USA.

I'm proud to have taken the risk to quit my job.  I'm proud to say that I've been involved in building CQR up from nothing to its dominant position today.  I'm proud to be making the world a safer place.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com

Cyber-Warfare Battlezone

In 1980 Atari came out with an amazing video game named Battlezone.  In it you drive a wire-frame tank around a landscape, shooting enemy tanks, UFOs and missiles.  The US Army even commissioned a version of the game as a training simulator!  I remember spending many hours and a significant amount of my pocket money trying to defend against the enemy onslaught.  Today I do much the same thing, but now it’s done by educating businesses on the cyber-threats that they face, and helping them develop the best-practice process and technology required  to safeguard their people, productivity and profits.

Good security practices are no longer optional or just “nice to have”.  The age of naivety has well and truly passed, and businesses that continue to operate with a head in the sand attitude are not able to effectively maximise the returns on their assets – assets that are increasingly digital, portable, and greedily desired by competitors and developing nations alike.  A recent Akamai “State of the Internet” report has shown that the combination of Indonesia and China represent 71% of the global attack traffic.  This is not stereotypical dysfunctional teenaged hackers, this is targeted, industrialised intellectual property theft.

One of the biggest blockers to effective security management is the belief that it is an IT problem, and that IT will solve it.  If this were true, then there would be no spam, no viruses, and no cyber-crime.  Yet 20 years of the best minds in the best IT companies, developing the best products has left us where we are, heading upstream without a paddle.  Security is a people problem, and until it becomes just business-as-usual, integrated into every business process, we will make little headway.  We already know how to deal with safety: safety is everyone’s problem.  We just haven’t realised that information security is business safety, and is also everyone’s problem.

The security foundations are able to deal with yesterday’s problems – patching, antivirus and firewalls – but they are no longer enough to keep us safe from today’s problems.  Today we live in a portable world, where the ability to work anywhere, anytime and have complete connectivity whilst doing so has meant that the implied protections of the past no longer exist.  Home networks are not as well protected as business networks.  Portable devices are left unprotected in airport lounges.  Social networks allow us to connect to our attackers in unimaginable ways.  Every protection we have built can and will eventually be bypassed.  It is no longer “if” but “when”.

The planned Data Breach Disclosure legislation in Australia will help us to help ourselves.  The intent is not to blame the victims, but instead give businesses incentives to protect their own assets, and break the culture of silence.  A company director is more likely to support a security improvement programme if they are the one who will be held personally liable for a data breach, the average cost of which in Australia was $2.13M last year.

Just like the Battlezone game, we need a radar to tell us when attackers are approaching, not discover it when having to clean up the mess.  Most businesses spend too much on protecting from attack, and not enough understanding the threat landscape they operate in, and detecting when the protections have failed.  In a video game we can just insert another coin, press start and try again.  We don’t have that luxury with our businesses.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com

Cyber Broken Windows Theory

In 1982 a now famous paper by James Q. Wilson introduced the Broken Windows Theory.  Consider a building with a few broken windows.  If the windows are not repaired, the tendency is for vandals to break a few more windows.  Eventually, they may even break into the building, and if it's unoccupied, perhaps become squatters or light fires inside.

This theory has an uncanny parallel with current information security practices - poor security hygiene allows cyber-crime to flourish.  Consider a computer with a few unpatched vulnerabilities.  If the vulnerabilities are not patched, the tendency is for criminals to start exploiting them.  Eventually, they may even break into the computer, and if unprotected, perhaps add it to a botnet or just trash it.

By not patching our systems, we are not just victims of cybercrime, we are unwitting accomplices.

One unrepaired broken window is a signal that no one cares, and so is one unpatched computer.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com