Cloud Computing

Security Overview

Glenn Brunette
Distinguished Engineer
Sun Microsystems, Inc.
Copyright © 2009 Sun Microsystems, Inc.
What Do People See in the Clouds?
Gartner:
SC Magazine: 7 cloud-computing
Head in the clouds: Cloud security risks
computing security issues

InfoWorld: IT Business Edge:

The Dangers of Cloud Computing Security
Cloud Computing Concerns Linger

Enterprise IT Planet: PC Magazine:

Will Cloud Computing, The Darker Side
Virtualization Become of Cloud Computing
Hacker Heaven?

Copyright © 2009 Sun Microsystems, Inc.

One Thing is Missing...

CONTEXT
Copyright © 2009 Sun Microsystems, Inc.
Which is “Best”?

Copyright © 2009 Sun Microsystems, Inc.

One Cloud Computing Model
Application Domains

Faster time-to-market

ce

al
tic
C

eb

dic
an
aly
HP

Me
Fi n
An Reduction of custom

Private
software
Software as a Service

Hybrid
Cloud Computing Layers

Pay only for what you

Public
Platform as a Service
use
Grow infrastructure
Infrastructure as a Service

el
od
M
with business
s
es
in
us
B
ud
lo
C

Copyright © 2009 Sun Microsystems, Inc.

Cloud Computing Characteristics

On-demand Self Service

Ubiquitous Network Access
Location Independent Resource Pooling
Rapid Elasticity
Measured Service

Reference: “Working Definition of Cloud Computing”. National Institute of Standards and Technology
http://csrc.nist.gov/groups/SNS/cloud-computing/index.html

Copyright © 2009 Sun Microsystems, Inc.

Cloud Computing is Multifaceted

Reference: “Rational Survivability Blog”. Chris Hoff. http://www.rationalsurvivability.com/blog/?p=743

Copyright © 2009 Sun Microsystems, Inc.
Focusing the Discussion
Public Infrastructure as a Service environment
used to perform a one-time conversion
of 10,000 images.

VS

Hybrid Infrastructure as a Service environment

used to analyze the results of human clinical
drug trials.
Copyright © 2009 Sun Microsystems, Inc.
Equilibrium Must Be Achieved

Manage Business Efficiency

Risk & Agility

Copyright © 2009 Sun Microsystems, Inc.

IaaS: Who is responsible for what?
Facilities
Network Fabric
Faster time-to-market
Reduction
Hypervisors and Compute of custom
Resources
software
Virtual Machine Images
Pay only for what you
Storage Resources
use
APIs and Infrastructure
GrowServices
infrastructure
with business
Control and Monitoring
Copyright © 2009 Sun Microsystems, Inc.
 Performance (SLAs)
Accreditation
Transparency
BUT
trust must
Open and
be earned Compatible
Copyright © 2009 Sun Microsystems, Inc.
IaaS Concerns - Storage

Physical Location
Customer Isolation
Unauthorized Access
Disclosure, Alteration,
and Destruction
Encryption and Key Mgmt
Copies and Remanence
Copyright © 2009 Sun Microsystems, Inc.
IaaS Recommendations - Storage

Confidentiality – Encryption, Sanitization

Faster time-to-market
Integrity – Digital Fingerprints and Signatures
Reduction of custom
Authenticity – Digital Signatures
software
Availability – LKSS, Pay
P2P, only for what you
Multi-Cloud
use
Accountability – IAM, Audit Trails
Grow infrastructure
with business
Copyright © 2009 Sun Microsystems, Inc.
IaaS Concerns - Compute

Physical Location
Customer Isolation
Unauthorized Access
Disclosure, Alteration,
and Destruction
Encryption and Key Mgmt
Copies and Remanence
Copyright © 2009 Sun Microsystems, Inc.
IaaS Recommendations - Compute

Secured, Fit for Purpose VM Images

Faster time-to-market
Compartmentalized Execution
Reduction of custom
Encrypted Swap and Local File Systems
software
Pay only
Encrypted Data Transit for what you
(In/Out)
use
Hardened Applications and Services
Grow infrastructure
Active Monitoringwith
and business
Logging
Copyright © 2009 Sun Microsystems, Inc.
IaaS Recommendations - Management

Strong Authentication
Faster time-to-market
Authenticated Communications
Reduction of custom
Encrypted Communications
software
Restricted Pay only for what you
Access
use
Least Privilege, Separation of Duty
Grow infrastructure
Active Monitoringwith
and business
Logging
Copyright © 2009 Sun Microsystems, Inc.
Ongoing Concerns

• Transparency
• Operational Maturity
• Trust and
Key Management
• “Rogue” Environments
Copyright © 2009 Sun Microsystems, Inc.
Emerging Concerns

• Security at Scale

• Ephemeral Deployments

• Forensic Pathology

• Economic Attacks
Copyright © 2009 Sun Microsystems, Inc.
Managing Risk
NEED A NEW IMAGE
INCLUDING: POLICY/LEGAL,
PEOPLE, PROCESS, and
TECHNOLOGY
INTERTWINED

Take
Takea aSystemic Approach
Systemic Approach
Copyright © 2009 Sun Microsystems, Inc.
IT Security Must Evolve

New Technologies and Business Models Drive Constant Change

Copyright © 2009 Sun Microsystems, Inc.
Cloud Security Big Rules

Embrace “Secure by Default” Systemically

Faster time-to-market
Design for Survivability and Self-Preservation
Reduction of custom
software
Compartmentalize Failures Modes
Pay only for what you
use (but no less)
Trust as Little as Possible
Grow infrastructure
Challenge the Status Quo!
with business
Copyright © 2009 Sun Microsystems, Inc.
Trends – Industry Collaboration

Copyright © 2009 Sun Microsystems, Inc.

Trends – Open Innovation

Copyright © 2009 Sun Microsystems, Inc.

Trends – Pre-Integration

Copyright © 2009 Sun Microsystems, Inc.

Today: Immutable Service Containers

Copyright © 2009 Sun Microsystems, Inc.

Segmenting Instances in the Cloud

Copyright © 2009 Sun Microsystems, Inc.

 Get Started Today
• Participate in the Development of
our Open Cloud APIs, Immutable
Service Containers and more
• Join the Cloud Security Alliance
• Let Sun Consulting experts help you
take advantage of Cloud Computing

sun.com/cloud
Copyright © 2009 Sun Microsystems, Inc.
Q&A
Copyright © 2009 Sun Microsystems, Inc.
THANK YOU!
sun.com/cloud

29