myths and realities of cloud data security

© 2012

Myths & Realitiesof Cloud Data Security

Michael J. KrouzeChief Technology OfficerCharter Solutions, Inc.

Copyright © 2013, Charter Solutions, Inc. 2.

“The first step toward change is awareness. The second step is acceptance.”

- Nathaniel Branden

“All our knowledge has its origins in our perceptions.”

- Leonardo da Vinci

“The thing about quotes on the internet is you can not confirm their validity.”

- Abraham Lincoln


We don’t use the cloud.


• Files are encrypted at rest• Files are encrypted during transit• Provide “business” version that

allows multiple user access control• Strict policy and technical access

controls that prohibit employee access

• Users can have weak passwords• Files are ‘synced’ to multiple

devices• API allows programs to access

your files (with permission)

• Always use strong passwords• Encrypt files before you put them there and only share key with the other

people who should see that file• Never give permission for API access


Yes, your organization uses the cloud… you just may not know it.


The cloud simply cannot be secure.

My provider has my security covered.

The cloud isn't safe.If it's on the Internet, it's more vulnerable to hackers.

Private cloud computing is secure by default.

Data stored in the cloud is more vulnerable.


Security is a Shared ResponsibilityOn-Premise

Network

Storage

Server

VM

OS

Services

Application

On-Premise(hosted)

Network

Storage

Server

VM

OS

Services

Application

IaaS

Network

Storage

Server

VM

OS

Services

Application

PaaS

Network

Storage

Server

VM

OS

Services

Application

SaaS

Network

Storage

Server

VM

OS

Services

Application

Organization Shares Control with VendorOrganization has Control Vendor has Control


Industry Groups Targeted

Other

Information

Health Care and Social Assistance

Finance and Insurance

Retail Trade

Accommodation and Food Services

0 10 20 30 40 50 60

% of Breaches

Source: 2012 Data Breach Investigations Report (Verizon/USSS)


Who’s Behind Data Breaches?

Business Partners

Internal Employees

External Agents

0 10 20 30 40 50 60 70 80 90 100

% of Breaches



Threat Agent Change Over Time

'04-'07 2008 2009 2010 20110

10

20

30

40

50

60

70

80

90

100

External Internal Partner

% o

f Bre

ache

s



How Do Breaches Occur?

Priviledge Misuse

Social Tactics

Physical Attacks

Malware

Hacking

0 10 20 30 40 50 60 70 80 90 100

% of BreachesSource: 2012 Data Breach Investigations Report (Verizon/USSS)


Attack Commonalities

97% Avoidable through simple or intermediate controls

96% Were not highly difficult94% Of all data compromised involved

servers92% Were discovered by a third party85% Took weeks or more to discover79% Were targets of opportunity



Hacking Methods

Unknown

Abuse of functionality

Remote file inclusion

SQL Injection

Exploit insufficient authentication

Exploit backdoor

Brute force/dictionary attacks

Stolen login credentials

Default/guessable credentials

0 10 20 30 40 50 60

% of Breaches



Not Just About Data Encryption

Application

Database

OS File System

Storage System

Public Network

Private Network

SSL Encrypted

Encrypted at Rest

Clear Text Data


It’s not that the cloud isn’t secure…

It’s that you need to think differently about how to secure it


My datacenter is more secure than the cloud.


A little obvious after the last myth

Security is often taken for granted behind the firewall


Data Breaches by Hosting Location

Mobile

Co-located

External

Internal

0 10 20 30 40 50 60 70 80 90

% of Breaches



Your datacenter (on-premise or cloud) is only as secure as you make it!

Both can be equally secure or insecure.


Concluding thoughts…


Understand your data risks & security needs

Establish a set of cloud-specific security processes / policies


Review cloud vendors closely to ensure their sphere of control aligns with your cloud-specific processes / policies

Implement, monitor, react, review, improve


Thank You!

[email protected]://www.linkedin.com/in/mjkrouze

@mjkrouze

mailto:[email protected]

mailto:[email protected]

myths and realities of cloud data security

Technology

control copyright

data breaches

rest copyright

set of cloud

review cloud vendors

cloud isnt safe

private cloud computing

rest files