www.enisa.europa.eu

ENISA – Cloud Computing Security Strategy

Dr Steve Purser

Head of Technical DepartmentEuropean Network and Information Security Agency (ENISA)

OGF28 2010Munich March, 2010

www.enisa.europa.eu

• Created in 2004• Centre of Expertise• Supports EU institutions• Facilitator of information

exchange between EU institutions, public sector & private sector.

• Advising and assisting• Collecting and analysing• Promoting methods • Raising awareness

ENISA

2

www.enisa.europa.eu

ENISA’s Understanding of Cloud Computing

• Cloud computing is a new business model that allows:• Highly abstracted HW and SW resources • Rapid scalability and flexibility • Near instantaneous provisioning • Shared resources (hardware, database,

memory, etc...)• ‘Service On demand’, usually with a ‘pay as

you go’ billing system • Programmatic management (e.g. through Web

Services API)

www.enisa.europa.eu 4

ENISA Cloud Computing Objectives

• Help governments and businesses to leverage the cost benefits of cloud computing taking due consideration of security requirements.

• Improve transparency on security practices to allow informed decisions

• Creating trust and trustworthiness by promoting best practice and assurance standards

www.enisa.europa.eu

Reaching the objectives

5

ENISA Deliverables and Ongoing Activities:

• Cloud Computing: Benefits, Risks and Recommendations for Information security 2009

• Assurance framework 2009• Research Recommendations 2009• Gov-Cloud security and resilience analysis (2010)• Cloud Assurance Framework (CAM) consortium

2010• 2011 (proposed) procurement and monitoring

guidance for government cloud contracts.

www.enisa.europa.eu

Cloud Computing: Benefits, Risks and Recommendations for Information security

6

www.enisa.europa.eu 7

Security

Benefits

www.enisa.europa.eu

Economies of scale

• The same amount of investment in security may result in better protection

• Many security measures are cheaper when implemented on a larger scale.o (e.g. filtering, patch management, hardening of virtual

machine instances and hypervisors, etc)

www.enisa.europa.eu

The Risks

www.enisa.europa.eu

Very high value assets

• More Data in transit (Without encryption?)

• Management interfaces are interesting targets for attackers.

• Trustworthiness of insiders.• Hypervisors- hypervisor layer

attacks on virtual machines are very attractive

www.enisa.europa.eu

Loss of Governance

• The client cedes control to the Provider on a number of issues effecting security:o External penetration testing may not be

permitted.o Very limited logs available.o Usually no forensics service offeredo No information on location/jurisdiction of data.o Outsource or sub-contract services to third-

parties (fourth parties?)• SLAs may not offer a commitment to provide the

above services, thus leaving a gap in security defences.

www.enisa.europa.eu

Compliance Challenges

• Cloud Provider may not be able to provide evidence of their own compliance to the relevant requirements.

• Cloud Provider may not permit audit by the Cloud Customer.

• In certain cases, using a cloud implies certain kind of compliance cannot be achieved

www.enisa.europa.eu

Legal and contractual risks

• Data may be stored in multiple jurisdictions, some of which may be risky.

• Lack of compliance with EU Data Protection Directiveo Potentially difficult for the customer (data controller) to

check the data handling practices of the providero Multiple transfers of data exacerbated the problem

• Subpoena and e-discovery• Confidentiality and Non-disclosure• Intellectual Property• Risk Allocation and limitation of liability

www.enisa.europa.eu

Cryptographic Key Management

• Key management is (currently) the responsibility of the cloud customer.

• Distributed key management is difficult.

• Therefore key provisioning and storage is usually out of band – i.e. off-cloud

• Some models, e.g. one key per account, do not scale to multiple accounts/account holders

• Hardware security modules are difficult to implement in the cloud.

www.enisa.europa.eu

Vendor Lock in

• Few tools, procedures or standard formats for data and service portability

• Difficult to migrate from one provider to another, or to migrate data and services to or from an in-house IT environment

• Potential dependency of service provision on a particular Cloud Provider.

www.enisa.europa.eu

Resource Exhaustion

• Overbooking• Underbooking• Caused by

o Resource allocation algorithmso Unpredictable peaks in legitimate demand.o Denial of Service

www.enisa.europa.eu

Cloud Computing Information Assurance Framework

17

www.enisa.europa.eu

• Aims at increasing transparency by defining a a minimum baseline for:

• Comparing cloud offers

• Assessing the risk to go Cloud

• Reducing audit burden and security risks

Cloud Information Assurance Framework

www.enisa.europa.eu

Cloud Information Assurance Framework

An example

• Network architecture controls• Well-defined controls are in place to mitigate DDoS (distributed denial–of-service)

attacks e.g.o Defence in depth (traffic throttling, packet black-holing, etc..)o Defences are in place against ‘internal’ (originating from the cloud providers

networks) attacks as well as external (originating from the Internet or customer networks) attacks.

• Measures are specified to isolate resource usage between accounts for virtual machines, physical machines, network, storage (e.g., storage area networks), management networks and management support systems, etc.

• The architecture supports continued operation from the cloud when the customer is separated from the service provider and vice versa (e.g., there is no critical dependency on the customer LDAP system).

www.enisa.europa.eu

Framework 2010 – Cloud Assurance Metric

Provider comparison on security features

Personnel security

Supply chain security

Operational Security

Identity and Access Management

Data and Service PortabilityBusiness Continuity Management

Physical and Environmental Controls

Asset Management

Legal and compliance requirements

0

5

Example Provider Comparison Chart

Score Provider 1

Score Provider 2

www.enisa.europa.eu 21

Government in the Cloud: impact on service security & resilience

2010 – Supporting EU Governments in Cloud Migration

ENISA aims to:

• Analyze and evaluate the impact of cloud computing on the resilience and security of GOV services

• Provide recommendations and good practices for European Members State planning to migrate to cloud computing

www.enisa.europa.eu

Governments and the Cloud

22

UK

DK

USA

Singapore

Japan

Australia

• Gov Agencies and Public Organizations around the globe are moving non-critical applications towards a "cloud approach".

• In Europe we have some fast adopters, i.e. Denmark and UK, announcing/planning to move into the cloud.

• In the short-medium term (1 to 3 years) an increasing number of Public Organizations, in EU Member States, will consider/adopt cloud computing.

...

www.enisa.europa.eu

2011 procurement and monitoring guidelines

Procurement Criteria

Monitoring and

Supervision

CERT, ISAC

Information security procurement criteria and monitoring of government cloud contracts.

www.enisa.europa.eu

Conclusions

• Cloud computing can represent an improvement in security for non-critical applications and data.

• But transparency is crucial: customers must be given a means to assess and compare provider security practices.

• In the current state of the art, migrating critical applications and data to the cloud is still very risky (even private clouds)

• It is not currently clear to what extent the Cloud Computing model can be applied to applications that require high levels of security.

www.enisa.europa.eu

http://www.nis-summer-school.eu/

Subscribe to the NIS'10 Newsletter at http://www.nis-summer-school.eu/