Cloud
2/24/2014
09:05 AM
Bill Kleyman
Bill Kleyman
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
Google+
RSS
E-Mail

How I Secure My Personal Cloud

As global cloud traffic grows exponentially, IT pros face the daunting task of securing their personal cloud, data, and workloads.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Bill Kleyman
50%
50%
Bill Kleyman,
User Rank: Apprentice
2/25/2014 | 10:38:49 AM
Re: Where are you on the continuum
There are a few things you can do to keep your cloud and data safe -- at a high level:

1. Constant vigilance. Never be complacent around your own security. If you're unsure about a piece of informaiton, a site, or an access point - don't go near it.

2. Keep you software (and firmware) updated. This goes for AV software as well as your router firmware.

3. Browse smart. Be aware of where you are both physically and in the cloud. Don't go to banking or other sites that contain your information from a public spot. Many times there may be someone snooping on that connection.

4. Keep track of your data. The good thing about cloud is that you can really efficiently expand your data footprint to more easily access infomration. This can also be bad thing. Programs like Dropbox allow you to share links -- but don't really remind you that you have shared links open. Keep track of where you store data both physically as well as in the cloud.

5. Be aware of passwords. First of all - please don't make your password something silly. Use good alphanumeric protocols and even throw in a special character in there. I am NOT a big fan of allowing browsers to save my passwords for me. 

6. Don't install, download or open data that you're unsure about. In a previous life - I did some security pen testing for large organizations. One of those projects included dropping an 8GB USB key in the middle of a busy hallway in the hopes that someone would pop it into their computer. We dropped 10 USB keys that had a hidden piece of software that would run as soon as the drive was plugged in. We had an 80% success rate. This holds true for downloading content you're unsure of or opening an email with a strange attachment. If it looks fake or strange -- it probably is.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/25/2014 | 9:17:11 AM
Re: Where are you on the continuum
Even those high-end routers seem beyond my capabilities as a user/consumer (Maybe you can create ACLs, configure RADIUS servers, create LAN/wLAN MAC filters, easily setup your own VPN server, and even create network services filters using an advanced firewall -- but know I can't).

But in terms of power users and a security-aware (maybe not elite)  IT professional how much of what you practice would you recommend as a priority for others?

 
Bill Kleyman
50%
50%
Bill Kleyman,
User Rank: Apprentice
2/24/2014 | 1:03:26 PM
Re: Where are you on the continuum
@Marilyn - SDN might be a stretch, you're right. As might be deploying hypervisor-layer security.

However, even on the consumer-side there are some pretty great security platforms. Let's take a couple of examples: NetGear Nighthawk AC1900 and the Asus RT-N66U Dark Knight. Both top of the line consumer routers - both capable of some advanced security - both under $200. Even without loading a mod firmware on these routers, the native software is very powerful. You can create ACLs, configure RADIUS servers, create LAN/wLAN MAC filters, easily setup your own VPN server, and even create network services filters using an advanced firewall.

These interfaces are pretty easy to navigate through and most have very good explanations built right into the GUI. So, good security doesn't have to be limited to the IT elite. In fact, these types of solutions and devices are here to make security much more accessible to the typical end-user.  
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/24/2014 | 12:36:16 PM
Where are you on the continuum
Bill, Curious to know where you would put yourself on the security continuum with respect to your peers in IT. Is what you do to secure your personal cloud fairly typical and what you would recommend for anyone looking to lock down their professional work and workload? It seems to me that the idea of fooling around with SDN on a home network would be quite a stretch for even the saviest security practitioners!
Bill Kleyman
50%
50%
Bill Kleyman,
User Rank: Apprentice
2/24/2014 | 12:18:16 PM
Re: What about Dropbox?
@Laurianne - Excellent question, and the answer sort of depends. If you're using it for personal use, always... ALWAYS, be aware of the sync settings of your Dropbox account. Many time if you install the client on a machine, you don't take the time to actually check what gets synchronized to that machine. 

I've seen folks load personal data onto public computers or load information onto machines that were infected. Additional recommendations revolve around limiting Dropbox use on unknown or even public WiFi spots. 

If you work in a compliance or regulatory shop - services like Dropbox will pretty much be stopped at the border. I like Dropbox and use it for personal use. However, I'm careful with what I upload to my account and what I synchronize.

Another good tip is to periodically check all of your "shared" folders or links. In many cases, lots of those shared links are old and no longer necessary. 
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
2/24/2014 | 12:13:04 PM
What about Dropbox?
Thanks for the ideas Bill. What are your best practices re storing data in a service like Dropbox?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9710
Published: 2015-05-27
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time windo...

CVE-2014-9715
Published: 2015-05-27
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that trig...

CVE-2015-2666
Published: 2015-05-27
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to t...

CVE-2015-2830
Published: 2015-05-27
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate...

CVE-2015-2922
Published: 2015-05-27
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?