09:05 AM
Bill Kleyman
Bill Kleyman
Connect Directly

How I Secure My Personal Cloud

As global cloud traffic grows exponentially, IT pros face the daunting task of securing their personal cloud, data, and workloads.

Trends around cloud computing are moving fast. The latest Cloud Index Report from Cisco shows that by 2017, global cloud IP traffic will reach 443 exabytes per month -- up from 98 exabytes per month in 2012. In five years, global cloud IP traffic will increase nearly fivefold.

For security practitioners like me, this rapid growth has created a number of new fields, professional opportunities, and methodologies. But what, as a user, is the best way to secure the cloud, data, and workload points in your lab or corporate setting?  Here’s what I do.

My hypervisor
The challenge used to be around requirements related to virtual on top of a hypervisor. Traditionally, clients that had to sit on the virtual machine became resource hogs. In my lab and in many customer deployments, I really enjoy working with client-less antivirus software.  5nine offers great client-less security on the Hyper-V platform while Trend Micro covers VMware. Both, as well as others, integrate at the virtual layer in the hypervisor through APIs, and both provide robust security.

My data
There are a few ways to look at this. Some data must be protected at the local layer, while other data resides in the cloud. Locally, drive encryption is a good choice. If you’re working with a larger storage array, segmenting your SAN/NAS network traffic on a vLAN and then monitoring that traffic really helps. A great example would be Palo Alto’s virtual firewall appliances running PAN-OS. This, along with similar products, represent a next-generation piece of security that sits in your cloud or at the datacenter, continuously monitoring data during peak and low times.

My physical machines
At home, a solid AV engine can do the trick. I really like light, cloud-based AV engines that don’t take up a lot of resources. Panda and Immunet both offer free, cloud-based AV services. At the corporate side, I lock down information rather than the machine, using app and desktop virtualization that can centrally store all of my information. This makes the machine just a set of resources without any valuable data at the end-point.

My end-points
This is where mobility comes into play. I’ve had the chance to test products like XenMobile from Citrix as well as the newly VMware-acquired AirWatch platform. The idea here is the create mobility and security. These end-point security mechanisms are all virtual, deploy powerful policies to pretty much any smart device, and even optimize end-user performance. I can lock devices, send them messages, and track them if they are stolen. The nice thing is that I can make these policies automated. For example, if a device leaves a certain security area,  I can require that it be immediately locked and become inaccessible.

My network(s)
There are a lot of best-practices to follow with home networking. For example: Limit open ports, segment your network traffic, always use SSL VPN connections, always monitor your certificates, and create access control lists. I enjoy working with Layer 2 or Layer 3 switches, which give you extra control over your network. That said, working with SDN can really control your network traffic at that virtual layer.

Recently, I had the chance to play with VMware’s new NSX virtual network platform. The cool security features there allow you to control your network at a logical layer with intelligent network isolation, and even distributed stateful firewalling.

Now it’s your turn. How do you secure your personal cloud? Let’s chat about it in the comments.

Bill is an enthusiastic technologist with experience in datacenter design, management, and deployment. His architecture work includes large virtualization and cloud deployments as well as business network design and implementation. Bill enjoys writing, blogging, and educating ... View Full Bio

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
User Rank: Apprentice
2/24/2014 | 12:13:04 PM
What about Dropbox?
Thanks for the ideas Bill. What are your best practices re storing data in a service like Dropbox?
Bill Kleyman
Bill Kleyman,
User Rank: Apprentice
2/24/2014 | 12:18:16 PM
Re: What about Dropbox?
@Laurianne - Excellent question, and the answer sort of depends. If you're using it for personal use, always... ALWAYS, be aware of the sync settings of your Dropbox account. Many time if you install the client on a machine, you don't take the time to actually check what gets synchronized to that machine. 

I've seen folks load personal data onto public computers or load information onto machines that were infected. Additional recommendations revolve around limiting Dropbox use on unknown or even public WiFi spots. 

If you work in a compliance or regulatory shop - services like Dropbox will pretty much be stopped at the border. I like Dropbox and use it for personal use. However, I'm careful with what I upload to my account and what I synchronize.

Another good tip is to periodically check all of your "shared" folders or links. In many cases, lots of those shared links are old and no longer necessary. 
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/24/2014 | 12:36:16 PM
Where are you on the continuum
Bill, Curious to know where you would put yourself on the security continuum with respect to your peers in IT. Is what you do to secure your personal cloud fairly typical and what you would recommend for anyone looking to lock down their professional work and workload? It seems to me that the idea of fooling around with SDN on a home network would be quite a stretch for even the saviest security practitioners!
Bill Kleyman
Bill Kleyman,
User Rank: Apprentice
2/24/2014 | 1:03:26 PM
Re: Where are you on the continuum
@Marilyn - SDN might be a stretch, you're right. As might be deploying hypervisor-layer security.

However, even on the consumer-side there are some pretty great security platforms. Let's take a couple of examples: NetGear Nighthawk AC1900 and the Asus RT-N66U Dark Knight. Both top of the line consumer routers - both capable of some advanced security - both under $200. Even without loading a mod firmware on these routers, the native software is very powerful. You can create ACLs, configure RADIUS servers, create LAN/wLAN MAC filters, easily setup your own VPN server, and even create network services filters using an advanced firewall.

These interfaces are pretty easy to navigate through and most have very good explanations built right into the GUI. So, good security doesn't have to be limited to the IT elite. In fact, these types of solutions and devices are here to make security much more accessible to the typical end-user.  
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/25/2014 | 9:17:11 AM
Re: Where are you on the continuum
Even those high-end routers seem beyond my capabilities as a user/consumer (Maybe you can create ACLs, configure RADIUS servers, create LAN/wLAN MAC filters, easily setup your own VPN server, and even create network services filters using an advanced firewall -- but know I can't).

But in terms of power users and a security-aware (maybe not elite)  IT professional how much of what you practice would you recommend as a priority for others?

Bill Kleyman
Bill Kleyman,
User Rank: Apprentice
2/25/2014 | 10:38:49 AM
Re: Where are you on the continuum
There are a few things you can do to keep your cloud and data safe -- at a high level:

1. Constant vigilance. Never be complacent around your own security. If you're unsure about a piece of informaiton, a site, or an access point - don't go near it.

2. Keep you software (and firmware) updated. This goes for AV software as well as your router firmware.

3. Browse smart. Be aware of where you are both physically and in the cloud. Don't go to banking or other sites that contain your information from a public spot. Many times there may be someone snooping on that connection.

4. Keep track of your data. The good thing about cloud is that you can really efficiently expand your data footprint to more easily access infomration. This can also be bad thing. Programs like Dropbox allow you to share links -- but don't really remind you that you have shared links open. Keep track of where you store data both physically as well as in the cloud.

5. Be aware of passwords. First of all - please don't make your password something silly. Use good alphanumeric protocols and even throw in a special character in there. I am NOT a big fan of allowing browsers to save my passwords for me. 

6. Don't install, download or open data that you're unsure about. In a previous life - I did some security pen testing for large organizations. One of those projects included dropping an 8GB USB key in the middle of a busy hallway in the hopes that someone would pop it into their computer. We dropped 10 USB keys that had a hidden piece of software that would run as soon as the drive was plugged in. We had an 80% success rate. This holds true for downloading content you're unsure of or opening an email with a strange attachment. If it looks fake or strange -- it probably is.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Published: 2014-10-23
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.

Published: 2014-10-23
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/; the (5) comment parameter to all...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.