Cloud
1/31/2013
08:34 PM
Connect Directly
RSS
E-Mail
50%
50%

The Physical Security Factor With Cloud Providers

Anyone with access to your cloud providers' servers has access to your data. Don't think burglars or Ethan Hunt of 'Mission Impossible': think insiders and search warrants

Data center operator Rackspace takes the physical security of its facilities seriously.

In a post on the topic earlier this month, the company, which declined to be interviewed for this article, outlined some of the standard security procedures it takes to make sure that outsiders, and even rogue employees, do not have unaudited access to their customers' data. Among the measures are biometric two-factor authentication, video surveillance in all its facilities, and monthly access reviews.

"Security in the cloud is not just virtual," Jim Battenberg, cloud evangelist for Rackspace, writes in the post. "There are a host of physical controls that must be in place to ensure secure computing in the cloud."

No wonder: A rash of server thefts from data centers hit the industry in 2008 and served as a lesson to companies to beef up their security. Among the victims, financial house HSBC, Cable & Wireless's hosting services, and even Peter Gabriel's website.

Insiders are also a threat. While a physical breach may not be a company's most major risk, or even in the top five risks, it is still a significant security issue, says Rocky DeStafeno, CEO of security consultancy VisibleRisk, because insiders are regularly bribed for their access to information.

"The problem is the cost of bribing someone for data is minuscule," he says. "The cost of top secret information is almost always in hundreds of dollars per secret, not millions."

And for all its diligence, Rackspace's security measures--or those of any other provider--could likely all be circumvented with a single piece of a paper: A search warrant or, more drastically, the national security letters used to hunt down spies and terrorists. In June 2011, for example, Instapaper lost the use of a server because it was taken during a raid by the FBI.

Companies move to the cloud to become more efficient, better manage their data, and gain ready access from anywhere. Unfortunately, they are also giving up control over access to their information, says Oded Horovitz, co-founder and CEO of startup PrivateCore. Even encrypted data, to be processed by applications in the cloud, has to be decrypted, and that means putting it in danger.

"Cloud providers might claim that they have the best physical security in the world, but how do you know that?" Horovitz asks. "It's not that physical security is different because it's in the cloud, the difference is that you are no longer doing it, someone else is doing it for you, and now you have trust somebody with physical security."

[Anxiety over the security of cloud services has waned, according to new research, showing that enterprises are becoming a bit less worried than they used to be. See Survey: IT Less Stressed About Cloud Security.]

PrivateCore aims to allow companies to attest that their data is safe. Using Intel's Trusted Execution Technology (TXT), PrivateCore has created its own secure hypervisor that allows a company to control and secure its own private virtual machines, even if they are running on public cloud infrastructure.

The company's technology is able to encrypt any code and data in memory, Horovitz says, and provides a secure hypervisor with a very small attack surface. Sensitive data is only decrypted inside a processor that is based on the trusted-computing technology. The technology will allow companies to have faith in the security of the virtual machine running in the cloud, as long as it is running on the trusted platform, Horovitz says.

"We make it so you don't have to trust anything except inside the CPU," he says. "Unless encrypted, even the system's memory cannot be trusted."

Last June, PrivateCore obtained $2.25 million in seed funding to develop the technology.

The technology appears interesting, but the security will rely on the implementation and how the keys are managed, says VisibleRisk's DeStafeno. Until they are ready to adopt such technologies, companies can request that their providers attest to certain security measures, perhaps most important among them is having an audit trail of who accesses the client's servers.

"One of the most simple things is to ask how detailed is the audit of who is accessing the systems," he said. "If there is access outside the audit, then it become very simple for insiders to steal data."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AKessler
50%
50%
AKessler,
User Rank: Strategist
2/4/2013 | 10:20:34 PM
re: The Physical Security Factor With Cloud Providers


It's
inevitable that enterprises will lose some degree of control when they move
data to the cloud, but the economics are enormously compelling; the key is to
mitigate business risk. From where I sit, it all comes down to putting in place
data security technologies that let enterprises secure even their most
sensitive data and gather the level of security intelligence necessary to let
them embrace the cloud with confidence. CISOs can maintain control of their
sensitive data - even in the cloud - if they put in place the appropriate
encryption, key management and privileged access controls and policies. Doing
this will protect them adequately against both insider threats and cloud
service provider snooping in ways that will accelerate cloud adoption.

Larry Seltzer - UBM Tech
50%
50%
Larry Seltzer - UBM Tech,
User Rank: Apprentice
2/1/2013 | 1:02:14 PM
re: The Physical Security Factor With Cloud Providers
Amazing. I can only assume it's decrypted in on-board cache because you can't encrypt/decrypt one register at a time. I'll have to look them up at RSA in San Francisco later this month.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7298
Published: 2014-10-24
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.

CVE-2014-8346
Published: 2014-10-24
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.