May 03, 2013 - by Carlos Cardenas
We recently welcomed Carlos Cardenas to the Joyent team as our Director of Solutions Engineering. Carlos is a security expert having come from The Institute for Cyber Security (ICS) at the University of Texas, San Antonio. While at ICS, Carlos worked under Ravi Sandhu, PhD, one of the leading security experts in the world. We expect Carlos to contribute significantly from both a thought leadership and technical perspective in the coming year, and he’ll be sharing his insight on the blog regularly.
We recently sat down with Carlos to learn about some of his thoughts on cloud security. He shared an overview of his vision and what he considers to be the four keys of cloud security. In the coming months, he’ll go into greater depth on all these topics, but here’s what Carlos believes you should expect from any provider.
If you back up your data to the cloud, your Cloud Service Provider (CSP) shouldn’t be able to see the data you store. “They can’t guarantee that!” you say. “I have to encrypt the data before it leaves my machine.” That’s all well and good, until you are relying on your CSP for this service, like Server Side Encryption available in AWS S3 where they manage your keys. How does one ensure the management of these keys to prevent an administrator from decrypting your data?
How do you know that your CSP didn’t log into your machines when you weren’t looking? Well, unfortunately in most cases, you don’t. Sure, you can check your logs, but the really good hackers (and even the script kiddies with good tools) can remove log entries and modify timestamps. You need a way to verify that you’re the only one logging into your machines. To expand on this, customers typically have the ability to manage their images and snapshots they run in the cloud. How does one ensure that no one has tampered with those images when they were made? Take the marketplace where companies buy and sell images to other users -- how can the buyer ensure the image they are purchasing does not contain any malware, viruses, or other malevolent software with or without the seller knowing?
This can be a plague on any CSP, as AWS has seen with a misconfigured application file -- it takes out an entire availability zone, as it did on April 20, 2011 for EBS. The solution is to have multiple availability zones. When one zone fails, there’s no security risk because another is ready to take over.
This is the holy grail of cloud security, and it’s one that many providers are not aware of. What this means is that as an administrator, you can verify to the user that their actions are their actions, and that you didn’t complete any actions yourself. And as user, I can verify that my actions are my actions -- I can see that I’m the one that did them. More importantly, an auditor (or other 3rd party) can go in and determine which actions were completed by which parties.
For many people, these concerns aren't at the forefront of their minds -- but there are all kinds of advantages to this level of insight. At Joyent, we’re committed not to just providing these levels of security but also to educating businesses on its importance.
We’re excited that Carlos has joined us as we continue to focus on cloud security in the coming months and years!