Demystifying cloud computing security
by Mirko Zorz - Monday, 10 October 2011.
In addition, enterprises can also deploy Private Clouds in order to have more complete control over security capabilities (whether hosted onsite or off-premises). With private clouds, your enterprise controls the entire software stack as well as the underlying virtualization platform, self-service provisioning and metering tools and hardware infrastructure – plus the people resources required to administer the entire environment. In fact, many enterprises have already started down this path by deploying virtualized infrastructures in their data centers. Virtualization forms the basis of most cloud offerings and offers some of the key benefits of cloud computing, such as more efficient utilization of compute and storage resources, while also offering more control over how security controls are implemented in the infrastructure.

One of the most talked about problems surrounding cloud computing has been trust. The malicious insider threat is something that no software can protect from, and when a company puts its confidential data in the cloud, and that data is to some degree accessible by a third-party, countless problems come to mind. What controls can be put in place to positively eliminate this type of threat?

Insider threats pose an interesting and growing challenge for organizations. According to a recent U.S. Chamber of Commerce study, disgruntled employees or employees transitioning out of a position have cost companies tens of millions. The definition of insiders is also evolving to include outsourced personnel, contractors and partners. Also, a recent Verizon Business data breach study reports that the number of insider threat incidents investigated nearly doubled compared to last year.

As with most IT challenges, the key to effectively managing insider threats includes a combination of people, process and technology. Here are some examples of best practices in this area:

Trust but verify: Monitor activities of privileged insiders such as DBAs, developers, system administrators and outsourced personnel. Continuous, real-time monitoring is crucial for rapidly detecting suspicious or unauthorized activity – such as a customer service rep downloading hundreds of sensitive data records in a single day -- and limiting exposure to attacks and misuse. Monitoring of privileged users is also a requirement for compliance regulations such as SOX, PCI, HITECH, and FISMA2. Database activity monitoring (DAM) and database auditing technologies allow organizations to generate a secure, non-repudiable audit trail for all database activities that impact security posture such as creation of new accounts, data integrity such as changing sensitive data values or schemas, or viewing of sensitive data. In addition to being a key compliance requirement, granular audit trails are also important for forensic investigations.

Monitor the application layer: Monitor the activities of end-users that access sensitive data via multi-tier enterprise applications such as SAP, PeopleSoft and Cognos. Well-designed DAM solutions can associate specific transactions at the database tier with specific end-user accounts, in order to deterministically identify individuals that are violating corporate policies. In addition, combining database auditing information with access logs from applications and host system, via a Security Information and Event Management (SIEM) system, to see everything that a user has done, can also provide critical information and analytics for forensic investigations.

Review entitlements: Periodically review entitlement reports (also called User Right Attestation reports) as part of a formal audit process. Make sure you follow the principle of “least privilege,” but remember that DBAs typically need to have privileged access to sensitive databases to accomplish their jobs (hence the need to monitor and audit their activities). Enforce corporate policies that forbid sharing of privileged credentials, since this eliminates accountability.

Don’t forget terminated employees: There are numerous examples of former employees who stole data from ex-employers or sold their administrative credentials on the black market. Make sure IT is involved in the employee termination process, so that all of the former employee’s accounts – including remote access – are automatically de-provisioned immediately.


What's the real cost of a security breach?

The majority of business decision makers admit that their organisation will suffer an information security breach and that the cost of recovery could start from around $1 million.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Feb 12th