4

I am working for a company which works with PHI, HIPAA, PCI and other highest sensitivity data. Their current security architecture uses hardware network monitoring tools to monitor the network connections between servers to detect security incidents and other abnormal traffic. They are looking to migrate their applications to the various cloud providers and are wondering how to do something similar there. Are there ways to guarantee network links are exclusively used only by specified hosts or components in the cloud? How would we monitor these connections, or can we only monitor requests coming in to our servers or applications? Is it just a case of trusting the provider's security claims and blaming them if there is a breach? Or can we maintain responsibility and control and should we? What are some other cloud specific security challenges that we might not be considering and how do we mitigate those? Thank you for any good info or references.

2

Are there ways to guarantee network links are exclusively used only by specified hosts or components in the cloud?

This depends on your cloud provider. Most cloud providers will allow this if for instance you want them to build a full private cloud for them. If you are looking for this option to provide security in terms of availability by offering connectivity from multiple data centers, then yes you could ask them. But do note this comes with a price tag.

How would we monitor these connections, or can we only monitor requests coming in to our servers or applications?

You could opt to procure IDS/IPS or WAF systems (virtual or physical) to monitor these lines. Note that in the end you are working with a cloud provider to save cost on maintenance or provide scalability, so most likely the cloud provider will have access to it

Is it just a case of trusting the provider's security claims and blaming them if there is a breach?

Probably they have their ass covered with regard to such demands and they will put blame on you.

What are some other cloud specific security challenges that we might not be considering and how do we mitigate those?

The most issues I see in the real world is with regard to hosting information in certain countries. For instance banking information from Switzerland and Luxembourg can only be hosted in those respective countries and no where else. The one fabulous thing about cloud computing is that you can have geographical failover, which means distributing your data across countries. So if you have requirements in place that require you to not distribute information to certain countries (e.g. in Europe many companies do not want to have their information sent to datacenters in the US) than you need to make those clear as well to your hosting provider.

Finally I would like to add these comments:

First you need to understand why you want to move things to the cloud. Is this for more flexible computing, less hardware maintenance, reduced costs for operating a data center, etc... or is it because someone saw that the "cloud" (did you know cloud can be replaced with just "somewhere on the internet") is cool and decided to move everything there because he heard other people were doing it.

If you do require flexible computing and scalability it might make more sense to build your own cloud infrastructure so you have full control of your environment.

Many people believe cloud computing is about automagically getting cost reduction by not having to host your own hardware, but it's at its core not different from using a managed hosting provider.

Cloud computing at its core is about scalability, flexibility and availability. If you require these properties it makes sense to move your applications into a cloud environment, if you don't then you need to reconsider.

  • Thank you for your very well thought out feedback! I have a lot of questions, but first thing just wanted to thank you and also to say that as I was considering my advice to this company I was considering just saying "don't move to the cloud" lol! Has anyone said yet that cloud providers are more secure than what an enterprise can do on their own? – Infin8Loop Mar 14 '16 at 2:20
  • they have not and most of the time the more secure is true about the cloud provider's backend systems rather than improving the security for the end user. – Lucas Kauffman Mar 14 '16 at 3:43
  • "Probably they have their ass covered with regard to such demands and they will put blame on you." - This. This is important. Unless they specifically, in writing, and in the format required in each jurisdiction you can be held accountable in specifically accept all liability for any breaches (and they won't), then you can bet their lawyers have covered such an essential risk in their business plan. They may have spent more on legal advice there than you are on your cloud hosting. – Anti-weakpasswords Mar 14 '16 at 6:21
  • Both Azure and AWS advertize HIPAA / PCI compliance on their websites. Doesn't this mean they take the responsibility for breaches? I still understand that if a company dealing with health or financial info experiences a breach, their reputation would be affected. Saying "We trusted Amazon/Microsoft" isn't really a response the customers would appreciate. – Infin8Loop Mar 14 '16 at 14:23
  • Only way to check this is to take it into a contract – Lucas Kauffman Mar 14 '16 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.