Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the standard maintenance and issues that tend to come with any self-hosted stack but the system did work and generated few complaints. From a security perspective, having data in our control and subject to our security standards and controls seems to be a great added bonus. Who knows what kind of sensitive data is floating around in 1:1 chat histories.

The security implications of putting our chat servers, logs, etc. in the cloud with little control should terrify me as a security professional but when I step back and think about everything is transforming and I find myself more and more evaluating new tools that actually do promise the type of security I'd demand out of my own network. This has become a big part of my job-investigating the security implications from going in-house to a managed service.

This is more of a philosophical question to everyone out there who is doing security in a modern company that's trying to provide internal tools that can sometimes only be hosted in the cloud or the best option is to take it out of house. How do you weigh the benefits vs. risks of putting our potentially sensitive information out there to a third party? I have my own assessment methodologies that I've learned over the years but I'm curious what everyone out there is doing, how are you vetting our cloud infrastructure when people want to move things out of your control?

  • 1
    Take a look at the types of questions that really should be asked when evaluating a cloud provider (or, really, any sofware-as-a-service provider) and you quickly see that this can be an exercise in absurdity. I found a great list of such questions here: lts.lehigh.edu/services/explanation/… – willc Nov 7 '14 at 19:22
  • This is an excellent resource! Thanks for sharing. – jmbmxer Nov 10 '14 at 19:11

I infer you're interpreting the cloud as a "tenant based" instance where you are on a hosted server, with 100s of other companies. This is not always the case. Using AWS as an example, or Softlayer, you can throw up your instances and use the same principles to lock things down. E.g., throw on a firewall ACL ONLY allowing connections to your instance from sources you desire.

I have had issues with handing over keys to kingdoms to cloud providers. One thing I never do is trust pretty much anything they say. I go about locking down my instances the same way I would if they were physically present. The biggest issue I have even with that model is, people fail, services fail, so am I willing to take that chance?

Think about the following, you create an instance lock it down to the Nth degree. A rogue Softlayer employee takes a snapshot of your ESX guest, exports it. You'd never know no matter what you put on your guest. This is not to say someone at Softlayer or another company would, but there is that possibility. You're at the mercy of another organization, and you're hoping they are on top of their game with regards to security. THAT in itself is laughable considering the amount of companies that have been breached.

So for me... Had I do throw up a chat server, sure, it'd be encrypted on the wire, in transit, off-site logging, full lock down like everything else. Would I throw up say my databases storing mission critical stuff? No thanks. That's just me.

  • 1
    This is in addition to the other concerns with the cloud... like 'How do I get my data back?' if you decide to change cloud providers/re-host your services internally/etc. – cpt_fink Oct 22 '14 at 3:36
  • Investigate clauses in the hosting contract where the hosting company has the right to do something that would invade your company's privacy or intellectual property, do they allow you to perform similar actions if the roles are reversed. Eg. A virus or attack compromises a system, on either side, who can investigate and what can they ask or divulge about it. – kronenpj Oct 22 '14 at 3:57

To your first point, yes there can be a greater risk. Depending on what an attacker is after, a cloud provider is a great target. You can potentially get lots of juicy information about targets or perhaps even authentication materials. A great example of this is the MongoHQ breach which resulted in Buffer being compromised as they had stored their access tokens unencrypted.

The good news is that if you're moving services to third party services, you presumably have more resources to review these vendors. Obviously like anything there's no silver bullet, but I've found good success with auditing vendors before agreeing to pay them. The important thing is for this process to be lightweight, but since you're a security professional I'm sure that's one of the first things in your mind. Processes that involve friction often are not followed.

I've had great luck with building a 20 question or so questionnaire to ask potential cloud vendors. Asking things like how their security team is structured (oh you don't have one, thanks for playing), how they perform operational security, any standards they adhere to, etc. can help you make a choice.

The process should be transparent and allow you to rate each category and give an overall score. This is important for your internal users so they understand why they can't store your important data in a poorly scored vendor's environment. Your data classification policies may be different than mine, but basically you wouldn't use a provider with a low score with sensitive data. If they are hosting a company directory which is just photos and contact info, maybe the risk isn't so great. If they're hosting your chat logs, which you correctly point out could contain sensitive info, you would want them to be more buttoned up.

  • In a perfect world, a full audit of each vendor would be ideal but it's very rare that we are allowed even a glimpse into the third-parties controls around our data. We have a questionnaire as well and that might be the best we can do. I do like the idea of a risk score that correlates to what tier of sensitive data we can actually let them process. Interviewing references who have used the third-party might also give insight into their controls. I found some good info in this blog post from Accuvant – jmbmxer Oct 22 '14 at 21:18
  • Oh yeah, we only go as far as to ask the questions. At rather large organizations that spend significant money, they might have the resources to audit and the vendors might be willing to be audited, but for most the questionnaire is as far as you can go. Given there is a certain legal liability behind them, vendors generally at least believe they are doing what they say. This stuff is great, a good starting framework for rating providers and prioritizing limited resources. – theterribletrivium Oct 23 '14 at 0:04

You have the comfort that when your cloud provider is compromised, or crashes, you will be in the company of many others.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.