Hot Topics:Mobility in the Cloud Adam Goldstein - IT Security Engineer, Dartmouth College EduCause Security Professionals Conference– April 13, 2010

Data on the Move… Institutional data is increasingly leaving the institution Mobile devices mean mobile data Drivers: Productivity Telecommuting Users like them! Services in the Cloud Cost Ease of use Allows institutions to focus on their core business

Data Protection Protecting data is as important as ever-why? Cybercrime and fraud a growing trend and significant problem Data protection laws Compliance trends Significant cost of breaches

The dilemma… How do we protect data when the data is on the move?

Cloud Computing- Definitions Software as a Service (SaaS) Google Apps, Salesforce.com, MS BPOS Platform as a Service (PaaS) Google App Engine, MS Azure, Force.com Infrasctucture as a Service (IaaS) Amazon EC2 Rackspace Cloud GoGrid

The Appeal of the Cloud Low cost Ease of use Scalability Minimizes infrastructure requirements Allows schools to focus on being a school

Concerns with the Cloud Some of the commonly cited concerns include: Bandwidth limitations Service availability Security!!! Legal issues!!!

Cloud-Security Concerns Technical concern examples: Authentication issues (both users and admins) Consolidating targets for the bad guys Procedural concern examples: Auditing? Are vendors implementing appropriate controls?

Cloud Security Concerns- Authentication Example Most vendors use a web-based admin console to control server instances Console accounts use username/password Doesn’t matter how secure the service is if attacker can get console credentials Phishing/spearfishing Sharing credentials Guessing Sniffing

Cloud Security Concerns: Target Example As more institutions move to popular Cloud services – will attacks change? CSRF (cross-site request forgery) example Can bad guys exploit that many users will be logged in to the same application ? Facebook CSRF Or more relevant- Banner CSRF (http://www.browndailyherald.com/campus-news/hickey-08- squashes-banner-bug-1.1673319)

Cloud Security Concerns: Vendor processes Limited auditing: Many vendor AUPs prohibit performing security tests against cloud services Minimal understanding of back-end security What can cloud companies access? What controls do they have in place? (HR, assessments, physical)

Risks to customers – Data retention/e-discovery Few published policies on how Cloud providers handle e-discovery requests What about internal investigations? What remains when data is deleted? Do Cloud providers perform their own backups? What is their retention policy? Do providers collect and retain access logs?

Cloud Legal concerns: Privacy Hosted e-mail… “We will not monitor your use of the online service, …track, view, … your subscriber data that are processed … by the online service except to…improve xxx products or online services” –not from who you think!

Cloud Legal concerns: Compliance and regulation trends All trends indicate that institution’s will be increasingly responsible for protecting data? Who will be responsible for protection? Breach? Even if it is not the institution’s fault, whose name is in the paper?

Cloud Legal concerns: Contracted services What happens to your data when contracts end? What happens if a vendor goes under! Putting data in the cloud is easy- how about getting it back?

Cloud Legal concerns: Contracted services We may suspend the online service: if we believe that your use of the online service represents a threat… We may cancel the online service: if we believe that your use of the online service violates the scope of use terms; “After we suspend or cancel the online service, you may not be able to access your data through the online service.”

Securing data on the move? Addressing the dilemma Institutional data security policies Required controls for vendors Technical solutions Understanding the true “cost” of cloud services And perhaps most important: What is your institutional stance on balancing security and mobility?

Additional Info: Contract Addendum for Vendors Data Protection Encryption (in-transit and at-rest) Network Security Secure Disposal Software Development Access Control Vulnerability Management Incident Response

Peter Kiewit Computing Services Thanks! Adam Goldstein IT Security Engineer Peter Kiewit Computing Services Adam.goldstein@dartmouth.edu