-: These days,
cloud computing seems to be
the big trend within our industry.
But what exactly is cloud computing?
Well, cloud computing is defined as
a way of offering on-demand services
that extend the traditional capabilities
of a computer or a network,
out into the Internet.
With the promise of increased availability,
higher resiliency,
and unlimited elasticity,
the cloud definitely can provide
our organizations a lot of advantages
over our traditional network architectures.
But cloud computing can also bring
a number of unique security challenges
into our environments, too.
For cloud computing to gain its
intended cost savings and efficiencies, though,
it relies heavily on the concept of virtualization.
By using virtualization,
numerous logical servers can be placed
on a single physical server.
This, in turn,
can help us reduce the amount of physical space,
power, and cooling
that's needed inside your data center.
Additionally,
by using virtualization,
we can achieve higher levels of availability
by spinning up additional virtual servers, when necessary.
This ability to dynamically provision
memory and CPU resources,
is one of the key benefits to cloud computing.
While there are a lot of benefits to cloud computing,
such as decreased cost,
increased scalability,
and unlimited elasticity,
there are also numerous security issues
that we have to consider.
Most of the same security issues
that we have with physical servers
also get carried over into
the cloud computing environment, too.
Oftentimes,
I hear executives think that all of their problems
will be solved by moving to the cloud.
This is simply not the case.
To gain these efficiencies,
cloud providers rely on virtualization
to allow multiple logical servers
to be placed on that single physical server,
as we said before.
Many cloud service providers, though,
have taken virtualization a step further
with the concept of hyper-converged infrastructure.
This allows providers to fully integrate the storage,
network, and servers
without having to perform hardware changes.
Instead,
they rely on a software and virtualization technology
to perform all of the needed integrations.
All of this can be managed from
a single interface or a device,
without any worry about the underlying vendor solutions.
Many cloud providers are also offering
Virtual Desktop Infrastructure as one of their services.
VDI allows a cloud provider to offer
a full desktop operating system
to an end user from a centralized server.
There are a lot of security benefits to this approach.
For example,
one organization that I worked with
creates a new virtual desktop image for each user
every time they log on in the morning.
This desktop is non-persistent.
So, even if it's exploited by an attacker,
it is destroyed as soon as
the user logs off at the end of the day,
or at midnight each night.
This effectively destroys the attacker's ability
to remain persistent on the end user's desktop,
and adds a lot of security for us.
Now, when we look at these numerous logical servers
being stored on a single physical server,
we also have to consider that there has to be a way
to keep the data confidential and separated
from the other logical servers, too.
To do this,
we use Secure Enclaves and Secure Volumes.
Secure Enclaves utilize two distinct areas
that the data may be stored and accessed from.
Each enclave can be accessed by the proper processor.
This is a technique that's used by Microsoft Azure
and many other cloud service providers.
Secure volumes, on the other hand,
are a method of keeping data at rest,
secure from prying eyes.
When data on the volume is needed,
a secure volume is mounted
and it's properly decrypted to allow that access.
Once the volume is no longer needed, though,
it's encrypted again and unmounted from the virtual server.
This is the same concept that's used by BitLocker
on a Windows laptop,
or FileVault on a MacBook.