Achieving Security in the Cloud

A major advantage of cloud computing is energy and space savings (Credits: Rachel C. Samples).

Large amounts of data can lead to increasing complications in securing and accessing, storing and analyzing. A rising trend to save money and increase capability is to use cloud computing. One of NASA’s upcoming challenges will be its transition to cloud computing, as identified by Inspector General Paul K. Martin during his Feb. 29 testimony to the US Congress.

“Cloud computing offers the potential for significant cost savings through faster deployment of computing resources, a decreased need to buy hardware or build data centers, and enhanced collaboration capabilities,” said Martin. “However, along with these benefits are potential risks such as when the provider of cloud-computing services experiences infrastructure failure or loss of customer data.”

Seeing the need for information in this sector, Space Safety Magazine sat down with Michael Baker, the Chief Technology Officer of Packetloop at Black Hat Europe 2012. Packetloop is a cloud computing consulting company that specializes in ‘Big Data’ Security.

Baker’s presentation, Finding Needles in Haystacks the Size of Countries, focused on how a technique called ‘Big Data’ could find small, complex attacks in vast amounts of information.

“’Big Data’ is a more generic phrase to summarize the explosion of data on hard disks, in data bases, and created by the exponential growth of the Internet. Big Data is like this mountain of information that needs to be processed and analyzed,” said Baker. “So I am really taking a lot of concepts of distributed processing in relation to Big Data.”

A key message of the session was that ‘Prevention fails, and detection is the key.’ Combining methodologies in Network Security Monitoring, Full Packet Capture, and Big Data tools, a new way of analyzing enormous amounts of information is possible. You can read more about Baker’s presentation on his blog, but for most in the space industry there is a need to start with the basics: how should a space agency like NASA approach data and cloud computing?

What is cloud computing?

Baker begins by comparing the modern approach to computing to the pre-Cloud days. “Everything had to be on a box in my premises,” said Baker. “A computer was basically connected with a single server which hosted all its storing and processing capabilities. Now instead of having lots of servers on site, one can use the space and power of a 3^rd party.”

This idea of taking space from other places is Cloud computing. Utilizing this resource is actually two processes; the first is method of dividing computing needs and the second in storing/accessing additional power and space.

“It’s taking a job or a task that use to be run on a single server and dividing it,” said Baker. “Reconstruct the job and spread it across multiple servers.”

Michael Baker at Black Hat 2012 (Credits: Provided to Space Safety Magazine by Michael Baker).

Why would cloud computing be a challenge?

People currently rely on cloud computing without even knowing it. Drop Box or Google Docs is a prime example. Amazon has even started selling cloud computing storage to companies. Why would NASA see switching as a challenge?

In matters of security Baker explains that many companies switch to cloud computing without fully exploring the issues, making ‘cheap cost compromises.’

“You can’t migrate all the security controls to the cloud,” said Baker. “Any kind of data that relies on third parties needs an equal level of security controls.”

Baker recommends that agencies like NASA would need to investigate how to integrate or ensure that their on-site security levels are transferred to the 3^rd party.

Baker then goes on to explain how there are many misleading notions about what to expect from 3^rd party providers of services. “Most of the cloud providers are hands off,” said Baker. He gives the example of how Amazon doesn’t monitor inbound/outbound traffic for security events such as intrusions, anti-virus, or anti-malware. When there is a problem with security many companies expect 3^rd parties to be able to quickly fix the situation.

“When NASA moves to the cloud there is no magical security level they achieve provisioning services there,” said Baker. “There is still a job for NASA to do to secure their infrastructure in the Cloud.”

In the video below, MIT researcher Andrew McAfee suggests ways any organization can start taking advantage of cloud computing:
[youtube http://www.youtube.com/watch?v=ME9VQVqkzFw]