Cloud-based IDS architectures : APPLYING THE IDS APPROACHES INTO THE CLOUD ENVIRONMENT

Editor's Notes

1. This is an oversimplification of the cloud security issues but it is definitely correct on a high level: there is only so much you can do to improve security if you use a software as a service provider (SaaS), who is hell bent on not being supportive of your security requirements
2. Source: CSA standard slideThis is where the mysteries of PCI in the cloud start to come to life : Especially note those yellow boxes with the word JOINT (which, sadly, often means finger pointing and glaring security holes)Also, note that for cloud security (and for cloud Payment security as well as PCI ) you will have to trust the provider in regards to physical security.
3. It is funny that this view of the world and of the cloud also has a hidden implication : if you neighbor is hacked in a traditional environment , you have a perfectly good grounds for saying “I don’t care.” But in case of shared infrastructure – cloud! – Being able to say that because more and more rare – or more and more risky.
4. https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdfThe purpose of this document, “Top Threats to Cloud Computing”, is to provide needed context to assist organizations in making educated risk management decisions regarding their cloud adoption strategies. In essence, this threat research document should be seen as a companion to “Security Guidance for Critical Areas in Cloud Computing”. As the first deliverable in the CSA’s Cloud Threat Initiative, the “Top Threats” document will be updated regularly to reflect expert consensus on the probable threats which customers should be concerned about. There has been much debate about what is “in scope” for this research. We expect this debate to continue and for future versions of “Top Threats to Cloud Computing” to reflect the consensus emerging from those debates. While many issues, such as provider financial stability, create significant risks to customers, we have tried to focus on issues we feel are either unique to or greatly amplified by the key characteristics of Cloud Computing and its shared, on-demand nature. We identify the following threats in our initial document: Abuse and Nefarious Use of Cloud Computing Insecure Application Programming Interfaces Malicious Insiders Shared Technology Vulnerabilities Data Loss/Leakage Account, Service & Traffic Hijacking Unknown Risk ProfileThe threats are not listed in any order of severity. Our advisory committee did evaluate the threats and each committee member provided a subjective ranking of the threats. The exercise helped validate that our threat listing reflected the critical threat concerns of the industry, however the cumulative ranking did not create a compelling case for a published ordered ranking, and it is our feeling that greater industry participation is required to take this step. The only threat receiving a consistently lower ranking was Unknown Risk Profile, however the commentary indicated that this is an important issue that is simply more difficult to articulate, so we decided to retain this threat and seek to further clarify it in future editions of the report
5. LOSS OF GOVERNANCE: in using cloud infrastructures, the client necessarily cedes control to the Cloud LOCK-IN: there is currently little on offer in the way of tools, procedures or standard data formats ISOLATION FAILURE: multi-tenancy and shared resources are defining characteristics of cloud computingCOMPLIANCE RISKS: investment in achieving certification (e.g., industry standard or regulatory MANAGEMENT INTERFACE COMPROMISE: customer management interfaces of a public cloud providerDATA PROTECTION: cloud computing poses several data protection risks for cloud customers and providers. INSECURE OR INCOMPLETE DATA DELETION: when a request to delete a cloud resource is made, as with most MALICIOUS INSIDER: while usually less likely, the damage which may be caused by malicious insiders is