Slide 1

Ragib Hasan University of Alabama at Birmingham CS 491/691/791 Fall 2011 Lecture 1 08/16/2011 Security and Privacy in Cloud Computing

Slide 2

Welcome to the class Administrative details When? : Tue/Thu 11am-12.15pm Where?: CH 430 Web: http://www.cis.uab.edu/cs491/fall2011http://www.cis.uab.edu/cs491/fall2011 Instructor: Ragib Hasan, CH126 / UBOB 214 ragib@cis.uab.eduragib@cis.uab.edu Office hours: Tue 12.30 pm-1.30 pm (more TBA) 8/16/2011CS491/691/791 Fall 20112

Slide 3

Introductions Please tell us Your name What level (grad, undergrad, PhD/MS/BS) you are currently Your advisor Your research interests Anything fun/interesting about you 8/16/2011CS491/691/791 Fall 20113

Slide 4

Goals of the course Identify the cloud computing security issues Explore cloud computing security issues Learn about latest research 8/16/2011CS491/691/791 Fall 20114

Slide 5

Plan Each week, we will Pick a different cloud computing security topic Discuss general issues on the topic Read one or two latest research paper on that topic 8/16/2011CS491/691/791 Fall 20115

Slide 6

Evaluations Based on paper reviews, term project, and class/discussion participation Reviews: Students taking the course for credit will have to submit 1 paper review per week The reviews will be short, 1 page discussion of the papers pros and cons (format will be posted on the class webpage) Project: Students (or groups) can pick any topic related to cloud security. 8/16/2011CS491/691/791 Fall 20116

Slide 7

Example Review Summary Mention what problem the paper addresses. What is the approach, and what are the results. Pros Advantages or features you liked. At least 3. Cons Disadvantages or shortcomings. At least 3. Ideas How can you improve the system? Short 2/3 sentence comment on your ideas. 8/16/2011CS491/691/791 Fall 20117

Slide 8

Topics we will cover 8/16/2011CS491/691/791 Fall 2011 Data and computation integrity and confidentiality Infrastructure, topology Data Privacy NetworkingForensics 8

Slide 9

Required Background Strong background in security is NOT required This is NOT a crypto course, so its fine if you dont understand the math in a paper Only basic background in common security concepts is needed (e.g., do you know what confidentiality, integrity, and availability mean? Whats a private key? Whats encryption, hashing?) Well take a systems approach towards security, i.e. think about the systems practicality, performance etc. 8/16/2011CS491/691/791 Fall 20119

Slide 10

Clouds have become ubiquitous How many of you have used a cloud today? Probably, everyone!! 8/16/2011CS491/691/791 Fall 201110

Slide 11

What is Cloud Computing? 8/16/2011CS491/691/791 Fall 2011 Lets hear from the experts 11

Slide 12

What is Cloud Computing? 8/16/2011CS491/691/791 Fall 2011 The infinite wisdom of the crowds (via Google Suggest) 12

Slide 13

What is Cloud Computing? 8/16/2011CS491/691/791 Fall 2011 Larry Ellison, founder of Oracle Weve redefined Cloud Computing to include everything that we already do.... I dont understand what we would do differently in the light of Cloud Computing other than change the wording of some of our ads. 13

Slide 14

What is Cloud Computing? 8/16/2011CS491/691/791 Fall 2011 Richard Stallman GNU Its stupidity. Its worse than stupidity: its a marketing hype campaign 14

Slide 15

What is Cloud Computing? 8/16/2011CS491/691/791 Fall 2011 Ron Rivest The R of RSA Cloud Computing will become a focal point of our work in security. Im optimistic 15

Slide 16

So, What really is Cloud Computing? Cloud computing is a new computing paradigm, involving data and/or computation outsourcing, with Infinite and elastic resource scalability On demand just-in-time provisioning No upfront cost pay-as-you-go 8/16/2011CS491/691/791 Fall 2011 That is, use as much or as less you need, use only when you want, and pay only what you use, 16

Slide 17

The real story Computing Utility holy grail of computer science in the 1960s. Code name: MULTICS 8/16/2011CS491/691/791 Fall 2011 Why did it fail? Ahead of time lack of communication tech. (In other words, there was NO (public) Internet) And personal computer became cheaper and stronger 17

Slide 18

The real story Mid to late 90s, Grid computing was proposed to link and share computing resources 8/16/2011CS491/691/791 Fall 201118

Slide 19

The real story continued 8/16/2011CS491/691/791 Fall 2011 Post-dot-com bust, big companies ended up with large data centers, with low utilization Solution: Throw in virtualization technology, and sell the excess computing power And thus, Cloud Computing was born 19

Slide 20

Cloud computing provides numerous economic advantages For clients: No upfront commitment in buying/leasing hardware Can scale usage according to demand Barriers to entry lowered for startups For providers: Increased utilization of datacenter resources 8/16/2011CS491/691/791 Fall 201120

Slide 21

Cloud computing means selling X as a service IaaS: Infrastructure as a Service Selling virtualized hardware PaaS: Platform as a service Access to a configurable platform/API SaaS: Software as a service Software that runs on top of a cloud 8/16/2011CS491/691/791 Fall 201121

Slide 22

Cloud computing architecture 8/16/2011CS491/691/791 Fall 2011 e.g., Web browser SaaS, e.g., Google Docs PaaS, e.g., Google AppEngine IaaS, e.g., Amazon EC2 22

Slide 23

Different types of cloud computing 8/16/2011CS491/691/791 Fall 2011 Amazon EC2 Clients can rent virtualized hardware, can control the software stack on the rented machines Google AppEngine Provides a programmable platform that can scale easily Microsoft Azure Clients can choose languages, but cant change the operating system or runtime IaaS PaaS 23

Slide 24

So, if cloud computing is so great, why arent everyone doing it? 8/16/2011CS491/691/791 Fall 2011 Clouds are still subject to traditional data confidentiality, integrity, availability, and privacy issues, plus some additional attacks 24

Slide 25

Companies are still afraid to use clouds 8/16/2011CS491/691/791 Fall 2011 [Chow09ccsw] 25

Slide 26

Anatomy of fear Confidentiality Will the sensitive data stored on a cloud remain confidential? Will cloud compromises leak confidential client data (i.e., fear of loss of control over data) Will the cloud provider itself be honest and wont peek into the data? 8/16/2011CS491/691/791 Fall 201126

Slide 27

Anatomy of fear Integrity How do I know that the cloud provider is doing the computations correctly? How do I ensure that the cloud provider really stored my data without tampering with it? 8/16/2011CS491/691/791 Fall 201127

Slide 28

Anatomy of fear Availability Will critical systems go down at the client, if the provider is attacked in a Denial of Service attack? What happens if cloud provider goes out of business? 8/16/2011CS491/691/791 Fall 201128

Slide 29

Anatomy of fear Privacy issues raised via massive data mining Cloud now stores data from a lot of clients, and can run data mining algorithms to get large amounts of information on clients 8/16/2011CS491/691/791 Fall 201129

Slide 30

Anatomy of fear Increased attack surface Entity outside the organization now stores and computes data, and so Attackers can now target the communication link between cloud provider and client Cloud provider employees can be phished 8/16/2011CS491/691/791 Fall 201130

Slide 31

Anatomy of fear Auditability and forensics Difficult to audit data held outside organization in a cloud Forensics also made difficult since now clients dont maintain data locally 8/16/2011CS491/691/791 Fall 201131

Slide 32

Anatomy of fear Legal quagmire and transitive trust issues Who is responsible for complying with regulations (e.g., SOX, HIPAA, GLBA)? If cloud provider subcontracts to third party clouds, will the data still be secure? 8/16/2011CS491/691/791 Fall 201132

Slide 33

What we need is to Adapt well known techniques for resolving some cloud security issues Perform new research and innovate to make clouds secure 8/16/2011CS491/691/791 Fall 201133

Slide 34

Final quote 8/16/2011CS491/691/791 Fall 2011 [Cloud Computing] is a security nightmare and it can't be handled in traditional ways. John Chambers CISCO CEO 34

Slide 35

8/16/2011CS491/691/791 Fall 2011 Further Reading Armbrust et al., Above the Clouds: A Berkeley View of Cloud Computing, UC Berkeley Tech Report UCB/EECS-2009-28, February 2009. Chow et al., Cloud Computing: Outsourcing Computation without Outsourcing Control, 1 st ACM Cloud Computing Security Workshop, November 2009. 35