Trusting the Cloud By Paul Hill

How can a company develop trust in the cloud and determine when the risk of using a service is acceptable?

Today, enterprises must trust, and only periodically verify, the integrity of their cloud service providers through annual assessments.  The tools to verify in real time rarely exist and the tools that do exist are primarily focused on providing limited access to log data.

When an enterprise is thinking about using a SaaS vendor or cloud service it has the responsibility to assess the vendor and determine the risks, liabilities, and responsibilities.  To perform an assessment an enterprise might perform an on-site visit and perform an in-depth interview to assess the service.  Or the enterprise may choose to let the vendor perform a self-assessment by responding to a questionnaire.

SystemExperts has assisted several of our clients to assess cloud vendors they are planning to use, or are using.  One favorable trend we are seeing is an increasing number of cloud vendors are using third parties to perform annual assessments.  We’ve seen at least one cloud vendor that has an ISO 27001 certificate of compliance.  Some others are performing annual ISO 27002 assessments.  Each of these are very useful as a starting point.  However, the most mature cloud service and SaaS providers offer complex services.

It is important for enterprises to perform an assessment that also focuses on how the enterprise will use the service.  For example, an enterprise should examine the types of data that will be propagated to the cloud service provider and then compare how each parties' Data Classification Policy categorizes or labels that data, and how it will be treated.  Are the two policies compatible?  Or is there a disparity that is a cause for concern?

An assessment should examine change management processes, incident management, log management, and log analysis.  In order to understand the risks it is necessary to understand how these processes are managed, what gets logged, who has access to the logs, and under what conditions will the enterprise be notified of upcoming changes and detected incidents.

Some SaaS vendors provide an enterprise with the ability to review logs related to their use of the service.  Enterprises should use this level of access and proactively review and analyze the logs.  Ideally, the SaaS log information should be integrated into the enterprise's SIEM.

Assessing a cloud vendor's Business Continuity and Disaster Recovery management is also critical.  Hearing a cloud vendor reply that they "do not perform complete testing of its BP/DR because of the potential impact on a number of its customers" would not inspire confidence.  Instead, a reply like that should trigger a more detailed discussion and evaluation.

An enterprise should not stop with an assessment of the cloud service vendor.  Many such vendors use additional third parties.  This might include co-location facilities and/or other cloud services. An enterprise should also know about those relationships and what types of assessments the primary cloud service provider has performed when selecting those providers.

Another aspect of cloud accountability is the ability to for the customer, or third party, to reliably monitor the state of the system and verify its integrity.  This tends to be an unresolved issue.  It's often possible to monitor and detect that a service is working.  However, in the case of a failure, the customer is not likely to have access to information that provides any insight about the cause, or how to expedite a recovery.  Still fewer services make any attempt for a customer or third party to verify the integrity of the system, beyond some status APIs and access to limited log information.

Due Diligence By Jason Rhykerd

When it comes to information security many organizations, no matter their size, lose sight of the basics.  Performing the proper due diligence around the “basics” can provide a solid foundation for advancement in computer resources and protection against the so-called advance persistent threat.  The question most likely weighing on many organization’s minds is, “What constitutes due diligence?”

The answer to this question is not as easy as many Security Practitioners would like you to believe.  Many organizations tout “Best Practices.”  But how can you be sure that one person’s Best Practices are the best practices for your organization?

The answer:  Due diligence is a relative term; properly inventorying assets and assessing risk will allow an organization to identify gaps and implement controls and/or mitigation processes and polices.

Understanding the business objectives, processes, and data provide organizations a foundation for how to build the proper controls, processes, and policies.

For example:  What type of data are we collecting?  How is it being processed?  Do we need to keep it after it has been processed?  Do compliance regulations drive our need for policy and procedure – i.e. encrypting data at rest.

The “basics” – such as requiring strong passwords, monitoring, disabling and filtering unnecessary services, and least privileged account access are still being missed today.  How we implement these items is relative to our business.

Implementing these “basics” takes resources and discipline, so it is not an effort to be taken lightly.  Often these basics get swept under the rug and forgotten about – a server is built with extraneous services available and/or developer’s administrative credentials are left on that box when it goes into production.  It’s these “basic” things that add up and present risk to an organization.  Everyone knows what happens to a server once it’s built and in production – nobody ever has time to go back and “fix” the issue, or it is seen as too much of a hassle – we have to put in a change ticket, perform the work during an outage window – that’s if you even have a change control process.

The “basics” might seem like a much easier task for an organization with a small technology footprint, but it is just as important – it is in my experience that once technology is injected into a culture, it will not be going away anytime soon – business and user requests will drive the need for more technology.

Not to be lost in the “basics” is security awareness and training for the end-user.  It is not uncommon these days to walk into a small shop/office where the employees are surfing the Internet, checking Facebook and their personal email, on the same system that they will swipe your credit card on when you check out.  Providing basic user awareness in a fun and positive way can go a long way.

I would also recommend to any small company that it ingrain into its culture the idea of the basics and that security is a real part of the organization.  Cliché’ as it may sound everyone has a part to play in securing an organization no matter the size – the IT guy building a purpose built server is just as important as the CEO checking his/her email and not downloading that unknown file.

The Importance of Frameworks By Jonathan Gossels

The world of IT security and compliance is simply too big and too complex to keep all the requirements straight in your head.  It is too easy to overlook something important.  That’s where frameworks come in (note: I’m purposely conflating the terms framework and standards here).  Frameworks help you ensure that you have covered all the bases.

There are several popular security frameworks:  NIST, COBIT, and my favorite ISO 27002.  Some security practitioners get into heated arguments about which framework is best.  I look at these frameworks as more of a Rorschach test – people see in these frameworks what they want to see - some prefer an emphasis on governance, others on operations. TomAto vs TomAHto.

Using a framework (any framework) forces you to reason about each of the required controls (135 controls in the case of ISO 27002).  One of our clients once said, “Going through the compliance exercise helped us to understand what we were doing well, what we needed to improve, and what we weren’t doing at all, but should be doing.”

While appetites/tolerance for lightweight versus heavyweight processes vary by company and industry and that may steer you to one framework versus another, my overarching advice is to choose one and really master it – know it inside and out, know where it is black and white and where it is more nuanced.

Security Monitoring for Your Business By Alex Chaveriat

Security monitoring services provide certain solutions that many people, especially those dedicated to computer and networking systems, should consider. These solutions offer services for routine activities that help to securely maintain the networks for organizations. These activities are maintained by various experts with security resources given to those interested in protecting their computer systems.

Precautions
The different types of services provided with services like these can offer a multitude of solutions, one of them being able to take the right precautions before something bad happens. Usually, different types of methods are taken by IT experts to assess your network system and improve those systems with their own system. These services provide tests for various situations, such as:

• Security Check-Ups
• Assessment Tests
• Notifications

These assessments test to see how strong your setups are and compare the results with industry standards to evaluate your security systems, keeping them up to date.

Monitoring
In addition, routine monitoring schedules are enacted to keep you updated on the current status of your system. Advanced monitoring will help you extensively in checking your computer networks and taking care of the issues at hand. Examples include:

• System Integrity Checks
• Risk Reporting
• Domain Management

The benefits that come with a security service with monitoring and proactive protection is indispensable. It provides an extension of security experts and ultimately, the services will lessen the burden on your security staff and make it easier to manage the protection of network systems. By keeping a company’s network monitored and protected against security threats, this type of service allows a business to grow without fear of hackers and other security issues. This allows a business to prosper and prevents many problems that can hurt its reputation and profits.

The Power of Integration By Jonathan Gossels

In August, I gave two talks to two very different groups (the Association of Contingency Planners -

Liberty Valley Chapter hosted by The Vanguard Group and the closing keynote to the IT bank examiners from all of the Federal Financial Institutions Examination Council - FFIEC agencies [Federal Reserve, FDIC, Office of the Controller of the Currency, NCUA, and State Liaison Commission]) - yet, there was resonance from both groups on several points. This three part blog post is intended to share a few of the key points and some of the feedback from the live audience.

The key themes were:  The Power of Integration, The Problem of Extreme Complexity, and the Importance of Frameworks.  There was another important theme, “Excellence,” which I’ll deal with separately.

Deploying security controls and solutions is necessary, but not sufficient.  Compliance requirements and contracts with business partners or payment card processors mandate that security controls and security best practices are in place such as separation of duties, change control, encryption of sensitive data, least privilege access control, and separation of development, test, and production environments.

However, putting a check in the box that a required control is deployed does not mean that the control is effective.  A key attribute of any control is integration.  The more highly that a control is integrated the more effective it will be.  That integration can be with business processes or with technology.

In the photo above, the lock and unlock security functions are integrated with the key.  It is effortless to lock the car when you park.  Contrast that to the case of manual door locks.  With manual locks, each time you park, you have to make a decision (a risk analysis), “Is it worth climbing all around the car to lock the doors or am I in a safe enough place to leave them unlocked?”

Yes, the car had locking capability, but because it wasn’t integrated, much of the time the car was left unlocked.

Every time you plan a security control or deploy a security capability, think integration; think about the key fob.  If you make it effortless, you raise effectiveness.