Security and Cloud Computing

[HighWiz]

Re: Security and Cloud Computing

I recently presented a paper on economics of cloud computing to the ACM, and was asked to prepare a talk on security in cloud computing.
S

Now what the hell good is that? I am writing an ARTICLE dammit!

I mean, sure, I'll meet you, but SHEESH!

S

So is it a paper, a talk or an Article that you're doing?

You mentioned all three, so could you clarify?

[valkyrie]

Re: Security and Cloud Computing

Now what the hell good is that? I am writing an ARTICLE dammit!

I mean, sure, I'll meet you, but SHEESH!

S

Whining will not help you. :-D

Regards,

valkyrie
______________________________________
sapere aude

[hydruh]

Re: Security and Cloud Computing

However, you must sign a non-disclosure statement.

Now what the hell good is that? I am writing an ARTICLE dammit!

I mean, sure, I'll meet you, but SHEESH!

S

[valkyrie]

Re: Security and Cloud Computing

THAT is an assumption.

I want proof. Or at least evidence.

S

Meet me at defcon and I will present evidence. :-) However, you must sign a non-disclosure statement.

Regards,

valkyrie
_______________________________________
sapere aude

[hydruh]

Re: Security and Cloud Computing

All is NOT secure.

THAT is an assumption.

I want proof. Or at least evidence.

S

[valkyrie]

Re: Security and Cloud Computing

Critical analysis. I don't think the picture that is painted is particularly pretty, but I want to work from the hypothesis that it is secure and disprove it if I can. I know that the first thing that a CIO is gonna say is "put my data on a machine that isn't under my control, forget it!" and he would be correct in that assessment.

I'll post links to the economics paper as soon as I find someone to publish it - or I'll just blog it if I can't.

And thanks, bascule. That'll take me a bit to sift through.S

Argggh. While I appreciate you working from a hypothesis that all is secure, let's be reasonable. All is NOT secure. So how does that hork your assumptions?

Regards,

Valkyrie
______________________________________________
sapere aude

[hydruh]

Re: Security and Cloud Computing

You don't seem to be clear on your expectations. What do you want. Critical analysis? Happy fun things? I would be interested to read your paper if you provide a link.

Critical analysis. I don't think the picture that is painted is particularly pretty, but I want to work from the hypothesis that it is secure and disprove it if I can. I know that the first thing that a CIO is gonna say is "put my data on a machine that isn't under my control, forget it!" and he would be correct in that assessment.

I'll post links to the economics paper as soon as I find someone to publish it - or I'll just blog it if I can't.

And thanks, bascule. That'll take me a bit to sift through.

S

[bascule]

Re: Security and Cloud Computing

I think what sets security in cloud computing apart from traditional infosec is that systems in the cloud typically demonstrate an extreme degree of automation.

For example, one of the most common configurations I know uses a tool like chef to automatically build out the environment within an instance to your specifications, going from a declarative profile. The instance is effectively a dumb agent that configures itself to do whatever you want it to.

Tools like nanite let you run agents on each of the nodes that connect to a pub/sub message queue and blindly do whatever you tell them to. There's a decent sized section on nanite security if you follow the link and scroll down. But the point still stands if someone compromises your command/control processes they effectively have a big botnet of dumb agents they can do whatever they want with.

With greater levels of automation it becomes easier to replicate something beneficial N times over, but at the same time if someone malicious takes over they get all that automation work for free, plus all the instances/IPs to do whatever they want.

[valkyrie]

Re: Security and Cloud Computing

I recently presented a paper on economics of cloud computing to the ACM, and was asked to prepare a talk on security in cloud computing. I know internet security fairly well, and I know cloud computing principles fairly well, but I thought there would be people on this forum who would know a lot more and have some good resources. If you don't mind sharing that is.

So have at it! What's your favorite story, article or thought on security and cloud computing? And before you say it - yes I have read Jason' blog post.

S

You don't seem to be clear on your expectations. What do you want. Critical analysis? Happy fun things? I would be interested to read your paper if you provide a link.

Regards,

valkyrie
_______________________________________________
sapere aude

[hydruh]

I recently presented a paper on economics of cloud computing to the ACM, and was asked to prepare a talk on security in cloud computing. I know internet security fairly well, and I know cloud computing principles fairly well, but I thought there would be people on this forum who would know a lot more and have some good resources. If you don't mind sharing that is.

So have at it! What's your favorite story, article or thought on security and cloud computing? And before you say it - yes I have read Jason' blog post.

S