Details

Cloud Security

A Comprehensive Guide to Secure Cloud Computing
1. Aufl.

von: Ronald L. Krutz, Russell Dean Vines
34,99 €
Verlag:	Wiley
Format:	EPUB
Veröffentl.:	31.08.2010
ISBN/EAN:	9780470938942
Sprache:	englisch
Anzahl Seiten:	384

In den Warenkorb

Als Gutschein

DRM-geschütztes eBook, Sie benötigen z.B. Adobe Digital Editions und eine Adobe ID zum Lesen.

Beschreibungen

Titelbeschreibung

Well-known security experts decipher the most challenging aspect of cloud computing-security Cloud computing allows for both large and small organizations to have the opportunity to use Internet-based services so that they can reduce start-up costs, lower capital expenditures, use services on a pay-as-you-use basis, access applications only as needed, and quickly reduce or increase capacities. However, these benefits are accompanied by a myriad of security issues, and this valuable book tackles the most common security challenges that cloud computing faces. The authors offer you years of unparalleled expertise and knowledge as they discuss the extremely challenging topics of data ownership, privacy protections, data mobility, quality of service and service levels, bandwidth costs, data protection, and support. As the most current and complete guide to helping you find your way through a maze of security minefields, this book is mandatory reading if you are involved in any aspect of cloud computing. Coverage Includes: <ul> <li>Cloud Computing Fundamentals</li> <li>Cloud Computing Architecture</li> <li>Cloud Computing Software Security Fundamentals</li> <li>Cloud Computing Risks Issues</li> <li>Cloud Computing Security Challenges</li> <li>Cloud Computing Security Architecture</li> <li>Cloud Computing Life Cycle Issues</li> <li>Useful Next Steps and Approaches</li> </ul>

Inhaltsverzeichnis

Foreword xxi Introduction xxiii Chapter 1 Cloud Computing Fundamentals 1 What Cloud Computing Isn’t 7 Alternative Views 8 Essential Characteristics 9 On-Demand Self-Service 9 Broad Network Access 10 Location-Independent Resource Pooling 10 Rapid Elasticity 10 Measured Service 11 Architectural Influences 11 High-Performance Computing 11 Utility and Enterprise Grid Computing 14 Autonomic Computing 15 Service Consolidation 16 Horizontal Scaling 16 Web Services 17 High-Scalability Architecture 18 Technological Influences 18 Universal Connectivity 18 Commoditization 19 Excess Capacity 20 Open-Source Software 21 Virtualization 22 Operational Influences 23 Consolidation 23 Outsourcing 26 Outsourcing Legal Issues 26 Business Process Outsourcing (BPO) Issues 28 IT Service Management 30 Automation 31 Summary 31 Chapter 2 Cloud Computing Architecture 33 Cloud Delivery Models 34 The SPI Framework 34 SPI Evolution 34 The SPI Framework vs. the Traditional IT Model 35 Cloud Software as a Service (SaaS) 37 Benefits of the SaaS Model 38 Cloud Platform as a Service (PaaS) 39 Cloud Infrastructure as a Service (IaaS) 41 Cloud Deployment Models 43 Public Clouds 44 Community Clouds 46 Private Clouds 48 Hybrid Clouds 49 Alternative Deployment Models 50 The Linthicum Model 50 The Jericho Cloud Cube Model 51 Expected Benefits 55 Flexibility and Resiliency 56 Reduced Costs 57 Centralization of Data Storage 58 Reduced Time to Deployment 58 Scalability 58 Summary 59 Chapter 3 Cloud Computing Software Security Fundamentals 61 Cloud Information Security Objectives 62 Confidentiality, Integrity, and Availability 63 Confidentiality 63 Integrity 64 Availability 64 Cloud Security Services 64 Authentication 64 Authorization 64 Auditing 65 Accountability 66 Relevant Cloud Security Design Principles 66 Least Privilege 67 Separation of Duties 67 Defense in Depth 67 Fail Safe 68 Economy of Mechanism 68 Complete Mediation 68 Open Design 69 Least Common Mechanism 69 Psychological Acceptability 69 Weakest Link 70 Leveraging Existing Components 70 Secure Cloud Software Requirements 70 Secure Development Practices 71 Handling Data 71 Code Practices 72 Language Options 73 Input Validation and Content Injection 73 Physical Security of the System 73 Approaches to Cloud Software Requirements Engineering 74 A Resource Perspective on Cloud Software Security Requirements 75 Goal-Oriented Software Security Requirements 76 Monitoring Internal and External Requirements 77 Cloud Security Policy Implementation and Decomposition 78 Implementation Issues 79 Decomposing Critical Security Issues into Secure Cloud Software Requirements 81 NIST 33 Security Principles 85 Secure Cloud Software Testing 86 Testing for Security Quality Assurance 87 Conformance Testing 89 Functional Testing 90 Performance Testing 92 Security Testing 94 Cloud Penetration Testing 99 Legal and Ethical Implications 100 The Three Pre-Test Phases 103 Penetration Testing Tools and Techniques 105 Regression Testing 111 Cloud Computing and Business Continuity Planning/Disaster Recovery 113 Definitions 113 General Principles and Practices 114 Disaster Recovery Planning 114 Business Continuity Planning 117 Using the Cloud for BCP/DRP 119 Redundancy Provided by the Cloud 119 Secure Remote Access 120 Integration into Normal Business Processes 120 Summary 120 Chapter 4 Cloud Computing Risk Issues 125 The CIA Triad 125 Confidentiality 125 Integrity 126 Availability 126 Other Important Concepts 127 Privacy and Compliance Risks 127 The Payment Card Industry Data Security Standard (PCI DSS) 128 Information Privacy and Privacy Laws 130 Threats to Infrastructure, Data, and Access Control 141 Common Threats and Vulnerabilities 141 Logon Abuse 143 Inappropriate System Use 143 Eavesdropping 143 Network Intrusion 144 Denial-of-Service (DoS) Attacks 144 Session Hijacking Attacks 144 Fragmentation Attacks 145 Cloud Access Control Issues 145 Database Integrity Issues 146 Cloud Service Provider Risks 147 Back-Door 148 Spoofing 148 Man-in-the-Middle 148 Replay 148 TCP Hijacking 149 Social Engineering 149 Dumpster Diving 149 Password Guessing 150 Trojan Horses and Malware 150 Summary 151 Chapter 5 Cloud Computing Security Challenges 153 Security Policy Implementation 154 Policy Types 154 Senior Management Statement of Policy 155 Regulatory Policies 155 Advisory Policies 155 Informative Policies 155 Computer Security Incident Response Team (CSIRT) 156 Virtualization Security Management 157 Virtual Threats 158 Hypervisor Risks 163 Increased Denial of Service Risk 164 VM Security Recommendations 165 Best Practice Security Techniques 165 VM-Specific Security Techniques 169 Hardening the Virtual Machine 169 Securing VM Remote Access 172 Summary 173 Chapter 6 Cloud Computing Security Architecture 177 Architectural Considerations 178 General Issues 178 Compliance 178 Security Management 179 Information Classification 181 Employee Termination 185 Security Awareness, Training, and Education 186 Trusted Cloud Computing 188 Trusted Computing Characteristics 188 Secure Execution Environments and Communications 191 Secure Execution Environment 191 Secure Communications 191 Microarchitectures 203 Identity Management and Access Control 204 Identity Management 205 Passwords 205 Tokens 206 Memory Cards 207 Smart Cards 207 Biometrics 207 Implementing Identity Management 209 Access Control 210 Controls 210 Models for Controlling Access 211 Single Sign-On (SSO) 212 Autonomic Security 213 Autonomic Systems 213 Autonomic Protection 215 Autonomic Self-Healing 215 Summary 216 Chapter 7 Cloud Computing Life Cycle Issues 217 Standards 218 Jericho Forum 218 The Distributed Management Task Force (DMTF) 219 The DMTF Open Virtualization Format (OVF) 219 The DMTF Open Cloud Standards Incubator 220 The International Organization for Standardization (ISO) 220 ISO 27001 220 ISO 27002 222 ISO 27003 222 ISO 27004 223 ISO 27005 223 ISO 27006 224 International Organization for Standardization/International Electrotechnical Commission ISO/IEC 29361, ISO/IEC 29362, and ISO/IEC 29363 Standards 224 Distributed Application Platforms and Services 225 The European Telecommunications Standards Institute (ETSI) 226 The Organization for the Advancement of Structured Information Standards (OASIS) 226 Storage Networking Industry Association (SNIA) 226 Open Grid Forum (OGF) 227 The Open Web Application Security Project (OWASP) 227 OWASP Top Ten Project 227 OWASP Development Guide 228 OWASP Code Review Guide 229 OWASP Testing Guide 230 Incident Response 231 NIST Special Publication 800-61 231 Preparation 232 Detection and Analysis 232 Containment, Eradication, and Recovery 233 Post-Incident Activity 234 NIST Incident-Handling Summary 234 Internet Engineering Task Force Incident-Handling Guidelines 234 Layered Security and IDS 236 Intrusion Detection 236 IDS Issues 240 Computer Security and Incident Response Teams 241 CERT/CC 242 FedCIRC 242 Forum of Incident Response and Security Teams 243 Security Incident Notification Process 243 Automated Notice and Recovery Mechanisms 244 Encryption and Key Management 246 VM Architecture 246 Key Protection Countermeasures 247 Hardware Protection 248 Software-Based Protection 249 Data Deduplication 250 Hashing 251 Retirement 252 VM Life Cycle 252 Overwriting 253 Degaussing 254 Destruction 254 Record Retention 255 Data Remanence 255 Due Care and Due Diligence 255 Documentation Control 256 Summary 256 Chapter 8 Useful Next Steps and Approaches 259 Getting Answers 259 What Services Should Be Moved to the Cloud? 260 What Questions Should You Ask Your Cloud Provider? 261 When Should You Use a Public, Private, or Hybrid Cloud? 262 Getting Help 264 Cloud Security Alliance 264 Cloud Computing Google Groups 265 Cloud Computing Interoperability Forum 266 Open Cloud Consortium 266 Getting Started 267 Top Ten List 267 1. Assess Your Data’s Sensitivity 268 2. Analyze the Risks vs. Benefits of Cloud Computing 271 3. Define Business Objectives 273 4. Understand the Underlying Structure of Your Network 273 5. Implement Traditional Best Practice Security Solutions 274 6. Employ Virtualization Best Practices 274 7. Prevent Data Loss with Backups 275 8. Monitor and Audit 275 9. Seek Out Advice 276 10. Employ Deception 277 Parting Words 277 Glossary of Terms and Acronyms 279 References 345 Index 349

Rezension

"This worthwhile addition to the growing library of cloud security books contains very helpful prescriptions for security policies and practices." (Computing Reviews, January 2011)

Autorenportrait

Ronald L. Krutz, PhD, is a senior information systems security consultant with more than 30 years of experience. He founded the CMRI Cybersecurity Center at Carnegie Mellon University. Russell Dean Vines is Chief Security Advisor for Gotham Technology Group, LLC, and has been an information systems security expert for over 25 years. They coauthored the bestselling CISSP Prep Guide.

Back cover copy

Secure your cloud to maximize its value Cloud computing is flexible, efficient, and cost-effective, but not without risks. To maximize its potential, you need to fully understand its vulnerabilities and how to offset them. This guide thoroughly examines cloud fundamentals, architecture, risks, and security principles. Two leadingsecurity experts detail critical approaches and solutions, helping you achieve the maximum return on cloud investments without compromising the safety of your information. <ul> <li> Avoid leakage and unauthorized data access among virtual machines running on the same server </li> <li> Properly handle sensitive information </li> <li> Prevent release of critical data to law enforcement or government agencies without approval by the client </li> <li> Follow compliance and regulatory requirements </li> <li> Deal with system crashes or failures </li> <li> Protect against hacker invasions into client applications hosted on the cloud </li> <li> Implement solid, robust security protection </li> <li> Manage interoperability that allows a client to easily move applications among different cloud providers and avoid "lock-in" </li> </ul>