Cloud Hosting

By Venkat Krishnapur, Vice-President of Engineering and Managing Director, McAfee India

Cloud computing has become near-ubiquitous, with Indias cloud market poised to reach over US$7 billion by 2022. The use of cloud services has empowered organizations to accelerate their businesses with more agile technology at moderate costs. Cloud is making IT more strategic than ever and companies are structuring themselves around the rapid transformation, growth and agility the cloud delivers. However, this rapid migration is also presenting complexities and risks that few businesses are equipped to deal with, and the security of data has taken center stage. While cloud providers are enabling more security than ever before, there are aspects of Security that they do not cover, and it becomes the responsibility of the users to ensure those are mitigated.

The data dilemma

While its true that sensitive data can be stored safely in the cloud, this is not an inevitable conclusion. According to the McAfee 2019 Cloud Adoption and Risk Report, 21 percent of all files in the cloud contain sensitive data and sharing of sensitive data in the cloud has increased by more than 50 percent. While most of this data is stored in well-established enterprise cloud services such as Box, Salesforce, and Office365, its necessary to realize that none of these services guarantee 100 percent safety.

Irrespective of how robust your threat mitigation strategy is, the threat rates are too high to have a reactive approach. Access control policies must be ascertained and enforced before data ever enters or exits the cloud.

Think of it this wayjust as the number of employees who require the ability to edit a document is much smaller than those who need to view it, it is likely that not everyone who needs to access certain data needs the ability to share it. Examine all permissions and access the context associated with data in the cloud environment. Control who has access. Access management requires three capabilities: the ability to identify and authenticate users, the ability to assign users access rights, and the ability to create and enforce access control policies for resources.

Large institutions that have a range of data, including sensitive consumer data to protect, and many cloud solutions to choose from, must balance potential benefits against risks of breaches and access integrity. What many organizations fail to realize when moving to the cloud is, to what extent they are responsible for securing their own cloud environment. Cloud providers (vendors) secure the infrastructure but securing data, and applications are all the responsibility of the cloud customer.

The Responsibility Equation

When it comes to security, CISOs are speculating if external providers can protect their sensitive data, while also ensuring compliance. There exists a misconception that the Cloud Service Provider is responsible for securing the cloud environment. This is where shared responsibility comes into play. In simple terms, this means that the organization and the vendor split responsibilities for cloud deployment. While the vendor may handle everything from physical networks, servers, and storage to operating systems, and even applications, but the organization will need to be responsible for the rest. In reality, no matter what level of service the vendor offers, the organization is ultimately responsible for the security and compliance of cloud deployment.

As it is with all aspects of cloud, responding to security incidents is also a shared responsibility. CISOs must learn to collaborate effectively with the Cloud Service Provider, to examine and respond to potential security occurrences. To collaborate effectively, they need to understand what information the vendor can share, and the limits within which they can assist.

Companies that are fulfilling their shared responsibility by securing their data are assuming substantially more benefits than those who arent taking data protection into their own hands. There are ways and means of mitigating security risks and the cloud is a feasible alternative for enterprises; the advantages from cloud-managed services far outweigh concerns.

Organizations need to regularly assess the security posture of their cloud environments, and that of their vendors, suppliers, partners all third parties. The Verizon breach is a fine example where the vendors mistake turns to be the organizations headache. The shared security model exists for a reason. No matter who is responsible for the security of the cloud data, the organization is eventually responsible for what happens to their data.

CASB a key enabler

Cloud access security brokers (CASBs) are on-premise or cloud-based security nodes, that sit between cloud service consumers and cloud service providers, to enforce security and compliance for cloud applications. These help organizations extend the security controls of their on-premises infrastructure to the cloud.

CISOs need to evaluate the full risk landscape in their on-premise and externally hosted cloud environments that can compromise security. Think of them this waythey act as central data authentication and encryption hubs for both cloud and on-premise applications, accessed by all endpoints, including personal devices like smartphones and tablets. CASBs are an essential element of a cloud security strategy, that helps organizations govern the use of cloud and protect sensitive data. These implement security procedures like authentication, authorization, encryption, device profiling, alerting and anomaly detection/prevention.

By using CASBs, organizations can:

Conclusion

Technology has come a long way since the dawn of computing that included conventional ways of data management. Today, cloud computing is revolutionizing the IT industry, shaking up the business landscape, and pretty much everything else it touches. Although migration to the cloud is helping CIOs in their digital transformation journeys, hastily jumping into it without the necessary maturity can throw all their efforts out of the window.

While the business advantage of cloud usage is significant, this rapid migration is also introducing complexities and risks that most organizations dont have provisions to deal with. If properly addressed, these issues will not hinder your IT roadmap and data doesnt have to remain anchored on-premise. The future of cloud rests upon introducing industry standards, that will help address regulatory, management and technological matters.

The stronger your cyber defenses are, the better you are at reducing the risk and the impact when something happens.

Disclaimer: CISO MAG does not endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. Views expressed in this article are personal.

Read more from the original source:
Data in the Cloud is Much More at Risk Than Enterprises May Think - CISO MAG

The upshot: Neocortix can muster smartphones to act as cloud computing resources.

From where we all sit, we see lots of cloud computing either being developed or fully rolled out. The general public is also heavily involved with the cloud, although they may not be as aware of it. To much of the public, the cloud might feel like an amorphous notion of giant banks of computers perhaps dominated by the Big Tech Overlords that are out of their control. In other words, theyre not personally involved with the cloud; its elsewhere and invisible.

And, for the most part, thats true. But theres one company, Neocortix, that has been working for a couple of years to change that. They aim to leverage the vast array of smartphones in the wild, harnessing them to handle cloud-computing-type work in the background when were not using the phone for something else. Add up the number of smartphones around the world, and theres some serious computing potential out there. Call it crowd computing?

And phone owners could be paid for the service to rent out their phones computing capacity. Neocortix claims on their website that top users can earn up to $80 a year for a phone thats engaged in computing for 8 hours a day; if available for 24 hours, it can earn up to $240 a year.

While this sounds straightforward enough (Neocortix will aver that it was anything but), several questions or perhaps concerns immediately come to mind. There are at least six of them:

Lets take these in order.

The security and privacy things both popped immediately to my mind. Lets start with the phone user. This isnt something that a phone can simply be roped into. You have to install an app, and with any app come permissions. If this app were to ask to use the phone or send texts, that would probably be a no-go. Neocortix say that theyve got a 2-1/2-year record of being responsible with the permissions, and they intend to keep it that way. If they were to change that policy on an update, then the phone owner would be prompted for new permissions. In other words, this isnt something that could be snuck into a future revision under the radar.

So, if we trust permissions enough to allow notorious privacy-abusers like Facebook to install apps on our phones, then, hopefully someone with a decent track record should be easier to OK. For the time being, Neocortix has been vetting their cloud users, but that doesnt scale and will be stopping in the not-too-distant future. So the permissions will be what we count on to protect our phones.

What about for the folks doing the computing? Should they be afraid that phone users would be able to see whats going on? Will data breadcrumbs be left on the phone? According to Neocortix, the computation happens in a secure container. In fact, to them, this looks like Linux. The container is unable to see outside files and processes on the phone. Thats good for both the person doing computing and for the phone owner. Theres also no long-term storage at this point. Any data is erased when the session ends. They have a storage version on their roadmap, so that policy may change someday.

When it comes to illicit use, their approach is to use policy and enforce it. Theres only so much that can be done to force behavior using technology; at some point you have to limit things by policy. Even for something as simple as photo storage, each such cloud service has policies as to what kind of content is acceptable (or legal). Although Facebook is working hard at this, right now, automated bots have limited success at flagging certain legal content that violates their internal standards and, in true cat-and-mouse fashion, folks try to alter images in ways that can foil the bots. So, ultimately, Facebook has to rely on complaints and their ability to put users into Facebook jail or ban them outright.

The same holds for pretty much any cloud service, and it will hold for Neocortix as well. I asked about a hypothetical situation once a storage product were to be available: lets say that some cloud-service user is abusing the system to park illicit photos on the various phones. If caught and terminated, what happens to the files on the phones? And, in particular, would the phone owner end up being legally responsible for those images?

The specific answer is TBD. If, in the future, we were to offer a distributed shared-economy storage product, we would have to have permissions, disclaimers, policies, protections, encryption, and remedies at all levels of the product to protect the phone owners and our company from a malicious [cloud-service] customer. Getting that right can be done, but it would be a significant amount of work which we would take very seriously, and that is one of the main reasons that we have not begun any work on such a storage product we have our hands full with our Scalable Compute product, and we will for the foreseeable future.

The next question about the battery has a surprisingly simple answer: this will work only while the charger is plugged in. Likewise for the data-plan question: this works only when the phone is connected via WiFi, meaning that it doesnt chew up data-plan data ever. So they guarantee, with clear text, that participating will not drain your battery and will not overrun your data plan.

Those usage conditions suggest that most phones will be on the nightstand charging at night when they can participate. That provides about eight hours a day of use (and potential income). Spare phones, however, can also be utilized up to 5 phones total for one account. If those phones are left on, with the charger connected and the WiFi active, then they can provide 24 hours of computing availability. This is where the earning potential of 8 vs. 24 hours comes from. If you have two regular-use phones and three spares on the same account, then you have 2 x $80 plus 3 x $240 for a total of $880 per year. And yes, if you earn more than $600 in a year, you will be 1099ed.

Finally, how do the cloud-computing customers interact with this whole service? Neocortix has worked very hard to make the interaction look exactly as it would look if using Amazons cloud service. Given the potential challenges of getting folks to sign up for something new like this, the usage model is a barrier that Neocortix doesnt want to introduce into the process. Existing scripts and approaches should work with little or no modification, easing that friction.

So, will we all eventually be hosts to unlimited amounts of computing on our phones? Its hard to say; it depends on how good a job they do convincing people that its safe. It sounds like theyve done all the right things. But phones have become these playgrounds for companies trying to harvest data from everywhere. Theres some dodgy history to be overcome, and I count myself as one of the skeptical ones when it comes to downloading apps. Then again, I usually come around if theres real value to be had. So, if this gets traction, Id probably join the crowd. Would you?

More info:

Neocortix

Sourcing credit:

Lloyd Watts, Founder and CEO, Neocortix

Related

See the rest here:
Is Crowd Computing the Next Big Thing? - EE Journal