22 July 2009 by Jeff Hayes.

We have heard it for the past year of so:  cloud computing is the future. However, cloud computing has been around for years and is nothing new. What is new is the marketing spin that is placed upon it.

Back in the late 80s when I first got into the computer networking business, we drew the WAN as a cloud. It was nothing more than a representation of the network that belonged to someone else. If I needed to describe a connection between two remote facilities and it was not a dedicated connection, I’d draw a line from each facility representation; i.e., router, to a central cloud. The physical path was not important, it was the virtual path that mattered.

Most of us that use free, Web-based email; e.g., Gmail, Hotmail, Yahoo! Mail, are using cloud computing.  Social networking sites; e.g., Facebook, hi5, Photobucket, Flickr, and Twitter are cloud-based applications. Web-based CRM packages are cloud computing applications; e.g., Salesforce. com.

All we really know as the average Joe and Jane is we have a computer interface into the cloud; i.e., a browser. We don’t know or care where the actual routers, firewalls and servers are. For most people, they have never heard of those words or could not describe them. We just know how to access these applications. We have an implicit trust. For most applications, that is fine. But for highly confidential and proprietary information, knowing where and who has physical access to those devices should be a concern.

The concern with cloud computing is the multi-tenant nature of the hosting design.  It helps to have a dedicated device within the cloud, like a dedicated web server at the hosting provider. But it does not eliminate the physical security issues associated with the facility. Sure, only authorized people are allowed access to the data center, but it is real easy for any authorized person to fiddle and wander into areas that they should not be in.

Cloud computing is nothing new, it is just a new spin on a long-standing concept. And cloud security principles are nothing more than normal security principles. If it works in an enterprise deployment, it most likely will work in a cloud deployment.

Posted in Cloud Computing | Print | 2 Comments »

13 March 2009 by Jeff Hayes.

There is a real nice article on Network World online written by Mark O’Neill on SOA Security: the Basics.

Service Oriented Architecture (SOA) is an architectural approach which involves applications being exposed as “services”. Originally, services in SOA were associated with a stack of technologies which included SOAP, WSDL, and UDDI. [snip] More recently, Cloud services such as Amazon’s Simple Queuing Service (SQS) may be used alongside local servimsces, to create a “hybrid” SOA environment.

Why does a smaller business care about this? I worked for a small business (less than 20 employees) that built and sold content filtering software, now part of Blue Coat. SOAP was a protocol we used quite a bit. Even though we were a “security company,”the security of that protocol was only slightly considered. (I am sure they have addressed this, as that was four years ago.) SOA security vulnerabilities include:

• SQL Injection
• Capture-replay attacks
• XML External Entity Attack
• XPath Injection
• XML Denial-of-Service (XDoS)
• Harmful SOAP attachments
• XML Signature dereference attacks

Many, if not most, mission-critical applications leverage the browser as the user’s interface. Authentication is secured via SSL, X.509, XML Encryption, Kerberos and WS-Security. As more firms move to cloud computing, SOA is a key component. Firms need to be sure that no private, unprotected data is sent to the cloud.

Posted in Cloud Computing | Print | No Comments »