In an echo of the move by governments including India, Saudi Arabia and the United Arab Emirates to ban the use of certain encrypted Blackberry services last year, the Russian Federal Security Service have cited Skype, Gmail and Hotmail as a “threat to national security” and has suggested a ban.

According to a release from ITAR-TASS, head of the FSB Information and Special Communication Centre, Alexander Andreyechkin stated:

“Uncontrollable use of such services can create a major threat to Russia’s security“

Andreyechkin reportedly went on to argue that, because the servers and encryption technology used all reside outside Russia it creates difficulty in carrying out investigations, asserting that these services are often used by “foreign extremists”.

The remarks, made before a government Communication & Technology committee meeting, which subsequently continued without press presence, appear to have cause a certain amount of confusion in the Kremlin. Dimitry Peskov, press secretary to Vladimir Putin confirmed that this opinion represented the official position of the FSB, saying “FSB representatives don’t express personal points of view. Naturally, that was the position of the agency“. Whereas Russian Communications minister Igor Shchegolev stated “We have no plans to cancel or close Skype, gmail, hotmail or any other foreign internet services in Russia“, adding perhaps a little more worryingly, “We are now discussing how to regulate such technologies, including economically.“

The main cause of concern for the FSB seems to be in the encryption employed by these services and the aim appears to be either to deny access to services such as these, or to use the threat of such a ban in order to open negotiations to improve the access of Russian security services to encrypted information. The countries that threatened a ban on Blackberry use reached an agreement with RIM, the Blackberry manufacturer, that allowed usage to continue uninterrupted, details of this compromise have never been revealed.

Vladimir Putin is currently heading a committee, set up by the Communication & Technology commission, charged with setting out a plan to regulate the mass use of internet encryption technology within Russia. The committee is due to report on October the 1st of this year. Watch this space…

A report released this month by the
European Network and Information Security Agency (ENISA) has investigated the utility and applicability of cloud services for governments across Europe.

The report, entitled “Security and Resilience in Governmental Clouds” aims to provide a decision making model that can be used by governments and other public bodies, to assess the information security challenges posed by cloud computing and to guide them in the definition of their requirements when planning such a migration.
 
All in all it is a thorough piece of work and should absolutely be on the recommended reading for anyone; private enterprises included, considering the commercial benefits of cloud.
 
One conclusion of the report though did seem at best premature, if not a little under researched. The report recommends:

“its [public cloud] adoption should be limited to non-sensitive or non critical applications and in the context of a defined strategy for cloud adoption which should include a clear exit strategy.”

 
On the face of it this is sensible advice but unfortunately the report does not go on to address the strategies and technologies that exist to mitigate these risks, making public cloud a viable and secure platform for enterprises and public bodies alike.
 
Some of the risks identified in the report are: improper access to confidential data (either at the service provider or by intrusion), service provider lock-in due to proprietary technologies, lack of audit and monitoring capabilities, concerns over application and OS patching strategies and access to encryption keys among others. Unfortunately the recommendations while sound do not offer any concrete detail on architectural strategies that overcome these issues even though this is already a technical possibility, at least in the Infrastructure as a Service model.
 
The multi-tenanted nature of public cloud means that organisations need to be able to reduce their effective perimeter to the edge of their virtual machine, effectively segmenting their systems away from other customers. The service provider’s network should be treated as public. In the IaaS environment the customer retains ownership of and responsibility for the patch levels of their virtual machines, host level firewalling and vulnerability shielding offer the opportunity to neutralise the threat of exploitation of vulnerability, even in the absence of a patch. Log and file integrity monitoring offer a means of audit and control and in the IaaS environment are simple to implement at host level.
 
The challenge of data security in public clouds has typically been more complex to answer, as encryption services are usually managed by the cloud provider. Organisations need the ability to segment their data away from other customers but also away from the service provider. Service providers need that too, otherwise they risk inheriting some serious liability. Data should be provisioned to the cloud in an encrypted format, the data owner should retain ownership and control of the keys and only the customer’s own machines should be able to get access to those keys ensuring that the data is only ever in-the-clear inside the secure perimeter of their own virtual machines.
 
Properly architected data encryption that operates transparently and is engineered for the cloud, encryption that is managed by the customer and not the service provider is a business enabler. It accelerates adoption of cloud services, drives down costs, and allows regulatory and legislative compliance. It means you no longer have to worry about how you’re going to delete the cloud when you decide to change service provider.

Used under creative commons from elliottbledsloe's photostream

 
UPDATE: This promotion has now closed
 

Hopefully regular readers of the blog will have noticed that I try to avoid using Countermeasures to push product. However, this afternoon I have been offered 100 licence keys for our new Windows security software to give away to readers of the blog and I thought giving you free stuff was definitely something I should be doing!

Trend Micro Titanium was released this week and is already getting great reviews from journalists and testing houses alike. In all honesty, I love the product too, I know I sound like a shill but it has to be tried to be believed. Titanium is security software that has been designed not to get in your way, it won’t slow down your PC and at the same time it doesn’t compromise on the quality of protection. Anyway don’t take my word for it, give it a test drive and I’ll give you a free serial number.

You knew there was going to be a catch though, like Alice Cooper said “Nothing’s Free”… I only have 100 serial numbers to give away, so here’s what you have to do. Go here. Click the blue button to download a trial copy and install it. There’s an option to log in with your Facebook account rather than your email address if you prefer. The first 100 people to post a review of their experience with Titanium, either here as a comment to this blog post or on the Titanium page on Facebook will each get a 12 month subscription free of charge and obligation.

So there you have it, end of shameless promo!

• It’s not their speciality. They make widgets. And they have the staff they need to make, deliver, develop and support those widgets. Other people can do non-widget related activities better than they can;
• They don’t need the overhead, time commitment and complexity that employing all these extra people demands. Yes, they could hire their own cleaner, but it’s a lot simpler to get on the phone and let a cleaning agency take care of that;
• It’s a lot more cost-effective that way. Our widget company could invest in a worldwide fleet of planes, vans and delivery-people but that would be ludicrously expensive when they can phone a courier company and have them delivered for a few pounds a day.

 
So three very good reasons for outsourcing: better service, simplicity and cost. These lines of reasoning can easily be applied to IT. Outsourced IT can be better, simpler and cheaper. Yay, let’s go for it, say those hotheads in accounting.
 
Where this sort of analogy starts to fall down, however is in the risk assessment. If the cleaner doesn’t turn up, then it’s no big deal. If they don’t turn up on a regular basis, you fire the agency and get a new one. There might be a few more biscuit crumbs and sandwich remnants for the new cleaner to deal with, but no harm done, by and large.
 
If your outsourced IT services turn out to be useless, on the other hand, then the consequences could be pretty brutal. Your information could be exposed; you could lose access at a crucial moment or they could manage to lose the lot. You don’t want that to happen, because it could make you bankrupt or put you in prison.
 
But people don’t like risk-assessment, of course. It’s boring. It puts paid to a lot of exciting new things. It reminds you of your mum when you were five.
 
I hate to say it, though, but your mum was probably right.

One of the reasons for this apparent contradiction must surely lie with the language itself, and not the technology. We already know that the term “cloud” when applied to technology has a different meaning to everyone who uses it and everyone who hears it. Hell, the term “cloud” when applied to clouds has a multitude of possibilities! The truth is though the same is true of the term “security”.
 Â 

If you talk to a sysadmin, a network admin, a coder, a hacker, a security guard, a facilities manager or a three star general about security then once again they will each have their own understanding of the definition, the aims and the means of achieving that elusive “security”. If you ask a C-level executive what security means, especially in the context of cloud, then they will have a different understanding again.
 
To an executive, security is all about control and accountability. Data and the management of data are the asset and the task that are currently mostly considered for delegation to cloud providers. Today’s legislation places a burden and corresponding sanctions on corporate executives to ensure that the data which they hold is stored and processed in a secure manner. Future legislation promises to extend this burden of accountability and the penalties for non-compliance can be severe, stretching, if you’ll pardon the pun, to even to jail-time.
  

When your most precious assets are tucked up tight in your own data centre, handled by your own employees on physical systems that you can secure discretely then creating an audit trail and accountability is far simpler. The control remains with the data owner. In the cloud environment as it currently stands, much of this control is outsourced, but none of the accountability.
  

Virtualisation, multi-tenancy and storage area-networks are the technological engines powering cloud services. The rapid provisioning of virtual machines across highly-scalable, highly available infrastructure gives cloud providers the economic advantage that is their business promise. Cloud customers need to be secure in the knowledge that they retain control over the secure perimeter of their virtual machine and that it is not dependent on any configuration at the provider end. Cloud customers need to know that their data is sufficiently encrypted in the SAN that it cannot be accessed or used by anyone other than those who hold the keys and that the keys are not held by the cloud provider.
  

In order to increase the acceptability of cloud to the enterprise executive, we need to design tools that ensure control over the security of key underlying technologies. It is only when a CIO has control that they can reasonably be expected to accept accountability.