![](bg4.png)
lightweight OS with minimal cloud access tools (e.g.
a browser)? Could this reduce the total number of
available exploits and the number of machines run-
ning them? Will this reduce the success chances of
new worms? Will it be more difficult for botnets?
Will this force attackers to move to the heavily forti-
fied clouds where the providers invested appropriately
in security (hopefully)? It is still to be seen whether it
is going to easier or harder for attackers in these new
environments.
6 EXTENDING PROTECTION
BEYOND TRADITIONAL
PERIMETER DEFENCE
The notion of ”Perimeter Defence” has been a part
of information security that generated a significant
amount of discussion. An organization seeking to
protect its information infrastructure will create lay-
ers of defence starting with protecting its “perime-
ter” which traditionally denotes what physically sep-
arates its information infrastructure from the outside.
Tools for protecting the perimeter include firewalls,
filtering capabilities at routers, and the use of a DMZ
(demilitarized zone) among others. The effective-
ness of perimeters has been challenged as boundaries
around an organization information infrastructure has
become blurred. This in part is due to that fact that
many employees connect from outside and with tech-
nologies such as HTTP that could allow attackers to
pass through firewalls undetected.
In the cloud, an organization will have little con-
trol over how and where its data and applications are
hosted. The notion of perimeter defence as known to-
day will be challenged even more. In this section, we
ask the question: does moving an organization’s data
and applications into the cloud eliminate its capabil-
ity to keep its perimeter defence at all?
At this point, the answer seems to be that the no-
tion of perimeter defence will change dramatically in
the cloud. An organization could extend its security
protection to complement what the Cloud Provider
(CP) offers and not rely solely on the CP’s pro-
vided security. Even when the CP offers all kinds
of promised security, an organization that is serious
enough about its security may want to provide addi-
tional protection to what the CP provides to extend its
protection beyond its traditional perimeter. This could
mean extending protection
3
beyond its perimeter to
3
For example: to maintain data privacy and integrity,
protect applications from tampering, and even to conceal its
application activities from competitors.
include various parts of the cloud that will dynami-
cally change both in location and in nature (software,
platform, and infrastructure).
In all cases, it is expected that the CP will offer
some security tools and mitigation services. But how
can an organization extend its protection differently
depending on the type of cloud service provider?
• The Case of IaaS. When asking the CP (IaaS
provider such as Amazon or GoGrid) for a vir-
tual machine, the CP is expected to secure the
network, the host OS, the hypervisor and isolate
VM instances. The CP could also provide the
clients with tools to use and customize. For exam-
ple, Amazon offers Multi-Factor Authentication,
customizable firewall, secure APIs, and Key man-
agement tools (Amazon, 2010). The organization
could extend its protection beyond its perimeter
to all the virtual machines that it has control over
in the cloud. Leveraging the organization’s secu-
rity tools and expertise could be done in a num-
ber of ways including securing the guest OS, en-
suring compliance with industry-specific require-
ments, creating multiple layers of security around
the VM, etc.
• The Case of PaaS. If the required service from
the cloud is a platform where an organization de-
ploys its applications, the CP (PaaS provider) in
this case should protect the network and the plat-
form. The extended perimeter is this case protects
the application within this provided platform. An
example of such an environment is Google APP
Engine. The platform offers a protected sandbox
to the application with some restrictions on what
could be accessed. However, it offers customers
the option to integrate with a third-party Single
Sign-On provider (Google, 2011). Another ex-
ample is Microsoft Azure which offers identity
management, authentication, and other mitigation
services. However, for some threats, the appli-
cation has to implement its own mitigation (Mar-
shall et al., 2010).
Suppose that the application provider does not be-
lieve that the CP provides sufficient security. This
begins to raise the question of where more protec-
tion can possibly come from. The cloud offers the
ability to scale at limitless proportions; however,
all the application images are exactly the same.
Once an attacker succeeds with one deployed in-
stance, it is a simple extension to create an auto-
matic exploit to attack the rest.
• The Case of SaaS. This is the situation where the
service sought from the cloud is solely an appli-
cation such as moving the enterprise email to a
A NEW PERSPECTIVE ON PROVIDING CLOUD COMPUTING SECURITY - A Position Paper
653