SMALL BUSINESS CYBERSECURITY

Simple, Easy to Follow Help
For the Small Business

Certified Information Systems Security Professional
ISC2 CISSP #473513 Since 2013

Clean Definitions

Measuring and Manageing Information Risk,
a FAIR Approach
1st Edition

Authors: Jack Freund and Jack Jones
Published by: Butterworth-Heinemann, Oxford, UK
2015
ISBN: 978-0-12-420231-3 (Paperback)

How to Measure Anything in Cybersecurity Risk

Authors: Douglas W. Hubbard and Richard Seiersen
Published by: John Wiley and Sons, Inc., Hoboken, New Jersey, USA
2023
ISBN: 978-0-11-1989230-4 (Hardback)
ISBN: 978-0-11-1989232-8 (ePDF)
ISBN: 978-0-11-1989231-1 (ePub)

What is the Cloud?

Cloud simply means remote controled, shared, data centers, computers, operating systems, services and/or applications, which you pay for using. They measure your usage in time, space, users, quantity, memory, processors, and maybe additional related services that they also provide which you subscribe to. Cloud services are typically provided in three different ways, Infrastructure, Platform and Software, detailed below. Put as simply as possible, "The Cloud" is just someone else's computer or platform or software installation that you choose to processed or stored your information on. Though it is not necessarily just out there for anyone to attack or steal, you do need to worry about a few things with regard to how your Cloud is setup, maintained, exposed and operated.

Connections to the Cloud

Connecting to Cloud resources is typically done over the Internet and is best when connecting to browser based applications. Some applications that you may use might not be possible with just a browser. This may make your decision for you as such applications typically take up lots of bandwidth and are latency sensitive. Depending upon the needs to run the applications in the Cloud, you may need fast Internet circuits at your offices. It is also possible to purchase direct connections between your offices and the Cloud providers, should you choose. This will give you more of a private cloud feel, but at an increased recurring cost. When you build your Cloud devices in IaaS, you have the option to make them available on the Internet, or not. You can setup firewall rules, or not. You can load balance the services, or not. You can enlist and use Internet available authentication systems (Entre ID, Okta, Ping, etc.) or others. You can also connect through third party available firewalls, load balancers, proxy servers and other filters, of you choose to pay for that. It is up to you.

The most secure way to setup your services and connect to then in the cloud is by keeping them in a private subnet (no public IPs) which is routerable from your on premises locations, and to use a VPN, SD-WAN or whatever the latest technology if for tunneling from your site(s) to the cloud location. You may need to purchase (lease) a VPN device on the cloud side from your favorite vendor, but most vendors of such hardware also have virtualized versions.

Infrastructure as a Service (IaaS)

Cloud infrastructure providers have server, network, power and cooling systems, hopefully in trustworthy and redundant data centers around the world. They employ people to maintain the sites, hardware, platforms, operating systems, applications and tools so you can manage your paid-for environment. Web based tools are used by you to deploy operating systems onto the remote hardware and to reconfigure the computers as needed. You can also define connections, allowed ports and protoctols, accounts permitted or denied to your setup as well as logging of actions. Much is pre-configured, or offered pre-configured as a package, but you can also build custom installations, if the provider has the operating system and the hardware choices you are looking for. The Cloud provider keeps the infrastructure systems available and updated. You are totally responsible for what you install with regard to patching, updates, configurations, accounts, protection and so forth.

Platform as as Service (PaaS)

Cloud service providers can also sell you time on a platform, such as a database, or a web server. This is called Platform as a Service, or PaaS. These services are deployed by you, very similarly to the operating systems in IaaS. They are "pre-canned" systems, meant to save you initial configuration and upkeep time. Instead of you maintaining the underlying operating systems and the platform appications with updates, patches and protections, they do. You only maintain the parts of the platform that you customize. This takes responsibility from you and your people, hopefully saving effort and time.

Software as a Service (SaaS)

There are many vendors who have created applications on paid-for IaaS and PaaS setups "in the Cloud" to run. They "rent" you time on their applications. Some applications are shared, and some are isolated instances. In a shared application space, it is normal for your data to be totally segregated from other clients' data through permissions and sometimes through encryption. If you choose your own instance of the application, it will probably cost more than a shared instance, but that depends on the contract and how the software works. You may feel more secure on you own instance, but it is not necessarily so. Because you are paying for the software use rights for a period of use, you need to very carefully read the contract, making sure you are the owner of the informaiton that you put in there. In a normal Sofware as a Service relationship, they are going to keep everything updated, backed up, and so forth, over the time period that you are paying for the use rights.

In any of the above solutions, knowing the contract and fact checking the vendor initially for secure and consistant business practices and on a recurring basis is critical. It is also good to know that, depending upon your choices when setting up the environments, your servers, platforms and software may or may not be available for connections from anyone with Internet access. This is a security parameter often forgotten. We can talk about all that with every possibility that you want to investigate.

Can I trust the Cloud?

The choice to use cloud resources to host some or all of your information and information processing applications is yours. Some time ago, I did not recommend using the Cloud for anything but development. However, things have changed. Cloud providers and cloud based application providers want to sell you services, and they are enhancing them to the point that they are very secure, solid and super helpful. Their contracts and consistency are stellar. Many cloud services actually enhance your ability to be always connected, over the Internet, because you tune your mobile compute devices to always connnect to them to assure things are safe and correct. That said, nothing is perfect, and going forward with blind faith is not a good option. You need to do the research and keep up with it on at least a yearly basis.

Risk in the Cloud?

In practice, risk can be treated in four (T-E-A-M): Transfer it to someone else; Eliminate the activity that causes it; Accept it fully as is; or Mitigate the worst parts to make it fit your business's risk appetite. In the cloud, you can do a little bit of everything on that list, depending upon the contract that you have with the provider. It is all in the details, so you should read the contract carefully, ask lots of questions and read those SOC1 and SOC2 Type II reports, which show you how well they do or do not follow their own financial and security plans, before your sign on the dotted line.

You should also take the "trust but verify" position and work with them to setup every type of monitoring, log collection, testing and scanning that you can. Depending on the type of Cloud services you subscribe to, various levels of monitoring and testing are available. With Infrastructure, you should be able to capture operating system, platform and applications logs, right from the systems that you deploy. You will not be able to get their hardware logs. Those belong to the provider. For their extra services that you subscribe to (such as firewalls and load balancers) you should be able to direct those logs to your log collectors. Which logs and reports you can gather, however, will depend on the rules in the contract. With Platform as a Sevice, you will get less than Infrastructure as a Service, and with Software as a Service, even less.

Testing the Cloud?

No Cloud provider can afford to have you penetration test their systems, but, beginning with operating systems, platforms and applications that you deploy on Infrastructure as a Services providers, you can vulnerabilty test, all you want but maybe not from the outside without special arrangments. If you create a testing machine inside the Cloud environment which you only allow to be run on your own compute resources, you should not have any problems. Patching and updating your installed devices is normally fine, with no special arrangements. As you move to Platform as a Service, your vulnerability testing of the platform deminish or disappear, because the provider is responsible for that along with patching and updating, and you don't want to get in their way. As you go to Software as a Service, they totally disappear. However, in many instances, you should still be able to divert account usage, system connection and data add/move/change logs to your log collectors if you wish. Basically, if you didn't install it, you can't do much to it or get as much from it.

This may sound odd to some, but you DON'T really want to fact check the providers of services on your own by double collecting and looking at things they are responsible for. They do that. First, it may violate the contract. Second, they may stop looking themselves if they think you are. And third, if they know that you can know what happens, they can deflect liability issues onto you, should something go wrong. With Cloud usage and a solid contract, you are transferring much of the risk in hosting operating systems, platforms and applications to someone else. It's nice that way. You are not at fault for as much, other than for hiring the provider. Your chance to fact check them will come every year, if you choose, when you can evaluate how well they score on the third-party produced audit report of the controls they claim to use (typically in a SOC2 Type II report). BUT, you do need to understand what they are claiming in that report so that you are satisfied that it will actually be secure. I can help with that part, very, very, very, part time.

Can I afford the Cloud?

That's for you to decide. It will depend on how you calculate the cost. There is cost to buy gear. There is cost to deploy it. There are maintenance costs. There are real estate costs for floor space. There are utility costs. There are innsurance costs. There are taxes and other employee overhead costs. But keep in mind that the Cloud provider has those as well, and they will want to make a profit on what they do and charge you for. Their hope is to spread the cost of highly skilled employees across many more systems than just what you have and to automate beyond what your team may be capable of. Calculate carefully.

I encourage you to do the math. Evaluate what you have today and what you could have in the Cloud tomorrow. The speed and agility of rapid development, test, quality assurance and deployment is highly worth it to some. If you are in a constant iterative mode for improvement, your apps are web based, and if you really need the connection and systems uptime that the Cloud can provide, you can't beat it. If your IT stack is more static, not web based, and a little downtime is OK, here and there, and super fast connection speeds from your in building staff over the Internet hosted resources don't matter, it may not be worth it to go to the Cloud. It's your information. It's your call. Remember that you can always go Cloud or come back later.

NULL at the moment.