SLA summaries

6.6.1 Amazon

Amazon Cloud system is called EC2 and it provides resizable capacity in the Cloud. According to Amazon the EC2 includes:

x Interfaces to configure firewall settings

x Selectable IP range that will connect to the existing infrastructure using encrypted IPSec VPN

Their service comment states that they are not responsible for any factor outside of their control.

We view that the SLA states that Amazon is not liable for anything that happens as soon as the customer accesses the Cloud or decides to put an application on there. EC2 has a clause that states that removes them accountability for anything that happens in the Cloud if it is by you or any third party and from equipment that is not theirs.

If EC2 is not up for the stated uptime, which is 99.95% is upon the customer to monitor this and report to Amazon. If Amazon does find itself at fault they will issue a credit back to the customer but it is up to the customer to monitor the up time for the whole year.

6.6.2 Microsoft

0LFURVRIW·V ILUVW VWHS WRZDUGV WKH &ORXG &RPSXWLQJ PDUNHW FRPHV LQ WKH VKDSH RI 0LFURVoft Azure which is a platform with Azure as the OS operating in the platform environment. On this platform that Microsoft run through their datacenters the customers should be able to have applications and tools for building applications.

In the SLAs WKDWFRYHUV0LFURVRIW·VGLIIHUHQW$]XUHVHUYLFHV (Microsoft 2010) they specify what they are providing and what will happen if they do not provide it, how they calculate the bill and in what situations they are not responsible. In essence Microsoft puts a lot of responsibility on the customer which means a lot of the possible errors that could occur are in the hands of the customer.

If the service does not follow the uptime directives Microsoft follow a credit system which governs how much the customer should pay even if the service percentage is not met. The different Cloud services that Microsoft offers are not connected when billing is calculated or service credits are given.

6.6.3 Google Apps

*RRJOH$SSVLV*RRJOH·V6DD6VROXWLRQDQGLWLQFOXGHVYDULRXVZHEDSSOLFDWLRQVVXFKDV*PDLO

and Docs. Google Docs is web based word processing, presentation, spreadsheet and form applications. Google Apps has some different editions where The Standard Edition is free to use and has a limited amount of storage, while the Premium Edition offers more storage for a fee.

There is also an Educational Edition which is also free and combines functions from the Premium and Standard Edition.

Google promises an uptime of 99.9 %, but if that uptime is not met, the customer receives credits in form of free days for using the service. For example, if the uptime goes down to less than 99 % but still more than 95 %, seven days of service is added to the end of the service term at no charge. However, the customer have to notify Google about the downtime within thirty days, or else the customer will not receive any service credits. The service credits added cannot exceed fifteen days per month and they cannot be converted to monetary amounts.

Google disaffiliates themselves from performance issues that are caused by factors that is outside RI*RRJOH·VUHDVRQDEOHFRQWURORUWKDWLVFDXVHGE\WKHFXVWRPHU·VRUWKLUGSDUW\HTXLSPHQW

In the SLA, Google state that they have scheduled downtime where the service will go down for a period of time. The customer will be notified about it five days prior to the downtime, and that scheduled downtime will not exceed twelve hours per calendar year. Scheduled downtime is furthermore not considered as regular downtime periods and will not affect the uptime percentage. (Google, 2010)

6.6.3.1 Google App Eng ine

*RRJOH $SS (QJLQH LV *RRJOH·V FRQWULEXWLRQ WR WKH Cloud environment in the platform as a service mDUNHW ,W SURYLGHV WKH SRVVLELOLW\ WR FUHDWH VWRUH DQG UXQ DSSOLFDWLRQV RQ *RRJOH·V

servers using development languages as Java and Python. As it should be with a Cloud service, you only pay for what you use and there are no installation costs and no other recurring fees. You are billed by consumption regarding storage and bandwidth (measured by gigabyte). If you have a specific budget you have to follow, you can control the maximum amount of usage by setting a limit. However, Google App Engine lacks a service level agreement. The only thing you can find online is terms of service. In other words, Google has not stated a certain uptime percentage so you are not guaranteed payback if the service goes down (Jackson, 2009).

6.7 Security Risks

Table 6.1 presents the security risks that we have found from NIST, CSA, or ENISA. Most of the risks that we found come from CSA but NIST and ENISA also state similar security risks and we have added them into the chart. The security risks column describes the risks and also what organization we found them from. The Impact column describes how it can affect the organization. The SPI model columns reveals what domain it affects. As you can see most of the risks actually concern all the domains but there are a few that only affects one or two SPIs. The countermeasure column described some steps that the organization can take to help minimize the security risks. The countermeasures that are stated are directly gathered from CSA, NIST, and ENISA. It is also important to state that there are plenty of countermeasures that can actually be implemented by having certain clauses in the SLA, as in demanding providers wipe persistent media before it is released and conducting vulnerabilities scans. We have grouped together certain security risks due to the fact that they are very similar. The definitions of the different security risks in the isolation group are below:

x Shared technologies: Hypervisors having flaws that allow guest operating systems to gain inappropriate levels of control or influence on the underlying infrastructure (CSA) x Isolation Failure: Failure of mechanisms separating storage, memory, routing, and even

reputations between different tenants (ENISA)

x Dependence on Secure Hypervisor: An organization dependence on the reliable and secure hypervisor (NIST)

x Multi-tenancy: The multiple organizations that have access to the infrastructure and the ability of the different organization ability to view others data or control the infrastructure (NIST)

Security Risks Impact SPI Models Countermeasures Abuse and Nefarious use

of Cloud Computing (CSA/Experts)

Due to weak registration systems allow anonymity and providers fraud detection capabilities are limited so criminals can use this to expand their reach and improve their

effectiveness.

x IaaS x PaaS

x Stricter Initial registration and validation process

x Enhanced credit card fraud monitoring and coordination

x Extensive monitoring of customer network traffic

Depending on a weak set of interfaces and applications exposes the organization to multiple set of security risks related to Confidential, Integrity, and Availability.

x IaaS x PaaS x SaaS

x Analyze the security model of the provider

x Ensure strong authentication and access controls are implemented along with encrypted transmissions

x Understand the dependency chain associated with the API Malicious Insiders

(CSA/ENISA/Experts) Attraction to Hackers (NIST)

Malicious insiders can impact an organization is related directly with their level in the

organizations and their ability to infiltrate.

Human element is a vital issue when employing services in the Cloud so it is of vital importance that the customer understand what the provider are going to do to detect and defend against malicious insider.

x IaaS x PaaS x SaaS

x Enforce strict supply chain management and conduct a comprehensive supplier assessment

x Require transparency into overall information security and management practices

x Determine security breach notification processes

Hackers will attempt to gain access to shared elements (e.g. Disk Partitions, CPU Caches and GPUs) because of the fact that they were never designed for strong compartmentalization.

x IaaS x Implement security best practices for installation and configuration

x Monitor environment for unauthorized changes/activity

x Strong authentication and access control for administrative access and operations x Enforce SLAs for patches and

vulnerability

x Conduct vulnerability scanning and configuration audits

Data Loss or Leakage

(CSA/Experts) Data that is lost or leaked can have different impacts on the organization. The data could have competitive or financial information that is vital to maintain a competitive edge or can lead to compliance violations and legal ramifications.

x IaaS, x PaaS x SaaS

x Strong API access control x Encrypt data in transit

x Analyzes data protection at both design and runtimes

x Strong key generation, storage and management, and destruction practices x Demand providers wipe persistent media

before it is released

x Demand providers backup and retention strategies

Account or Service

Hijacking (CSA) Hackers that have stolen credentials can access critical areas of a deployed Cloud which will endanger the organization. Account or Service Hijacking remains a top threat to Cloud Computing.

x IaaS x PaaS x SaaS

x Prohibit the sharing of account credentials between users and services

x Use two strong factor authentication techniques

x Employ proactive monitoring to detect unauthorized activity

x Understand the providers security policies and SLAs

Unknown Risks Profile

(CSA) Customers often leave certain areas overlooked (e.g. what information will the provider disclose in an event of a security event, how is the data or related logs stored, or even internal security) when deciding to invest in the Cloud.

x IaaS x PaaS x SaaS

x Disclosure of applicable logs and data x Partial/full disclosure of infrastructure

details

x Monitoring and alerting on necessary information

Insecure or Incomplete Data Deletion (ENISA/Experts)

The information that is not completely deleted could still reside in insecure locations. It may be impossible to fully delete information since full data deletion is only possible by destroying the hard drive that might be shared by multiple organizations.

x IaaS x PaaS x SaaS

x Ensure that the provider has effective encryption