Currently browsing tag

Cloud

Tough Security Questions for SaaS Providers – Part 2

Current results from Data Survey #1: Data Scientists. Thanks to everyone for helping the world understand Big Data better!

Please take the following 2-minute survey to help us understand your hadoop environment better.

This is part 2 of the tough security questions for SaaS providers. In part 1 of the series, we asked the following questions:

1. Data Locality – Where’s my data?
2. Data Segregation – How is my data segregated with other customers, potentially my competitors?
3. Data Access – Who can access my data in your company?
4. Access Audit – Who has accessed my data and where’s my access logs?

We are continuing this discussion with the following questions in part 2.

5. How are the users authenticated and authorized?
6. Web Application Security – How secure is the SaaS provider’s web application?
7. Data Breaches – How do you protect my data from insider breaches?
8. PCI DSS – Are you compliant with PCI DSS?

5. How are the users authenticated and authorized?

Companies have spent hundreds of man years and millions of dollars trying to setup single-sign-on systems inside the corporate firewalls. Most companies, if not all, are storing their employee information in some type of LDAP servers. In the case of SMB companies, a segment that has the highest SaaS adoption rate, Active Directory seems to be the most popular tool for managing users. In many cases, companies have designed their IT infrastructure so that all authentication, including VPN, web proxy, file server, and others will go through this single infrastructure. The process of employee onboarding and termination is much easier this way.

Just as companies start to have some success, the advent of the SaaS model changes the scenario again. With SaaS, the software is hosted outside of the corporate firewall. Many times user credentials are stored in the SaaS providers’ databases and not part of the corporate IT infrastructure. This means SaaS customers must remember to remove/disable accounts as employees leave the company and create/enable accounts as come onboard. In essence, having multiple SaaS products will increase IT management overhead.

SaaS customers will start asking questions on identity and access integration and providers would be wise to design such features in early on. For example, SaaS providers can provide delegate the authentication process to the customer’s internal LDAP/AD server so that companies can retain control over the management of users.

6. Web Application Security – How secure is the SaaS provider’s web application?

One of the “must-have” requirements for a SaaS application is that it has to be used and managed over the web (in a browser.) This creates an interesting scenario. In the on-premise scenario, when a vulnerability is found, at least you have your firewall protecting the application so you may get a bit more time to patch it (assuming the application vendor provides the patch in a timely fashion.) However, in the SaaS world, there is no such luxury. Any vulnerability identified can potentially have detrimental impact on all of the customers. Even leading security companies aren’t immune to security holes in their web applications.

Web application security is quite a hot topic these days and it’s discussed by many security researchers such as rmogull and RSnake. Here’s an interesting article on “What web application security really is“.

Verizon Business recently released their Verizon Business 2008 Data Breach Investigations Report. Of all the breaches, 59% of the breaches involve hacking, with the following breakdown:

  • Application/Service layer -39%
  • OS/Platform layer – 23%
  • Exploit known vulnerability -18%
  • Exploit unknown vulnerability – 5%
  • Use of back door -15%

Attacks targeting applications, software, and services were by far the most common technique, representing 39 percent of all hacking activity leading to data compromise. This follows a trend in recent years of attacks moving up the stack. Far from passé, operating system, platform, and server-level attacks accounted for a sizable portion of breaches. Eighteen percent of hacks exploited a specific known vulnerability while 5 percent exploited unknown vulnerabilities for which a patch was not available at the time of the attack. Evidence of re-entry via backdoors, which enable prolonged access to and control of compromised systems, was found in 15 percent of hacking-related breaches. The attractiveness of this to criminals desiring large quantities of information is obvious.

Currently there’s really no mandate or requirement for SaaS providers to provide detailed security analysis of the SaaS application. However, it would be wise for the SaaS providers to start considering something similar to what PCI DSS has required of the merchants:

  1. 6.5 Develop all web applications based on secure coding guidelines such as the Open Web Application Security Project guidelines. Review custom application code to identify coding vulnerabilities. Cover prevention of common coding vulnerabilities in software development processes, to include the following:
    1. 6.5.1 Unvalidated input
    2. 6.5.2 Broken access control (for example, malicious use of user IDs)
    3. 6.5.3 Broken authentication and session management (use of account credentials and session
      cookies)

    4. 6.5.4 Cross-site scripting (XSS) attacks
    5. 6.5.5 Buffer overflows
    6. 6.5.6 Injection flaws (for example, structured query language (SQL) injection)
    7. 6.5.7 Improper error handling
    8. 6.5.8 Insecure storage
    9. 6.5.9 Denial of service
    10. 6.5.10 Insecure configuration management
  2. 6.6 Ensure that all web-facing applications are protected against known attacks by applying either of the following methods:
    • Having all custom application code reviewed for common vulnerabilities by an organization
      that specializes in application security

    • Installing an application layer firewall in front of web-facing applications.

Additional sources of information provided as a starting point for more information on web application security would include

  • OWASP Top Ten
  • OWASP Countermeasures Reference
  • OWASP Application Security FAQ
  • Build Security In (Dept. of Homeland Security, National Cyber Security Division)
  • Web Application Vulnerability Scanners (National Institute of Standards and Technology)
  • Web Application Firewall Evaluation Criteria (Web Application Security Consortium)

Trey Ford of Security Spin Control has a fairly good explanation of the recently released PCI information supplement on requirement 6.6.

SC Magazine also has an article on Deconstructing PCI 6.6 for the management folks.

7. Data Breaches – How do you protect my data from insider breaches?

In the Verizon Business breach report blog, Verizon Business stated that

While criminals more often came from external sources, and insider attacks result in the greatest losses, criminals at, or via partner connections actually represent the greatest risk. This is due to our risk equation: Threat X Impact = Risk

  • External criminals pose the greatest threat (73%), but achieve the least impact (30,000 compromised records), resulting in a Psuedo Risk Score of 21,900
  • Insiders pose the least threat (18%), and achieve the greatest impact (375,000 compromised records), resulting in a Pseudo Risk Score of 67,500
  • Partners are middle in both (73 39% and 187,500), resulting in a Pseudo Risk Score of 73,125

Many SaaS advocates claim that SaaS providers can do a better job at protecting the customers’ data. Unfortunately, just because the data is now in the cloud, it does not reduce the risk of insider breaches. Insiders still have access to the data, they are just accessing it a different way. Just because the data is in the cloud, the responsibility of segregation of duties and access authorization still fall on the customers, not the SaaS or cloud computing providers. So yes, it may reduce the chance of insiders getting direct access to, say, a database, it does not in any way reduce the risk of insider breaches. In fact, it may even increase the possibility as you now have to take into consideration of the cloud or SaaS providers’ employees. They have access to a lot more information and a single incident could expose information from many customers.

SaaS providers should be prepared to answer questions on what tools and processes are utilized to ensure segregation of duties and protect from insider breaches. Remember, in the case of the mult-billion dollar insider incident at Société Générale, IT management had implemented all of the controls recommended by auditors, but nobody was monitoring them. So it’s extremely critical to be able to show the processes around these security controls.

8. PCI DSS – Are you compliant with PCI DSS?

PCI DSS has a specific section for hosting providers (including SaaS providers):

Requirement A.1: Hosting providers protect cardholder data environment

As referenced in Requirement 12.8, all service providers with access to cardholder data (including hosting providers) must adhere to the PCI DSS. In addition, Requirement 2.4 states that hosting providers must protect each entity’s hosted environment and data. Therefore, hosting providers must give special consideration to the following:

A.1 Protect each entity’s (that is merchant, service provider, or other entity) hosted environment and data, as in A.1.1 through A.1.4:

  1. A.1.1 Ensure that each entity only has access to own cardholder data environment
  2. A.1.2 Restrict each entity’s access and privileges to own cardholder data environment only
  3. A.1.3 Ensure logging and audit trails are enabled and unique to each entity’s cardholder data environment and consistent with PCI DSS Requirement 10
  4. A.1.4 Enable processes to provide for timely forensic investigation in the event of a compromise to any hosted merchant or service provider.

A hosting provider must fulfill these requirements as well as all other relevant sections of the PCI DSS. Note: Even though a hosting provider may meet these requirements, the compliance of the entity that uses the hosting provider is not necessarily guaranteed. Each entity must comply with the PCI DSS and validate compliance as applicable.

Simply put, SaaS providers must be compliant with PCI DSS in order to host merchants that must comply with PCI DSS.

We will continue with our tough security questions in part 3 of this series.

Mike Kavis on Cloud Computing

Current results from Data Survey #1: Data Scientists. Thanks to everyone for helping the world understand Big Data better!

Please take the following 2-minute survey to help us understand your hadoop environment better.

Mike Kavis, aka madgreek65, did an interesting 7-minute video blog on the topic of cloud computing where he explains his view of it as well as explaining the risks. He then followed up with a blog post on The future is in the Clouds.

In the video blog, Mike tried to explain why customers shouldn’t have to worry about the loss of data control and security. First of all, as Mike said, “these companies invested in billions of dollars in infrastructures and security and have armies of security professionals.” Therefore, these companies will have greater control and better governance and do a much better job at protecting customers’ data than they can. Second, since “most security breaches are inside jobs”, cloud computing will “greatly reduce the risk” of such breaches. Even though there will still be some, but the risks are reduced. Third, companies are already putting their data out there, including payroll, accounting, CRM. Since this is already being done, we just need to “shift the way we think” because “this is the wave of the future” and it’s the “next game changer.”

I have to disagree on all three points. First, not all “cloud computing” companies that have sprung up can and will invest billions of dollars in infrastructure and security. If you just look at Amazon or Google, yes, maybe. However, there are plenty of cloud computing startups that have no such budget and they have the same problems as every startup when it comes to deciding whether to invest in infrastructure or security (i.e., infrastructure wins, security loses.) So a blanket statement like that doesn’t make any sense. Even in the case of Amazon and Google, just because they can have more security professionals, it doesn’t mean customers should just trust them and not worry about security and data privacy.

Second, on the topic of insider breaches, just because the data is now in the cloud, it does not reduce the risk of insider breaches. Insiders still have access to the data, they are just accessing it a different way. Just because the data is in the cloud, the responsibility of segregation of duties and access authorization still fall on the customers, not the SaaS or cloud computing providers. So yes, it may reduce the chance of insiders getting direct access to, say, a database, it does not in any way reduce the risk of insider breaches. In fact, I will argue that it may even increase the possibility as you now have to take into consideration of the cloud or SaaS providers’ employees. They have access to a lot more information and a single incident could expose information from many customers.

Third, the argument that because companies are doing it already and are already putting their payroll, account, and CRM information in the cloud, customers should just shift the way they think also doesn’t sit well with me. Just because others are doing it doesn’t mean it’s the right thing to do. Customers shouldn’t just throw away their security policies and adopt a new way without evaluating the risks.

So am I advocating companies not to adopt cloud computing and SaaS? Absolutely not. What I am advocating is that companies evaluate the potential risks and understand the business impacts before jumping into the “wave of the future.” Don’t just trust the cloud or SaaS providers to take care of security. At the end of the day, it’s the customer, not the providers, that’s signing off on the SOX report and go to jail (or fined) if the audits fail.

I am working on a series on “Tough security questions for SaaS providers“. It should serve as a good set of questions to ask when evaluating cloud or SaaS providers.

Interesting nuggets from Slideshare

Current results from Data Survey #1: Data Scientists. Thanks to everyone for helping the world understand Big Data better!

Please take the following 2-minute survey to help us understand your hadoop environment better.

Designing the SaaS Enterprise

Good set of slides from Slideshare, by John Overton, on best practices for building a SaaS company, via bitcurrent.

Moving to SaaS

Another slide deck from bitcurrent. It looks at the perils and best practices of moving an application from internally-run to software-as-a-service.

Navigating the Labyrinth

Found another one that’s by Rackspace, but probably more vendor pitchy…

Tough security questions for SaaS providers – Part 1

Current results from Data Survey #1: Data Scientists. Thanks to everyone for helping the world understand Big Data better!

Please take the following 2-minute survey to help us understand your hadoop environment better.

We will be writing a series of blog posts on the tough questions that SaaS providers can expect to get from customers or they should ask themselves. The questions will span many different areas including security, compliance, sales, marketing and operations. This is Part 1 of the security questions.

As we mentioned previously here, one of the biggest obstacle to enterprise SaaS adoption is the issue of trust. Customers are asking SaaS providers “Can I Trust You?!” The security analysts and warriors are asking similar questions.

Some SaaS advocates have argued that concerns for SaaS security are just red herring. It is true that, to date, there hasn’t been any major breaches amongst SaaS providers. However, we have already seen some activities such as the breach at Salesforce.com. In addition, we have seen many anecdote evidence that multi-tenant architectures in the B2C (e.g., Flickr, YouTube) world are prone to data leakage. I have also personally experienced this on YouTube. The following screen capture shows an account that’s NOT mine (again, that’s NOT me in the video!!) but it popped up in my browser when I tried to go to YouTube.

One may argue that these are consumer sites and are not relevant for the SaaS providers. However, the same technologies and architectures are being used in both the consumer and enterprise world. In fact, as the trend of IT consumerization continues, we will see more and more of the consumer technologies being used in enterprise applications. Think about it this way, what if this Salesforce.com and your customer list popped up in your competitor’s screen?

SaaS providers should be prepared to answer security questions from customers and enterprises. Here are a list of questions that SaaS providers will likely get asked during customer trials/evaulations.

1. Data Locality – Where’s my data?

Due to compliance and data privacy laws in various countries, locality of data is of utmost importance in many enterprise architecture. For example, in many EU and South America countries, certain types of data cannot leave the country because of potentially sensitive information. In addition to the issue of local laws, there’s also the question of whose jurisdiction the data falls under when an investigation occurs. In most cases, the government where the data is housed will likely win. A good example of this type of concern is when the French cabinet banned the use of Blackberry devices.

Many enterprises have architected around these issues for the on-premise software they install. However, with cloud computing and SaaS, this issue is even more exasperated. In a cloud computing environment, sometimes you don’t know where your data is stored or where your application is being run; and some proponents of cloud computing are also saying that you shouldn’t have to worry about where the computing resources are as long as your application is running and behaving as it should. However, other leaders in the cloud computing space are taking note of the data privacy and locality issues. For example, Amazon recently announced the availability of an European S3 cloud, and Salesforce.com is also planning Singapore data center.  

Given the regulatory compliance and data privacy concerns, SaaS providers should be ready to answer tough questions about where their computing resources are and will customer data be ever transferred outside to another jurisdiction with different laws.

2. ata Segregation – How is my data segregated with other customers, potentially my competitors?

Everyone’s talking about the benefits of multi-tenancy in the SaaS world, but many seem to ignore one of the biggest security concerns, mixing customer data together, that came along with multi-tenancy.   

One of the reasons that hampered SaaS adoption initially was trust. End users must trust that the SaaS providers have the best security in place to protect their data and never expose their data to anyone outside of the authorized domain. Therefore, the ability to segregate data by end customer is a critical requirement for the SaaS providers. There are many architectural methods in segregating the end customer data. At the end, the requirements come down to that users must never see the data that they are not authorized to see, and that end customer’s data should never be exposed to other end customers. 

Saas Providers would be wise to consider data segregation early on in the architectural design. For most ISVs turning into SaaS providers, this is an unfamiliar territory and should seek guidance if possible. SaaS providers should also understand the customer concerns and address them early on.

3. Data Access – Who can access my data in your company?

Enterprises have spent hundreds of thousands of dollars on identity and access management systems, log management systems and other software to ensure that employees access only information they are allowed. Within the confines of their firewalls, IT organizations may feel that they have the situation somewhat under control. The advent of SaaS have changed that. With the company data outside of the firewall and in a “cloud,” IT organizations no longer can control who and when their data-in-the-cloud will be accessed. Without visibility into the cloud, IT organizations are accepting a much bigger risk compare to when everything’s inside the firewall. Even though many SaaS providers have offered various capabilities such as authentication integration with customers’ own LDAP servers, this perception of lost control is a difficult hurdle to get over.

SaaS providers offering cloud services, whether it’s infrastructure, platform or application, should accept the responsibility of protecting customer data as a single breach could affect all of the customers. SaaS providers must be prepared to help customers understand their security policies on user access, activity monitoring as well as segregation of duties.

4. Access Audit – Who has accessed my data and where’s my access logs?

The last few years we have seen a rise of log management and SIEM solutions aimed at compliance-aware organizations. These products is responsible for collecting, analyzing, correlating, archiving and reporting on all activities happening inside an IT infrastructure. Part of the reason these products became such a success is because of the need to track and monitor user activities in the world of regulatory compliance. In addition to compliance, IT organizations use logs to help them identify security issues, perform troubleshooting and forensics analysis, and analyze traffic and user patterns.

With software in the cloud, network, system and application logs are no longer easily accessible by IT organizations. They either have to negotiate access to these logs during contract time, or they have find new ways of monitoring user activities. Given that the IT organizations don’t “own” the software, it makes it even more difficult to “hack” around the system. Without access logs, IT organizations may not be able to answer simple questions from auditors, such as “who have accessed the financial information in the past quarter?”

Knowing how critical access logs are to compliance, operations and security matters for IT organizations, SaaS providers should consider providing access logs as a part of their normal service or have it as an option for customers. As an example, Amazon’s S3 service offers options to enable and download access logs.

We will continue with our tough security questions in part 2 of this series.

Survey: why companies still shun SaaS

Current results from Data Survey #1: Data Scientists. Thanks to everyone for helping the world understand Big Data better!

Please take the following 2-minute survey to help us understand your hadoop environment better.

Computerworld has an interesting article titled Survey attempts to answer why companies still shun SaaS. (I believe it’s originally from CIO.com.)

A late 2007 survey of North American and European software IT decision-makers found that just 16 percent of respondents said they were already using or currently piloting SaaS applications. Conversely, more than 80 percent were still on the sidelines-curious, for sure, but not yet completely sold or running SaaS apps right now. (Forty-six percent said they were interested in SaaS or planning to pilot; 37 percent said they were “not at all interested.”)

According to a Forrester Research survey, these are the top eight reasons why companies say “No Thanks” to SaaS.

66% Integration issues
61% Total cost of ownership concerns
55% Lack of customization
50% Security concerns
42% “We can’t find the specific application we need”
39% Complicated pricing models
39% Application performance
34% “We’re locked in with our current vendor”
(Note: Multiple responses accepted)

Saas Week Podcast – Common SaaS Misconceptions

Current results from Data Survey #1: Data Scientists. Thanks to everyone for helping the world understand Big Data better!

Please take the following 2-minute survey to help us understand your hadoop environment better.

Saas Week just posted a new podcast on Common SaaS Misconceptions with Chris Cabrera, CEO of Xactly.

Download file here.

Chris, in the podcast, talked about 3 major misconceptions: security, integration and legacy concerns.

Security (and data privacy for that matter) has been, and will likely continue to be, the biggest concern. Chris argued that this concern is really red herring and that smart CIOs are finding that SaaS companies sometimes even have more security measures and better security policies than when the data is housed internally. Though I would say that this is the case of devil you know vs the devil that you don’t. If you know that internal security measures are not up to par, there may be compensating controls that can be put in place. However, with SaaS products, the enterprises loses all of the control. So they are understandably concerned.

Chris gave the example that with data housed internally, employees will copy them onto their computer and use it offline. Whereas with SaaS, they will likely be less inclined to do that. This is true to a certain extent. However, nothing prevents the employees from copying data onto their computer even if it’s SaaS. If they are offline and want to work on the data, they will copy them down regardless of SaaS or on-premise. (Now here’s a thought, maybe Google Gears can have some monitoring and tracking capabilities built-in? Or maybe someone can extend Gears?)

Now I am not arguing that enterprises should never use SaaS products. I am simply saying that they should keep security and privacy in mind when evaluating different SaaS offerings and make sure that either

  • Truly sensitive data such as credit card information are never housed externally.
  • Take extreme measures to evaluate a SaaS provider’s security policy and practice. (How to evaluate is probably for another post. I would love to hear your thoughts in the comments if you would like to discuss.)

Chris later provided some guidance:

  • Make sure the vendor meets compliance standards and such as SAS70 type 2 security standards
  • Tour the data center to ensure proper security practice are in place
  • Get educated about the security standards (and for SaaS providers, educate your customers)
  • Check references (nothing ever replaces this, so always do it)

The second misconception Chris mentioned is “integration.” Many enterprises have the misconception that SaaS offerings are closed and are more difficult than on-premise apps to integrate. I have to agree with Chris here that this is truly a misconception. Most SaaS providers are much more Web 2.0-savvy and usually provide better API to customers for integration. Chris also mentioned their 4-way mashup with PayPal, Amazon and Salesforce.com.

The last misconception discussed was around the legacy concerns from the old ASP model. Chris didn’t specifically talk about why the old ASP model generated these legacy concerns. He simply said that because the old ASP model wasn’t built from the ground up to be multi-tenant, therefore people had concerns. I would have liked to hear more about the specific reasons. This is one of the things that bugged me about the podcast. Chris touted multi-tenancy to be this be all end all solution to all problems including security and integration. That’s simply not the case. Multi-tenancy brings its own set of concerns and problems such as data privacy and performance. Most ISVs who have been developing on-premise applications will likely not be familiar the design considerations of multi-tenancy and will have a learning curve to go through. Again, I believe multi-tenancy has a lot of advantages but let’s not make it the solution for everything.

One thing Chris said that every ISV should remember is: “The saas model must earn the customer every month.” The cost of migrating from one SaaS provider to another is much lower than on-premise apps. So in order to keep your customers, make sure you do everything you can in supporting the customers. Remember, Support is the New Marketing!