Researchers find a new way to attack the cloud

From: Researchers find a new way to attack the cloud

Amazon and Microsoft have been pushing cloud-computing services as a low-cost way to outsource raw computing power, but the products may introduce new security problems that have yet to be fully explored, according to researchers at the University of California, San Diego, and the Massachusetts Institute of Technology.

Cloud services can save companies money by allowing them to run new applications without having to buy new hardware. Services like Amazon’s Elastic Computer Cloud (EC2) host several different operating environments in virtual machines that run on a single computer. This lets Amazon squeeze more computing power out of each server on its network, but it may come at a cost, the researchers say.

In experiments with Amazon’s EC2 they showed that they could pull off some very basic versions of what are known as side-channel attacks. A side-channel attacker looks at indirect information related to the computer—the electromagnetic emanations from screens or keyboards, for example—to determine what is going on in the machine.

The researchers were able to pinpoint the physical server used by programs running on the EC2 cloud and then extract small amounts of data from these programs, by placing their own software there and launching a side-channel attack. Security experts say the attacks developed by the researchers are minor, but they believe side-channel techniques could lead to more serious problems for cloud computing.

In the past, some side-channel attacks have been very successful. In 2001, researchers at the University of California, Berkeley, showed how they were able to extract password information from an encrypted SSH (Secure Shell) data stream by performing a statistical analysis of the way keyboard strokes generated traffic on the network.

The UC and MIT researchers weren’t able to achieve anything that sophisticated, but they think their work may open the door to future research in this area. “A virtual machine is not proof against all of the kinds of side-channel attacks that we’ve been hearing about for years,” said Stefan Savage, associate professor with UC San Diego, and one of the authors of the paper.

By looking at the computer’s memory cache, the researchers were able to glean some basic information about when other users on the same machine were using a keyboard, for example to access the computer using an SSH terminal. They believe that by measuring the time between keystrokes they could eventually figure out what is being typed on the machine using the same techniques as the Berkeley researchers.

Virtual machines may do a good job of isolating operating systems and programs from each other, but there is always an opening for these side-channel attacks on systems that share resources, said Alex Stamos, a partner with security consultancy iSEC Partners. “It’s going to be a whole new class of bugs that people are going to have to fix in the next five years.”

His company has worked with a number of clients interested in cloud computing, but only if they can be assured that no one else is sharing the same machine. “I’m guessing the cloud-computing providers are going to be pushed by their clients to be able to provide physical machines.”

Amazon wasn’t quite ready to talk about side-channel attacks Thursday. “We take all security claims very seriously and are aware of this research,” a spokeswoman said. “We are investigating and will post updates to our security center.”

Six steps to adopting cloud computing services

What is Cloud Computing?

Cloud computing is becoming one of the next industry buzz words. Cloud computing overlaps some of the concepts of distributed, grid and utility computing, however it does have its own meaning if contextually used correctly. The conceptual overlap is partly due to technology changes, usages and implementations over the years.

Trends in usage of the terms from Google searches shows Cloud Computing is a relatively new term introduced in the past year. There has also been a decline in general interest of Grid, Utility and Distributed computing. Likely they will be around in usage for quit a while to come. But Cloud computing has become the new buzz word driven largely by marketing and service offerings from big corporate players like Google, IBM and Amazon.

The term cloud computing probably comes from the use of a cloud image to represent the Internet or some large networked environment. Cloud computing is associated with a higher level abstraction of the cloud. Instead of there being data pipes, routers and servers, there are now services. The underlying hardware and software of networking is of course still there but there are now higher level service capabilities available used to build applications. Behind the services are data and compute resources. A user of the service doesn’t necessarily care about how it is implemented, what technologies are used or how it’s managed. Only that there is access to it and has a level of reliability necessary to meet the application requirements.

In essence this is distributed computing. An application is built using the resource from multiple services potentially from multiple locations. At this point, typically you still need to know the endpoint to access the services rather than having the cloud provide you available resources. This is also know as Software as a Service. Behind the service interface is usually a grid of computers to provide the resources. The grid is typically hosted by one company and consists of a homogeneous environment of hardware and software making it easier to support and maintain. (note: my definition of a grid is different from the wikipedia definition, but homogeneous environments in data centers is typically what I have run across). Once you start paying for the services and the resources utilized, well that’s utility computing.

Cloud computing really is accessing resources and services needed to perform functions with dynamically changing needs. An application or service developer requests access from the cloud rather than a specific endpoint or named resource. What goes on in the cloud manages multiple infrastructures across multiple organizations and consists of one or more frameworks overlaid on top of the infrastructures tying them together. Frameworks provide mechanisms for:

• self-healing
  
  
• self monitoring
  
  
• resource registration and discovery
  
  
• service level agreement definitions
  
  
• automatic reconfiguration

The cloud is a virtualization of resources that maintains and manages itself. There are of course people resources to keep hardware, operation systems and networking in proper order. But from the perspective of a user or application developer only the cloud is referenced. The Assimilator project is a framework that executes across a heterogeneous environment in a local area network providing a local cloud environment. In the works is the addition of a network overlay to start providing an infrastructure across the Internet to help achieve the goal of true cloud computing.

Steps to adopting cloud computing services

1. Assess IT software assets, then consider putting commodity and standalone applications in the cloud. The IT team should built a chart showing business users which applications they thought were differentiators and which ones they thought were commoditized and explained why applications they viewed as commodities were better suited for cloud services like email for LiveOffice. Standalone applications like HR/benefits and sales analytics were also better suited for the cloud.
   
   
2. Reorganize IT teams according to application functionality rather than brand. To prepare for a virtualized/cloud environment, eliminate application silos such as those for Oracle or Siebel applications. IT thinks their value is associated with an application rather than a skill, so we need to change the mind-set to skills that we want in this new paradigm, like data management, business intelligence and analytics and the ability to do end-to-end business processing rather than skills tied to a particular application.
   
   
3. Get a handle on your internal IT costs. What does email, ERP and clustered storage cost you internally? You need to know this before you can validate what it costs you in the cloud. Engage the finance department from the get-go to validate these costs internally compared with a services model.
   
   
4. To socialize the cloud computing concept around the business, figure out the terminology that business executives and users are familiar with. When we heard that business users were reading The New Age of Innovation and using terms such as R=G for Resources are Global, he started to adopt the same terminology to explain the benefits of the cloud. You need to sync up the vocabulary around the cloud and virtualization with what the business users are hearing about it.
   
   
5. Engage IT staff members by giving them a role in the process. Make testing cloud services a game for IT. pick several cloud applications for IT to test like sales analytics and HR/employee performance management and have no ground rules. Test whatever service on whatever provider you like.
   
   I can tell you that there is no better motivation for IT than to see the CIO/CTO doing it himself.
   
   
6. Engage stakeholders throughout the organization. Information security, legal and finance are just a few of the groups that need to be involved.
   It took us two months to figure out security issues in the cloud -- with a lot of trial an error. The consensus in general is that security is ultimately up to you -- most cloud providers leave security parameters up to the customer, whether they be a need for encryption or beyond.

Successful Internet Business Models for SMBs

Technology has played an imperative role in business operations. The advent of internet has given a new methodology to conduct business faster in a cost effective way in a limited time and space. The economic downturn has increased the reliance on IT, and various companies are showing retroflexion.

Since our company, Business Mashups LLc, does web development work for Internet companies and web entrepreneurs, we have gained experience in understanding both the technological and business side of a web site. We believe the economic climate is favorable to companies like ours as we would be able to help most SMBs cut their costs, and become more efficient and help them in focusing on core revenue-generating aspects of their business. We have adopted a very aggressive approach to reach out to SMBs, and help educate them on the buying decision. We have also put a more concerted effort on simple tools that help businesses understand the savings associated with our model, and the associated tactical benefits that help them manage through the uncertainty using our scalable IT platform.

With the increasing capital constraints, most businesses are finding it hard to fund large up-front technology purchases and opt for a recurring cost model instead. The increasing regulation and compliance needs have actively propelled most businesses to make very conscious decisions about their infrastructure, and the outsourced model stands out to its advantages around cost savings, minimal capital expenditure, and flexible IT infrastructure.

How can you rate a successful e-business?

The outward signs of a robust and thriving business are:

1. Revenue increases
   
   
2. Ability to generate profits
   
   
3. Success in creating meaningful alliances
   
   
4. Success in expanding into new markets
   
   
5. Differentiating itself

Existing business models are of many kinds:

• Advertising - banner and direct marketing
  
  
• Subscription sites
  
  
• Customer services
  
  
• Directory services
  
  
• Content providers
  
  
• Product/Service sales

Most successful companies pursue several related but different models concurrently. They defy easy categorization by diversifying revenue streams and becoming hybrids in a cost-efficient way.

ORACLE

This software and service provider entered the digitized world only in 1998, and metamorphosed into a digital pioneer in the span of two years. Innovative products and services and integration of these services have brought them into the forefront of web innovation today.

Products like Biz Online Initiative that deliver simple and complete online services and a host of other tools that customers require in setting up an e-business have made them a one stop shop for e-biz today. Their built-in self-service system for customers, employees and suppliers improved productivity and accuracy and brought down costs by 100's of millions of dollars. Consulting services with major firms like Sun Professional Systems have established their reliability with customers.

Their business formula:

1. Innovative products and packages
   
   
2. Integration of internal processes
   
   
3. Exemplary customer service - a user friendly web site that connects customers easily
   
   
4. Fast online e-business services
   
   
5. Expert consultancy services

Another company in this league is Exodus Communications, an Internet data center that offers a range of web hosting services, bandwidth on demand, security monitoring. Their servers host leading web sites like Yahoo!, e-Bay and Merril Lynch. They allow these firms to deliver content and applications online round the clock without fail.

35% of their revenue comes from a very successful e-business consulting firm whom they have partnered with (Sapient). They are expanding from 19 data centers to 34 data centers this year.

CISCO

Cisco develops switches and routers for Local Area Networks (LAN) and Wireless Area Networks (WAN) and the related software. They have become the worldwide leaders in networking for the Internet today.

90% of their sales are conducted over the Internet. They offer expertise in planning and executing Internet enabled solutions.

The company has grown in the past 7 years with 71 acquisitions to its credit, the latest being its investments in an optical equipment company and speech recognition software makers. Their business model could be termed an acquisition one!

Amazon

The customer is King here! Amazon pampers their customers, tracks their tastes and uses this information to create a unique customer experience. This e-tailer cultivates relationships that lead to customers liking and trusting them. This kind of service surpasses the most brilliant technology in use today. Amazon brought in the world of successful one-to-one marketing, a personal touch from another era.

Recently though, they have suffered heavy losses, proving that any successful e-business strategy will survive provided it is based on a solid brick and mortar foundation, a la Barnes and Noble, another famous online bookseller. Although barnesandnoble.com and Barnes the Noble Ltd. are run separately, a customer tends to associate trust and comfort in a known and established brand.

To summarize, exemplary customer service, successful online advertising and special discounted offers made Amazon and books synonymous terms today.

Google forays Into The ebook Biz

Google has indicated its intent to introduce a program by that would enable publishers to sell digital versions of their newest books direct to consumers through Google, according to a recent article in the New York Times.

The move pits Google against Amazon, which looks to control the e-book market in a very Apple-like way with its Kindle offerings and e-book sale pipeline to them.

Since many ebooks are found from a Google search in the first place there is a binding logic to seeing Google skip the middle man and enter the ebook business themselves.

What’s going to be really interesting I suspect, is to see how well this does against the Amazon Kindle crowd. That ought to be really interesting. Because it will mean Google having to tread onto Amazon’s home turf, I bet that Amazon is not going to take this lying down.

Amazon versus Google

If Amazon have made a false move with the Kindle, who benefits? One beneficiary is surely going to be Apple. The iPhone and the iTouch are already very text capable and they will only get more so as Apple extends the touchscreen interface to larger systems. But the other big gainer, in the long-term, perhaps the biggest beneficiary, is going to be Google. Google with its Book Search program and its alliances with publishers and libraries is going to occupy the place that would otherwise appear to be Amazon's of becoming our preferred source of access to published literature. Amazon seems to have taken a wrong turn in supposing that distribution, rather than access and search, is the key challenge for digital print.

Google and Apple, between them already have the solution for eBooks (and its not a download solution). Read and search on your iPhone and access via a web browser, anything in print can be handled that way. More to the point: everything in print can be handled that way. Everything will be searched via the web, everything will be accessed via the web. Downloads are pretty much of an irrelevance. The question is: what do authors and publishers plan to do about that?

Answer: "Maybe the publishers should themselves try selling/granting access direct". Aside from Google with its Book Search, the publishers are the other variable in the market-place which has a promising opportunity if the Amazon Kindle download system bombs. After all, scientific and technical publishers have made a reasonable fist of creating a digital market for their STM periodicals. Book publishers need to create access opportunities and figure out how to sell digitally direct.

Please leave your comments in the comments box below.