Title: The Art and Science of Building Customer Trust in the Cloud
Primary considerations for enterprise customers who want to leverage a public cloud are data security and the effort involved in migrating existing applications. But how do enterprise customers use cloud? How do they evaluate a cloud vendor’s security capabilities? How do they secure their resources in the cloud? What are the pillars of a trusted enterprise cloud? In this talk we will attempt to answer these questions and discuss some security research directions that could enhance the security model in the cloud.
Yuecel Karabulut is Director of Product Management at Oracle, USA, leading the development of security solutions for Oracle’s Public Cloud Infrastructure offering. Yuecel joined Oracle in 2015 bringing more than 19 years of academic and industrial experience leading research, design and implementation of security solutions. Previously, he was Product Line Manager for VMware’s multi billion dollar Cloud Infrastructure and Virtualization business, focusing on the next-generation Cloud Platform security capabilities. Prior to joining VMware, Yuecel was Chief Security Advisor in the Office of the CTO and Engineering Sr. Director of Product Security at SAP Labs, Palo Alto. He held various Adjunct Professor positions as a lecturer and research collaborator at leading universities such as Carnegie Mellon University, University of Macquarie, and University of Newcastle. He is a frequent speaker at conferences and institutions and has published 32+ peer reviewed technical publications on distributed systems security. Yuecel received his PhD in Computer Science from the Technical University of Dortmund. Yuecel also holds an MBA from the Fuqua School of Business at Duke University and a Bachelor's degree in Computer Engineering from Ege University.
Grading will be based on the submission of a seminar thesis.
- T P: OAuth attacks: What is it, how does it work, what can you do against it? See also https://resources.cloudlock.com/security-infographics/hackers-have-moved... (Hofstadler / Mairinger)
- T (P): Side-channel attacks (e.g. timing) to obtain information on other running VMs. Potentially with an experiment measuring the transfer rate in Bits/second (or minute?). Both at a public cloud provider and a normal VM on a local computer. Could also be theory only or split into two topics. (Nolan / Purcell)
- T/P: Migrating a web-application from a relational backend to a NoSQL data store. How to do this, prerequisites, restrictions, additional capabilities. Implement an example, starting with a ready-made example web application and describe its transformation (including tests). (Amr / Khalik)
- T P: Forensic challenges: How difficult is it (practical test), what are the contractual requirements… to obtain a forensic copy of a VM from a cloud provider? If it is not too costly, this could be a real experiment as well: Creating a VM, generating traffic, suspending & resuming it etc. and finally finding out what traces remain (e.g. traces of activity that was deleted before a shutdown/suspend is completely absent? à Images are probably stored “compressed”). (Urbina / Cetinbilek)
- T: Salesforce security overview: What information do they provide, what certifications do they offer? Describe their code security testing as far as possible (https://security.secure.force.com/security/tools/forcecom/scanner). (Mufleh / Shafi)
- P: Cloud interoperability: Comparison of interoperability between cloud providers and local VMs. Does it work? To what degree? How to do it? Practical tests: Creating a local VM (Virtualbox, Hyper-V, VMWare ESX/ESXi) and moving it to the cloud. The same in reverse (select one cloud provider and try to move this to a local system. Is automation possible (e.g. cheaper price à Move there)? (Alani / Rahmouni)
- T P: Reconstructing and repairing damaged virtual machine images: Free tools and a practical test of them. Including experiments what kinds of failures do occur e.g. with power failures of virtualization systems (Not: Turning a VM off, but turning the VMM/host machine off). Includes documentation of the VMDK (and other) file formats, if possible. (Hanca / Meder)
- T P: “Quantified self”: Security in devices/apps for self-tracking . E.g. heartrate monitors, step counter apps for mobile phones etc. These store data in the cloud. What security is present and against whom? What would be necessary to ensure that only the user himself has access to the data (but the service remains usable!)? We would need to provide this device! (ElDash / Saad)
- T (P): Caching in the cloud: How to have your own (perhaps non-cloud) webserver and have it cached through a cloud service. What is necessary? E.g. separation of static and dynamic content, … Comparison to a commercial CDN (functionality, ease of use, costs, …). (Mamun)
- T (P): Patch management: When renting full systems from a cloud provider, how to keep them up to date, e.g. automatically migrating to a newer image from the cloud provider? Is there help/support from the cloud provider or does SW exist for this? Compare this with systems for automatically configuring/provisioning new instances created automatically. (Hsu / Long)
- Updating docker containers automatically: How to keep docker containers up to date, e.g. installing updates or recreating them. Also take care of dependencies, e.g. libraries. Can this be automated, does support software exist, can you do this without interruption (e.g. load-balancing, creating&starting a new version, stopping the old version)? Explain problems and advantages of different solutions! (Chen / Puscas)
- P: Comparing resource usage from inside and outside a virtual machine. Explore tools and perform practical tests to compare measurements from within and outside a VM. Take care e.g. of “ballooning” (ESX) and multiple VMs on one physical hardware. Do the results match or differ? How precise are they? What cannot really be measured inside? See e.g. https://www.logicmonitor.com/blog/2013/02/25/a-tale-of-two-metrics-windo... (Strasser / Weitmann)
- T: Load testing in and for the cloud. How to test cloud applications, especially regarding automatic creation of new instances and removal of unneeded ones (“elasticity”)? Tools in the cloud to test applications, esp. web applications. Precautions to take to avoid being classified as a DoS attack. (Chang / Lee)
- T: Compatibility testing in the cloud. Description of services to test compatibility with different OS/OS versions. Both for PCs as well as mobile devices or applications (e.g. web browsers). What is available, how fast are they, how much do they cost? (Arnaut / Müller)
- T: Cloud-based home automation: What are the advantages, what the dangers? Collect examples of such services, both current and past. How can you ensure the system is still working if the cloud is not available (temporarily because of Internet outage or permanently because the provider shut it down? (Nieminen / Winkler)
- T: Cloud security configuration checkers: In the past, data in cloud accounts (e.g. S3 buckets) often was disclosed accidentally through incorrect configuration. Are there tools available to verify the security of a setup? How good are guidelines by the CSP? (Almousa / Izajar)
- T: Ransomware and the cloud. Ransomware typically infects the local computer and also spready to local servers, e.g. through Shares. Investigate whether this extends to cloud services. These could be either “local” ones (dropbox) or completely remote ones (obtaining the password/credentials locally, and then spreading out). What prerequisites would be necessary for such malware? (Hagy / Mahmoud)
- T: What security parameters can be used to select a CSP? Use https://www.enisa.europa.eu/publications/survey-and-analysis-of-security... as basis for a summary. The specify a scenario (small/medium size business) and define a set of parameters and values and give reasons for this selection. Then try to find a matching CSP. (Abul Azm / Elbaroudy)