CloudSQL – Accessing Datastores in the Sky using SQL…
I think this is definitely a precursor of things to come and introduces some really interesting security discussions to be had regarding the portability, privacy and security of datastores in the cloud.
Have you heard of Zoho? No? Zoho is a SaaS vendor that describe themselves thusly:
Today, Zoho announced the availability of CloudSQL which is middleware that allows customers who use Zoho's SaaS apps to "…access their data on Zoho SaaS
applications using SQL queries."
From their announcement:
Zoho CloudSQL allows businesses to connect and integrate the data and applications they have in Zoho with the data and applications they have in house, or even with other SaaS services. Unlike other methods for accessing data in the cloud, CloudSQL capitalizes on enterprise developers’ years of knowledge and experience with the widely‐used SQL language. This leads to faster deployments and easier (read: less expensive) integration projects.
Basically, CloudSQL is interposed between the suite of Zoho applications and the backend datastores and functions as an intermediary receiving SQL queries against the pooled data sets using standard SQL commands and dialects. Click on the diagram below for a better idea of what this looks like.
What's really interesting about allowing native SQL access is the ability to then allow much easier information interchange between apps/databases on an enterprises' "private cloud(s)" and the Zoho "public" cloud.
Further, it means that your data is more "portable" as it can be backed up, accessed, and processed by applications other than Zoho's. Imagine if they were to extend the SQL exposure to other cloud/SaaS providers…this is where it will get really juicy.
This sort of thing *will* happen. Customers will see the absolute utility of exposing their cloud-based datastores and sharing them amongst business partners, much in the spirit of how it's done today, but with the datastores (or chunks of them) located off-premises.
That's all good and exciting, but obviously security questions/concerns immediately surface regarding such things as: authentication, encryption, access control, input sanitation, privacy and compliance…
Today our datastores typically live inside the fortress with multiple
layers of security and proxied access from applications, shielded from
direct access and yet we still have basic issues with attacks such as
SQL injection. Imagine how much fun we can have with this!
The best I could find regarding security and Zoho came from their FAQ which doesn't exactly inspire confidence given the fact that they address logical/software security by suggesting that anti-virus software is the best line of defense ffor protecting your data and that "data encryption" will soon be offered as an "option" and (implied) SSL will make you secure:
Many people ask us this question. And rightly so; Zoho has invested alot of time and money to ensure that your information is secure and private. We offer security on multiple levels including the physical, software and people/process levels; In fact your data is more secure than walking around with it on a laptop or even on your corporate desktops.
Physical: Zoho servers and infrastructure are located in the most secure types of data centers that have multiple levels of restrictions for access including: on-premise security guards, security cameras, biometric limited access systems, and no signage to indicate where the buildings are, bullet proof glass, earthquake ratings, etc.
Hardware: Zoho employs state of the art firewall protection on multiple levels eliminating the possibility of intrusion from outside attacks
Logical/software protection: Zoho deploys anti-virus software and scans all access 24 x7 for suspicious traffic and viruses or even inside attacks; All of this is managed and logged for auditing purposes.
Process: Very few Zoho staff have access to either the physical or logical levels of our infrastructure. Your data is therefore secure from inside access; Zoho performs regular vulnerability testing and is constantly enhancing its security at all levels. All data is backed up on multiple servers in multiple locations on a daily basis. This means that in the worst case, if one data center was compromised, your data could be restored from other locations with minimal disruption. We are also working on adding even more security; for example, you will soon be able to select a "data encryption" option to encrypt your data en route to our servers, so that in the unlikely event of your own computer getting hacked while using Zoho, your documents could be securely encrypted and inaccessible without a "certificate" which generally resides on the server away from your computer.
Fun times ahead, folks.
/Hoff
There's no way i would host any data with PII or any other sensitive/classified/secret data with any cloud solution. Point 6 above, as you quoted it, is a bunch of fluff and bs, which is probably why you posted it in the first place. sorry for pointing out the obvious. 😉 Zoho, tell me something concrete, practical and manageable about how you securely partition my data from other customer data. Even then, how can i be sure that my data is not co-mingling with some other data in another db server application, or be notified when any change occurs? How can i be sure that permissions have not changed, or if they have, how can i review the changes to make sure they were appropriate in a timely manner? How can i be sure that my network traffic to and from the database is always encrypted as I specify and that some changes to the db access has not changed, etc, etc, etc. fun times ahead, indeed.
That's just scary that encryption is not addressed but rather alluded to. What's that on my wire? SQL commands heading up to some cloudSQL mothership? Screw popping exposed FTP servers, I got myself some databases to own now!
But that's also not surprising. New technologies get made first and security is tacked on later if it proves successful enough.
Maybe "cloud security" is meant to be cloudy?
The bottom line is that we are back at security data via obscurity, and we all know how well that works. It's just on a greater scale: scaled services therefore scaled obscurity. This should not be a surprise to anyone.
To be fair, data store in the cloud need not be a security nightmare. Poorly stored data is the problem, whether in a cloud or inside a data center. I agree that special care needs to be employed in a shared environment, and that many folks fail to understand the additional complexity, but this technology *will* get adopted and people will get smarter (likely after they have been burned)
A few years back, some smart folks at berkeley worked on something called Oceanstore. It was a cloud environment in which data was broken into small chunks and then redundantly distributed. Among its many properties, were high availability and integrity (through replication) and a fair degree of confidentiality (since each discreet chunk was virtually meaningless without the context of related chunks). The data didn't need to be secured nearly as much as the central keys that described where the chunks were and how to reassemble them. Try to reassemble a glass of water once the molecules have been poured into the ocean.
My point is that cloud storage, when done correctly, can actually enhance security. Our concern should be less about the fact that data is stored in a cloud or shared environment and more about whether it's badly stored or well stored.
I actually did a text on why anyone interested in his information security will avoid cloud computing. http://www.shortinfosec.net/2008/08/cloud-computing-premature-murder-of.html
I’ll summ up with the conclusion of that text:
The users of cloud computing are the ones that find it acceptable to:
* have delays in access to information
* have some data lost and
* information leakage will not make a significant impact.
In the meantime, the enterprise data centers are still humming strong
Spirovski Bozidar
http://www.shortinfosec.net