Cloud // Infrastructure as a Service
News
2/27/2014
11:02 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cloud Security Needs More Layers: HyTrust

Eric Chiu, co-founder of HyTrust, says cloud operations will require "layered security" and encrypted virtual machines when at rest.

Much has been written recently about how willing enterprises are to migrate some of their operations into the cloud. That move to the cloud would proceed much faster if security weren't still an overwhelming worry and consideration.

In the second half of 2013, Forrester Research conducted its usual Forrsights Hardware Survey and found enterprise hardware buyers more than willing to make use of cloud servers, but they were limiting their use because of unresolved concerns over security. In that survey, 73% of IT decision makers were concerned about public cloud security, and 51% were concerned about their own private cloud security.

The cloud now represents not only concentrations of compute power and storage, but also a concentration of security, given the potential for mischief or disaster if those centralized resources fall into the wrong hands. Whether it's a private cloud in the virtualized enterprise datacenter or a public cloud, new levels of "layered" security will need to be built in. Furthermore, such security will need to operate in a highly automated fashion and be driven by well-crafted and relentlessly applied policies, said Eric Chiu, president of HyTrust, in an interview in advance of the RSA Security Conference in San Francisco this week.

Chiu is co-founder of HyTrust, founded in 2009 with the explicit purpose of focusing on the new and rapidly evolving virtual environments. VMware, Citrix Systems, and Cisco Systems, which all had a stake in keeping virtual machines safe, were among its early investors. Intel Capital joined in a third round of financing last August that brought the Mountain View, Calif., firm another $18.5 million. Chiu says its primary focus has moved beyond the hypervisor and VM environment to securing cloud operations, with several initiatives underway to make it an innovator in "layered" cloud security.

[Think virtualized production systems stand little risk of being deleted? Better read about the ill-tempered Jason Cornish affair. Virtualization Security: No One Product Does It All.]

Chiu says he subscribes to a commonly held view that more data in the virtualized cloud must be encrypted when stored, including the VM itself. But the popular references to "2014 as the year of encryption" don't mean the public and private cloud, with more encryption, will be secure. It will take more than that. The cloud must monitor both its low-level users and privileged, empowered operations managers and impose on them secure practices in a way that prevents a single person from copying sensitive data, as Edward Snowden did at the NSA, or maliciously deleting production VMs.

HyTrust made its first acquisition, HighCloud Security, in November for an undisclosed amount, giving it new encryption capabilities. Virtual machines often run a few hours a day when needed, then are shut down by their owners to minimize hourly charges. In their sleeping state, the data they delivered to disk drives or databases is frequently stored with automated encryption. Chiu says the software that includes the VM itself, its copy of an operating system, and the application running inside should also all be encrypted at rest.

"By mid-year, we'll take encryption to the virtual machines themselves" rather than merely encrypting sensitive data sent to storage," he said. HyTrust is currently busy integrating HighCloud's capabilities into its product line.

(Image credit: FutUndBeidl.)
(Image credit: FutUndBeidl.)

Another part of enhanced security in the cloud would be protecting the encryption keys used to unlock the VMs and their data. HighCloud offers a means for enterprise IT managers to secure and protect the encryption keys outside the cloud where the VMs are running, setting another barrier to potential attackers.

HyTrust's Appliance already provides policy-driven supervision of system administrators and other cloud infrastructure managers, assigning them a role and privilege level that restricts the kinds of actions they can take. It monitors their actions and tests the activities it sees in cloud software events to make certain the person executing them has the right privilege level. By mid-year, HyTrust will build into that system an ability to impose a "two-man rule," that forbids copying, major changes, or deletions of production VMs by one system admin without the approval of another.

Through its integration with Microsoft's ActiveDirectory, HyTrust Appliance can also authenticate cloud users and assign them proper privilege levels. It monitors all activity that affects host-server hypervisors, inspecting code the hypervisor will run. In the process, its Appliance log file creates an audit trail that leads to the intruder or malicious insider who's attempting to make unauthorized changes. Such a system would have quickly spotted Snowden's copying activity, said Chiu.

There's one other safeguard, propelled in part by Snowden and the revelations about NSA snooping, that will become available as a cloud security feature by mid-year, and that's "geo-fencing" data. Britain, Germany, France, The Netherlands, and other countries have laws governing the privacy of their citizens' data and where it may be stored. In Germany, routine business and other normal data that originates within the country's boundaries must be stored in Germany.

Data-location compliance is made more difficult by the tendency of virtualized environments, as they strive for maximum utilization of resources and lower costs, to move VMs around, putting them on powerful servers during their peak demand and consolidating them with other VMs as traffic winds down.

Soon, Chiu said, it won't be uncommon for a VM to be moved 10 times during the business day, and all of its security policies and access controls must move with it.

HyTrust will have the means to identify data and, through automated policies, ensure that location restrictions are met. In some cases, government agencies or healthcare institutions have policies that data they originate must stay within their own datacenters. The geo-fencing mechanism will make sure they are compliant.

Only when user and administrator supervision, encryption, and attached security measures are fully automated for each cloud workload will the cloud have the necessary layers of protection to make it a secure place.

"That's where we're focused now, automated policies and security for the cloud," he said. As long as key measures remain human based, time and operations-staff limits guarantee that mistakes will be made and breaches will occur. With the acquisition of HighCloud, HyTrust is a company with 75 employees devoted to the issue. And VMware, Cisco and Intel are banking on it to keep the cloud safe.

Engage with Oracle president Mark Hurd, NFL CIO Michelle McKenna-Doyle, General Motors CIO Randy Mott, Box founder Aaron Levie, UPMC CIO Dan Drawbaugh, GE Power CIO Jim Fowler, and other leaders of the Digital Business movement at the InformationWeek Conference and Elite 100 Awards Ceremony, to be held in conjunction with Interop in Las Vegas, March 31 to April 1, 2014. See the full agenda here.

Charles Babcock is an editor-at-large for InformationWeek, having joined the publication in 2003. He is the former editor-in-chief of Digital News, former software editor of Computerworld and former technology editor of Interactive Week. He is a graduate of Syracuse ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Author
2/27/2014 | 12:03:02 PM
Interesting
It's a great point that more automation equals better security, and I admit to being surprised that a VM might move 10 times. I wonder what is the tipping point for efficiency/movement.

Also not sure the headline does this column justics: more layers = more complexity, which (usually) does not = better security!
J_Brandt
50%
50%
J_Brandt,
User Rank: Ninja
2/27/2014 | 5:37:59 PM
Re: Interesting
I have to disagree with you Lorna.  More automation does not equal better security.  If security were to permeate all aspects of development, all aspects of the work flow and from end point to end point this might be true, but in most instances this is simply not true.  Today you have consumer tech hardware and software cobbled and shoehorned into enterprise systems.  More automation for sure, but in many instances a drop in security.  People are more automated with their shadow tech, but security is usually an afterthought and nonexistent.  Plus you have data collection and sharing that occurs many times without the knowledge of the end user.  More automation, but again, no better security.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Author
2/28/2014 | 9:38:32 AM
Re: Interesting
Seconding what Charlie said. Also, the very process of automation can uncover security problems. In our recent DevOps report, we discussed how one large company was spinning up a DevOps-driven development project using a private cloud provider, and it added a security engineer to the discussion.

Imagine the engineer's dismay when he saw that the scripts the team planned to use for automated provisioning and network changes stored user names and passwords and used domain-administrator-level accounts. With some digging he found out that the company was already storing domain-level accounts in all kinds of batch files, scripts, and application configuration files — in plain text.

Automation tends to impose discipline, and shine a light, on processes. That's good for security.
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Author
2/27/2014 | 12:05:56 PM
Don't rely on just one vendor
Cloud security needs more layers, and it's probably wise not to rely on just one vendor to provide all of them. Look for different vendors to have different strengths.
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Author
2/27/2014 | 6:15:16 PM
Automation of security is more secure
If Lorna means the security practices themselves are made automatic, such as limiting system admins, except the group boss, from deleting a production VM, then I would agree with her. Too often security relies on a human completing a standard process, over and over again, and once in a while, slip ujps occur. With the constant interuptions in today's workplace, is it any surprise?
Multicloud Infrastructure & Application Management
Multicloud Infrastructure & Application Management
Enterprise cloud adoption has evolved to the point where hybrid public/private cloud designs and use of multiple providers is common. Who among us has mastered provisioning resources in different clouds; allocating the right resources to each application; assigning applications to the "best" cloud provider based on performance or reliability requirements.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest - July 22, 2014
Sophisticated attacks demand real-time risk management and continuous monitoring. Here's how federal agencies are meeting that challenge.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.