Today I’m at Bletchley park, home of the code-breakers in the second world war and the perfect location for a workshop* on Cloud Computing security. I thought I would share some of the most interesting points that emerged today:

Focus on security audits:

• A talk from someone in the US department of homeland security was calling for improvements in CIO’s ability to move to the cloud while maintaining security. In doing this they argue the need for better auditing  – security audit, privacy impact audits, and performance audits. They argue the “goal is to develop test and deploy cloud computing to facilitate end-to-end trust”. Silverline was proposed as part of this move.

Cloud security as a religious debate:

• Prof Ahmad Sadeghi argued that cloud security is “a religious debate”. While cloud security is presented as new, many parts of the work was already achieved in utility computing and IBM mainframes. The problem, he argues, is that for cloud providers the focus is upon optimization not on security. This lack of focus on security is a significant problem for BYOD (Bring your own device) since an employee backing up data with iCloud on their iPhone may be inadvertently sharing company data (e.g. calendar data on who they are meeting) in a less secure site.

Hardware Solutions to the problem of cloud security:

• The problem with cloud security is ensuring that everything from the CPU up through the operating system stack, the hypervisor, and the users’ virtual machines are secure. Without this there is a risk either from the systems administrator, or another virtual machine, of attacking a user’s virtual machine. Prof. Sadeghi explained that one solution to this problem is being developed by Intel through their SGX – Software Guard Extension chipset. This is a hardware based cloud security solution maintaining an “enclave” area of memory which is secure from the operating system upwards – if you trust the CPU you can trust the whole server. The implementation is complex, but suffice it to say that many of the attack challenges are resolved allowing highly secure parts of the cloud to keep data.