As people we want everything for the least amount of effort as possible, this is what the unions fought for, this is what the unions got. For 30 years our country has moved British Livelihood to China, Malaysia, Taiwan and India – because we wanted our pound to go further on our highstreets, this is just as much a fact as greedy fatcats wanted bigger profits by outsourcing jobs…

Now these counties are loaning back the very same money WE GAVE THEM! So, if you want someone to blame for the downward spiral of our sociality, which you think is the cause of these Riots, don’t blame Thatcher, the Unions, Tony Blair, Gordon Brown, David ‘Dave’ Cameron, don’t even blame these “Youth Scum”…… We must blame Ourselves…. and Jeremy Kyle..

But there is a fundamental pitfall with securing Cloud based Services because they primarily focus on making data accessible via the internet with user level authentication and little validation on where authentication requests are coming from.

As any security consultant will tell you, Security is primarily about reducing the risk of security violations and identifying them when they happen. The more security messures you put in place, the less risk you have of your security and data being compromised. You’ll be never totally 100% guaranteed secure, but if you make your infrastructure and systems secure enough, it makes attempting to violate the security measures too costly and time consuming to bother, thus reducing the risk.

Cloud based Services like iCloud, Amazon S3, DropBox employ user level authentication to decrypt data as well as device level authentication to authenticate requests to distribute it – which is adequate for non-commercial Cloud Storage in home and mobile computing, but corporate computing requires an additional layer of security that limits the availability of all authentication methods, with overall control given corporate IT departments. By this I mean, IP and Geographical authentication as well as well as integration with existing corporate authentication methods.

Corporations often have security policies in place for securing their corporate data and network, adding additional thirdparty authentication methods to existing policies may not practical or possible. Corporations also invest heavily on location based authentication to secure their data, particularly over Wide-Area-Networks (WANs) and Virutal-Private-Networks (VPNs) where access to data is restricted and authenticated with both user and device levels (often with certificates) but more importantly from within their own network.

It’s clear corporations want to make their data more easily accessible within their organisation, but CTOs and CSO are reluctant about using Cloud based services given user and device authentication could potentially be compromised anywhere in the world. Services like DropBox only employ device authentication on mobile devices, not on their web portal, so all a hacker needs to access corporate data is an authorised username and password and they’re granted full access to read/write/delete anything being stored on that service. For DropBox this in affect means their device level authentication is pointless because all a hacker needs to do is obtain credentials collected by some malware keylogger and hey presto they have full access via a webbrowser to your corporate data…

Coming back to risk, generally speaking your corporate data is most likely to be compromised by a disgruntled employee, or someone from the outside entirely – usually not even in the same country.

It seems prudent to me that corporate users of Cloud services have the ability to firstly, separate the management portal from the data at that level and only allow devices access to read/write/delete corporate data, and secondly allow corporations to integrate their internal/external network directly into their provisioned cloud service, for example corporations could integrate a DNS Zone into the cloud service to make restricting authentication easier at TCP/IP level by defining their own access policy on their Cloud services so that user/device authentication isn’t even possible unless the request matches IP address access list, or approved IP geo location or IP providers (selected ISPs).

It would also be feasible that user credentials for cloud services be authenticated against corporate infrastructure, perhaps where the cloud services negotiates authentication over LDAP with say a corporations Active Directory infrastructure and then generates a cacheable token which it then uses to authenticate subsequent requests until the token expires. It’s probably not good practice to rely on user authentication built by the cloud provider for large scale corporate infrastructures using cloud services, particularly with many users, as logistically it may not be practical for IT Management. Even perhaps when staff maybe dismissed and a persons corporate user credentials might be disabled on the network but not on the cloud service..

Now this additional layer of security is by no means perfect, you could say that spoofing an IP address could potentially be used to bypass this additional layer of authentication, but surely it should be down to the corporation as to what level of compromise they have on their services, and narrowing the scope of vulnerability with an additional security layer is certainly better than having no layer that the corporation has control of. The more restrictive this security layer, the more effort a hacker has to put in – in order to gain access, which in my book reduces the chances and risk of your data being compromised.

Certainly on a liability point of view, it could benefit Cloud Service Providers with their SLA liability if a corporate security policy wasn’t sufficiently configured to reduce risk further than what can be provided as part of the service.

Now, a big problem for Cloud at the moment is that there isn’t any commercial virtualization software out there, specifically designed for Cloud Hosting, but if there is, it’s likely well out of a midrange hosts price range. Another problem is that too many Web Hosts and Service Providers (even software venders like Parallels) throw around “Cloud” like it’s the word of the week without actually having a concept, product or service that actually truly reflects what “Cloud” actually is. This means “Cloud” is basically being miss sold as VPS hosting sat on top of a balanced and failover resilient infrastructure. Now, OK, it’s a fundamental feature of cloud computing and vast improvement on VPS hosting, but ”Cloud” is actually allot more than just balancing a VPS with failover recovery and live migrating between Hosts.

 The Key Word (or words) in “Cloud” is; Infrastructure Intelligence.

To better explain what Infrastructure Intelligence is, I’ll use a scenario starting with virtualizing a webfarm and then explaining how the virtualized webfarm can be turned into a “Cloud”.

So in our virtualized webfarm scenario, a popular e-commerce website is balanced over a 5 Server webfarm running on 2 Microsoft Hyper-V Hosts with Windows 2008, and built-in Network and Load Balancing services. All website traffic is distributed across those 5 virtual web servers to ensure availability. Now, lets spice up this scenario. From nowhere, website traffic significantly increases to the point that impacts the speed and operation of the  e-commerce website. So you manually provision another virtual web server into your farm to spread the work load and is fine again… Now lets say later on, traffic increases four-fold, and your resource requirements YoYo between needing 6 – 10 virtual web servers in your farm over 2-4 Hosts, and you manually manage and provision physical and virtual servers when ever you notice traffic increasing or decreasing.. This is in essence Infrastructure Intelligence.

A “Cloud”, basically posses the intelligence to autonomously provision additional resources, such as virtual servers, to your web farm (and if necessary, more physical Hosts to run them on) during periods when resources exceed whats been allocated, and then un-provision those things when the resources are no longer needed. You can expand this even further, by turning on/off physical Hosts as and when, so that they only consume power when they are required.

So all you need is a Virtualized Infrastructure, wrapped that around some kind of provisioning business logic and monitoring system, and bobs your uncle, you have your very own “Cloud”..

This is what I’ve been working on recently, for my VoD project. I’ve virtualized my data centre infrastructure on Microsoft Hyper-v and Windows 2008, use System Centre (SCVMM) to manage my Virtual Host Cluster, and I’ve then written a Business Logic layer into my VoD platform that hooks into SCVMM’s API to monitor resources of each VM in the cluster, and if required, provision additional VMs to the webwarm and/or send a Wake-on-LAN command to a physical host and when its active, start managing VMs to include newly powered Hosts. An ISP could have a pool of burstable Cloud Host servers, that lie dormant until a cluster some where needs it to run additional virtual resources on. This could allow them to not only charge for each VM running a customers service, but also each Host (possibly on an hourly/daily basis).

Well, that pretty much explains it.. Anyone keen to know how to develop that kind of business logic, it’s fairly simple for an experienced .net developer who can work with WCF, WMI and WebServices. Microsoft have actually made all the information you’ll ever need (code samples, documentation) freely available if you know where to look.

If you would like me to share these resources with you, drop me a message.

Welcome to my Blog. I hope to stimulate you with Interesting Code Snippets and daily thoughts on current events.