Cloud-10 Accountability and Data Ownership - Revision history

Pankaj Telang: /* R1:Accountability and Data Ownership */

2010-02-15T22:31:59Z

‎R1:Accountability and Data Ownership

Pankaj Telang at 22:31, 15 February 2010

2010-02-15T22:31:22Z

Pankaj Telang at 17:04, 15 February 2010

2010-02-15T17:04:52Z

Pankaj Telang: /* R1:Accountability and Data Ownership */

2009-11-17T21:08:37Z

‎R1:Accountability and Data Ownership

Pankaj Telang: /* R1:Accountability and Data Ownership */

2009-11-17T21:06:43Z

‎R1:Accountability and Data Ownership

Pankaj Telang: /* R1:Accountability and Data Ownership */

2009-11-16T19:50:20Z

‎R1:Accountability and Data Ownership

Pankaj Telang: /* R1:Accountability and Data Ownership */

2009-11-16T19:50:05Z

‎R1:Accountability and Data Ownership

Pankaj Telang: /* R1:Accountability and Data Ownership */

2009-11-16T14:18:04Z

‎R1:Accountability and Data Ownership

Vinaykbansal: Created page with ' ==R1:Accountability and Data Ownership== Category:OWASP Cloud ‐ 10 Project NOTOC '

2009-11-09T15:45:55Z

Created page with ' ==R1:Accountability and Data Ownership== Category:OWASP Cloud ‐ 10 Project __NOTOC__ <headertabs/>'

New page

==R1:Accountability and Data Ownership==

[[Category:OWASP Cloud ‐ 10 Project]]

__NOTOC__
<headertabs/>

@@ Line 4: / Line 4: @@
 __NOTOC__
 <headertabs/>
 A traditional data center of an organization is under complete control
 of that organization.  The organization logically and physically

@@ Line 55: / Line 55: @@
 the original data.  Such reconstructed data can be stolen, and
 misused, posing a significant risk to the cloud consumer.
 Real-world incident: On July 15, 2009, Twitter disclosed that a hacker

@@ Line 1: / Line 1: @@
 ==R1:Accountability and Data Ownership==
 [[Category:OWASP Cloud ‐ 10 Project]]
@@ Line 56: / Line 55: @@
 the original data.  Such reconstructed data can be stolen, and
 misused, posing a significant risk to the cloud consumer.

@@ Line 41: / Line 41: @@
 lowest tax rates, since the cloud provider may store orders data in
 any country.
 A cloud provider may store the consumer's data in its premises, or

@@ Line 6: / Line 6: @@
 <headertabs/>
-An internal cloud or a data center of an autonomous organization is
+The severity of risks depends on the sensitivity of the data stored in
-under complete control of that organization. The organization is
+the cloud.  Informal blogs, twitter posts, public news, and newsgroup
-accountable and owns data in an internal cloud. Unlike internal cloud,
+messages are examples of less sensitive data.  The risk of hosting
-for economical reasons, an organization may choose to use a public
+such data in the cloud is low.  On the contrary, data such as
-cloud for hosting business services. In the public cloud, the
+health-related records, criminal records, credit history, and payroll
-accountability and data ownership gets delegated to the cloud
+information is highly sensitive business data.  There are serious
-provider.
+business and legal ramifications if such data is compromised.
-The cloud provider may store the data in its
+Since data in the cloud is physically in control of the cloud
-premises, or employ an Insfrastructure-As-A-Provider (IAAS) for data
+provider, the foremost risk is that of ensuring confidentiality of the
-storage. The provider may use multi-tenancy architecture which
+stored data.  Encryption can be employed to ensure confidentiality. If
-collocates data of multiple cloud consumers in one physical
+the cloud provider uses multi-tenancy architecture, then separate
-storage. This poses the risks of physical security of the data,
+encryption keys, one per cloud consumer, should be employed.
-For audit and compliance purposes, the specific
+A cloud provider may physically store a consumer's data in various
-location of data can be important. A cloud provider may have a
+countries.  Such architecture poses several risks.  For example, a
-geographically distributed storage architecture which conflicts
+country has its own legal system, and the cloud provider operating in
-with the regulatory requirements.
+that country is bound to that system.  The laws of a country may force
-Upon a deletion request, a cloud provider may
-may nominally erase data. The remanant data can be accessed and
+A cloud provider may store the consumer's data in its premises, or
-stolen.
+employ an Infrastructure-As-A-Provider (IAAS) for data storage.  The

← Older revision		Revision as of 19:50, 16 November 2009
Line 1:		Line 1:

	==R1:Accountability and Data Ownership==		==R1:Accountability and Data Ownership==
−
−
−
−
−
−
−
−
−
−
−
	[[Category:OWASP Cloud ‐ 10 Project]]		[[Category:OWASP Cloud ‐ 10 Project]]

← Older revision		Revision as of 14:18, 16 November 2009
Line 16:		Line 16:
	__NOTOC__		__NOTOC__
	<headertabs/>		<headertabs/>
		+
		+
		+	An internal cloud or a data center of an autonomous organization is
		+	under complete control of that organization. The organization is
		+	accountable and owns data in an internal cloud. Unlike internal cloud,
		+	for economical reasons, an organization may choose to use a public
		+	cloud for hosting business services. In the public cloud, the
		+	accountability and data ownership gets delegated to the cloud
		+	provider.
		+
		+	Tim Mather, et.al. (cite Cloud Security & Privacy) categorize data
		+	risks of a public cloud in the following categories:
		+
		+	Data-in-transit risk: The data of a cloud consumer traverses to and
		+	from the cloud provider over the public internet. The data can be
		+	stolen or tampered in-transit. This poses confidentiality and
		+	integrity risks.
		+
		+	Data-at-rest risk: The cloud provider may store the data in its
		+	premises, or employ an Insfrastructure-As-A-Provider (IAAS) for data
		+	storage. The provider may use multi-tenancy architecture which
		+	collocates data of multiple cloud consumers in one physical
		+	storage. This poses the risks of physical security of the data,
		+	unauthorized data access, and lack of auditability.
		+
		+	Data processing: A cloud consumer may use a cloud for data processing.
		+	Data processing necessitates the data to be un-encrypted during the
		+	duration of the processing. There is a risk of data getting stolen.
		+
		+	Data location: For audit and compliance purposes, the specific
		+	location of data can be important. A cloud provider may have a
		+	geographically distributed storage architecture which conflicts
		+	with the regulatory requirements.
		+
		+	Data remanence: Upon a deletion request, a cloud provider may
		+	may nominally erase data. The remanant data can be accessed and
		+	stolen.

Cloud-10 Accountability and Data Ownership - Revision history

Pankaj Telang: /* R1:Accountability and Data Ownership */

Pankaj Telang at 22:31, 15 February 2010

Pankaj Telang at 17:04, 15 February 2010

Pankaj Telang: /* R1:Accountability and Data Ownership */

Pankaj Telang: /* R1:Accountability and Data Ownership */

Pankaj Telang: /* R1:Accountability and Data Ownership */

Pankaj Telang: /* R1:Accountability and Data Ownership */

Pankaj Telang: /* R1:Accountability and Data Ownership */

Vinaykbansal: Created page with ' ==R1:Accountability and Data Ownership== Category:OWASP Cloud ‐ 10 Project __NOTOC__ '

Vinaykbansal: Created page with ' ==R1:Accountability and Data Ownership== Category:OWASP Cloud ‐ 10 Project NOTOC '