Well aware of the rich benefits of cloud computing and virtualized environments but anxious about the exposure of sensitive data through computing resources no longer under their physical control, organizations find themselves torn between the potential of these distributed models and the chance that hackers could penetrate security barriers and cause severe damage. But can sensitive data (and the applications that use this data) be safely deployed in the cloud?
Risk and reward; they constitute the yin and yang, the price of the possible, and potential cost weighed against desired benefit.
This concept has taken on a particularly powerful meaning for businesses and organizations that want to make use of cloud computing.
It all boils down to enjoying the incredible flexibility and power offered by virtualized resources and cloud environments while finding a way to deal with the very real anxiety of giving up the direct management of your computing infrastructure.
The cloud has dramatically altered the perception and reality of computing resources like servers, storage and hardware. IT tools are now seen as infrastructure pieces that can be brought online and taken offline as needed. The risk element of this revolves around relinquishing the physical control and peace of mind of traditional data security.
The Challenges of Tracking a Moving Target
Clearly, much of the appeal of virtualization and cloud computing derives from the increased flexibility and efficiency they deliver, as well as reduced costs. But this often means that the database servers housing sensitive data are continually being provisioned and de-provisioned, with each of these instances representing a potential target for hackers.
Further complicating the situation is the fact that, given the dynamic nature of a cloud infrastructure, the monitoring of data access becomes much more difficult. If the information contained within applications is governed by regulatory compliance requirements, organizations need to be able to demonstrate to an unforgiving auditor that its sensitive data is secure.
These dynamic environments present special problems requiring a monitoring method that is easy to deploy on new database servers without management involvement to reflect every change. One approach uses a distributed model where each instance in the cloud has a sensor or agent running locally. The software must be capable of being provisioned automatically along with the database software.
The right architecture makes it possible to see—at any point in time—exactly where databases are hosted, centrally log all activity and flag suspicious events across all servers, regardless of where they are running.
Monitoring Traffic within a WAN Environment
The key difference between data center virtualization and cloud computing architectures largely boils down to the network topology they use. While many current database activity monitoring solutions make use of a “network sniffing” model to identify malicious queries, this approach doesn’t translate into virtual and cloud environments. What’s really called for is a solution architected for distributed processing, where the local sensor is able to analyze traffic autonomously.
Distributed processing and the use of local sensors are important for a very simple reason: in cloud computing environments, network bandwidth—and more importantly, network latency—make off-host processing too inefficient. Cloud computing prevents organizations from being able to co-locate a server close to their databases because their location is often unknown. Time and resources spent remotely analyzing every transaction will bog down network performance. Timely interruption of malicious activity becomes difficult, if not impossible.
The Special Problem of Privileged Users
The activity of privileged users presents one of the toughest monitoring challenges in any database implementation. Database Administrators (DBAs) and system administrators have many options at their disposal to access and copy sensitive information. And quite often, this mischief can go undetected or can be easily covered up. Further complicating things is the fact that in a cloud computing environment there will be unknown personnel at unknown sites with these privileges, which limits effective access control.
One way of resolving this problem is through separation of duties, ensuring that the activities of privileged third parties are monitored by internal staff and that the pieces of the security solution on the cloud side of the network cannot be defeated without raising alerts. It’s also important to have the ability to closely monitor individual data assets (for example, a credit card table), regardless of the method used to access it.
Cloud and VM Environments–Here to Stay
The complex nature of monitoring databases in a cloud or VM environment may lead some organizations to the conclusion that the benefits of these architectures do not outweigh the security headaches. Regardless, most enterprises will accept that it is simply a matter of time until they use cloud or VM environments for deploying applications with sensitive data. Concerns about security should not keep organizations from enjoying the benefits of the cloud or virtualization, and the advantages of cloud and VM can be enjoyed without anxieties about security exposure.
