Download to read offline
Uploaded byTomppa Kuusi (formerly Järvinen)
Service goes accessible_2013_sh
The document discusses how to safely use cloud services, noting that while cloud services provide benefits like scalability and accessibility, users should select services carefully based on the type of data, choose providers that ensure privacy and security, and avoid storing certain sensitive data like intellectual property or regulated information in the cloud.
More Related Content
Similar to Service goes accessible_2013_sh
Service goes accessible_2013_sh
- 1. How to besafe in the cloud “AaltoCloud” • Cloud as a concept Workshop • Good to know before using cloud • Selecting the best suitable cloud • Using cloud safely Tomi Järvinen Aalto-university IT • What Aalto can offer for cloud users Twitter/tomppaj
- 2. What is ”Cloud”? •nothingnew, really… –news groups, IRC, forums, web hosting... –marketing term, services are now in a fancy, easy to use package –IBM new product ”Blue Cloud” came 2007 * •there is no universally accepted definition –concept or metaphor, which refers to the services available through network –"only" a concept that combines old and new services –Cloud conputing Guru Simon Wardley found 67 marketing definitions for Cloud ** accessible scalable from “pay only for everywhere elastic , dynamic what you use” resources typically via browser * IBM, 2007 http://www-03.ibm.com/press/us/en/pressrelease/22613.wss ** http://www.slideshare.net/CloudCampFRA/simon-wardley-cloud-computing-why-it-matters Simon Wardley, Cloud Guru, technology thinker, researcher at CSC Leading Edge Forum 4/26
- 3. ”Cloud” - corporatevs. individual users • IaaS (Infrastructure as a Service) “IT” is outsourced, customer pays only for the use. • PaaS (Platform as a Service) typically software development using tools and/or libraries from the provider. • SaaS (Software as a service ) application can be used with the browser. – For corporates, e.g. Office 365 – For consumers, e.g. Facebook, Gmail, Twitter • Today ‘anything as a service' (NaaS, SaaS...) Definitions depend on the provider (remember, just marketing term...) 4/26
- 4. Why people liketo use Cloud services? share.aalto.fi/ Magnificent new ”DropBox” service http://blog.gardeviance.org/2012/07/adoption-cycles.html 4
- 5. Plenty to choosefrom 5
- 6. Pros and cons- “consumer tools” • ready to use/clientless • where is the data? • scalable • who gets it? • no IT help needed • provider employees? • all possible bells and whistles • network traffic? • low cost , • bottlenecks? free of charge • privacy policy? • Data collection and (not really free, privacy, destruction? addvertisement..) • terms of service? • investigation? (illegal content ,copyright etc.) • lock-in? * No Google Maps for Windows Phone 8? http://www.t3.com/news/no-google-maps-for-windows-phone-8 (at the moment 7.1.2013) seems that Maps WILL be available on Windows phone. 6
- 7. Discussion • What kindof cloud services are you using? • Which are the best ones and why? • Do you have any concerns about cloud services? 15 min 7
- 8. Part 2 • Good to know before using cloud, risks, material, providers, other issues • Selecting the best suitable cloud service • Using cloud safely • What Aalto can offer for cloud users
- 9. Risk is nota question, it is a fact 2006 Major USA credit card processor leaked millions of credit card numbers http://www.ftc.gov/opa/2006/02/cardsystems_r.shtm 2011 The Register UK Magazine :“Amazon cloud fell from sky” http://www.theregister.co.uk/2011/04/29/amazon_ec2_outage_post_mortem/ personal details of 77 million PlayStation users leaked http://www.guardian.co.uk/technology/2011/apr/27/playstation-users-identity- theft-data-leak LinkedIn passwords leaked by hackers http://www.bbc.co.uk/news/technology-18338956 Microsoft Windows Live Hotmail (Four days outage for 17 000) http://blogs.windows.com/windows_live/b/windowslive/archive/2011/01/03/hotma il-email-access-issue-now-resolved.aspx http://datalossdb.org/index/largest 9
- 10. Privacy costs Some servicesare collecting huge amount of data about user. However, the user does not know what provider is collecting: • what data is being collected • for how long the data is stored, • for what purpose the data is being collected etc. – and the service provider usually is claiming right to use the data for future purposes. Sell data to other company in case of acquisition hardware model, operating system version, unique device identifiers, mobile network information, details of how you use the service, search queries, phone number, calling-party number, forwarding numbers, time and date of calls, duration of calls, SMS routing information and types of calls, system activity, hardware settings, browser type, browser language, the date and time of your request and referral URL, migth collect and store information (including personal information) from your device using mechanisms such as browser and application data caches…(these are from one service) 10
- 11. ”Patriot act”, doI have to care? USA PATRIOT Act (commonly known as the Patriot Act) Law for fighting against terrorism. Government can ask data from any USA based company, including data located outside of USA. (Microsoft, Gmail, Facebook, Dropbox...) • 1,271 government organizations and 1,931 private companies Wikimedia commons • 854,000 people have security clearances • Data “for government use” might end to a third party Take into consideration if you are working with the goverment, with something very innovative or when co-operating with external partners. http://projects.washingtonpost.com/top-secret-america http://www.webanalyticsworld.net/2012/03/eu-data-protection-law-and-the-patriot-act-in-the-cloud.html 11
- 12. Material not suitablefor cloud (1/3) Think about your work and information you are processing! All the material is not suitable for a public service. University data, • study attainments, student evaluations • research plans, development work • or, e.g., information which the university is obligated to retain long term in its records should not be processed using external services Published intellectual property • copyright (e.g., digital-rights management, media) • patent (e.g., designs, processes)• • trademark (e.g., graphics, URLs, even Logos might need approval) 12
- 13. Material not suitablefor cloud (2/3) Regulated information • HR and employment • medical • financial • technology and telecommunications data (usage) • other regulated information IT information • activity and access logs (dynamic monitoring, audits) • policy, rules, and authorizations (some of those) • identity and authentication 13
- 14. Material not suitablefor cloud (3/3) Confidential business information • trade secrets • financial, tax, and insurance records • operations data (e.g., enterprise resource planning, supply-chain management • other commercial information (e.g., marketing plans, customer lists, contracts, IT architecture) 14
- 15. First: choose theright service (1/3) • three basic models: Free – Advertisement – Freemium (business) • free service (often end up to advertisement or freemium model) • advertisement:, what is the motivation of the service provider? – money, money, money (Facebook) • Freemium, light free version, full with paying something (Yammer) • And, stay focused, service for one purpose usually fits the user needs better and lasts longer – users learn how to use – service does what it is supposed to do – probably easier to find alternative solution when needed 15
- 16. First: choose theright service (2/3) pay attention! • Documentation, widely used API:s • standard and multiple formats • anonymity (option to study without giving personal details to external marketing company) • EULA, terms of service, privacy policy (Good or Bad?) • integration to other same provider services (lock in vs. easy exit) More information about EULAs: open community http://tos-dr.info/ ”Terms of service - didn’t read” 16
- 17. Security is notprovider top priority (3/3) audit test result Cloud provider security audit 2011 Context Information Security, 3- 2011; Assessing Cloud Node Security, White paper http://www.contextis.com/research/white-papers/assessing-cloud-node-security/ 17
- 18. Second: use servicewisely (1/2) • you cannot get anything “back” • services may claim ownership of the information • “free” services often collect and disclose information to third parties such as advertisers or collaboration Trend micro partners. So, think what you share • malicious links, think before clicking • think where you buy from • "fakeware / scareware“, think before buying • be accurate, how and what you write • please do not comment on behalf of the University, unless it belongs to the job description :) • be careful, and specially with Android - > http://www.sophos.com/en-us/security-news-trends/reports/security-threat-report/android- malware/android-risk-mitigation.aspx 18
- 19. Second: use servicewisely (2/2) • keep your password / username combination safe, if the worst happens (serious illness, even death, or matters related to legislation) • material may be financially or for some other reason valuable (university or relatives, e.g. script, photos, new 7 brothers:) • use different password and user id, mnemonic?, software like "KeePass“ http://keepass.info/ for password management • use "alias", Teemu courseX2012, etc... check if this is not against TOS. • keep copies of everything on your own computer • do not accept all friend requests! • if necessary, clear the browser cache • only "Sure" way to store files securely is an encryption http://www.makeuseof.com/tag/5-ways-to-securely-encrypt-your-files-in-the- cloud/ 19
- 20. Special cloud case,email in the cloud • actually the biggest real life risk, most incidents are related to email. • phishing emails/malware on a daily basis • identity thefts happen (monday mornings, stress, hurry) • proposals to make money • With ”SingleSignOn” Aalto-password , access to ALL you data • Aalto IT will NEVER close your account because of full disk space or malware, so don’t click those emails. • Aalto IT will NEVER ask your password, neither by phone nor by email • You will NEVER get any sanctions about accidental mistakes If you suspect something, contact immediately Aalto service desk or security team. Don’t panic! Don’t be afraid to contact
- 21. Special case, email •Actually biggest real life risk • On daily basis phishing emails • Identity theft • Proposals to make money • SingleSignOn Aalto-password provide access to ALL you data • IT will NEWER close you account becaouse of full disk space or malware, so don’t be scared and click those emails. • IT will NEWER ask your password, not by phone, not by email • You will NEWER get any sanctions about accidents If you suspect something contact immediately Servicedesk or [email protected]
- 22. Aalto Cloud portalhttp://Pilvi.aalto.fi Why we made it: • Aalto users were asking a lot about various kind of applications and providers • Users had concerns • Questions, which systems could be used for certain needs, policy? • recommend good/ secure/ reliable/ tested services to Aalto users Who made it: • Aalto VIPU team* , Information security team, Aalto Web-team 22
- 23. http://Pilvi.aalto.fi – ”just use” cloud services for light use Need is something for light use or for small group, just choose the appropriate service and start using! Grouped by Categories: •”Web presence” •collaboration •file synchronising •blogging •media share... You can also find: •feedback page •request form, for a new services •list about recommended and approved services •instructions 23
- 24. Instructions about heavieruse (1/2) IF the service use involves: • processing of personal data • processing of secret material • processing of bank details • administration requirements • requirements for high 24/7 usability • licences • large costs • a large number of users or several units involved THEN Please, contact the account managers http://www.aalto.fi/fi/about/contact/services/it/ - “asiakkuuspäälliköt” 24
- 25. Instructions about heavieruse (2/2) 25
- 26. Accessibility Accessibility, big yes! (fromeverywhere, with all the platforms, all needs) So USE cloud services. But, think first
- 27. Questions? Thank you! security(at)aalto.fi, tomi.jarvinen(at)aalto.fi 27