CIRRUS Workshop

Something missing in Cloudcertification
A study on Third-party certification for cloud services

YONOSUKE HARADA
Professor, Graduate School of Information Security
INSTITUTE of INFORMATION SECURITY

1

Content Certification for cloud services are commonlyused Lessons learned from “First Server” incident

 Chain of trust for cloud services
 customer organization needs trust from provider
 accountability

 Proposal of new model to explain the gap
between customer and cloud provider

2Company-Customer
perception
Many of company customer feel bigger risk exists
on cloud provider IT environmentComparison of risk perception of IT environment between
customer premise or cloud provider
Cloudprovider

Cloudprovider

customerpremisecustomer
premisesamesame

2010年度
N=311

2012年度
N=328

Survey result by Harada Lab. of Institute of Information Security in 2010 and 201231 Customer preference of Certification

Many of Japanese customers(companies) use of ISMS andPrivacy Mark certification when they procure IT services
from third party
ISMS
Privacy Mark(domestic)
BS25999 Business Continuity
Management System
ASP・SaaS Information
dissemination
SAS70 Type 2PCIDSS certification
SysTrust
CSA CCS
OthersCertification is necessary for cloud provider selection
Survey result by Harada Lab. of Institute of Information Security in 20104

2. First Server Incident• Loss of data (accidental deletion of entirecustomer data)• Leakage of data (unintended data salvage)

5

Incident Company
 First server : Rental server company (cloud provider) Date 20th June, 2012 PM 1730-

 Loss of data (servers)
 Entire data of User area
Web and Mail server data
database Setting parameters Affected number of business customers
 5676 (about 20% of customers) companies and users

 Major cause Human error and lack of management (manager’s supervisory)

Detail of Incident
Program update for vulnerability
Prepare automated macro command to update
programs which utilizes file deletion after update
completion of maintenance. (missing of macrocommand)
Lack of standard procedures for operation
Operators did not follow Prepare automated macro
command to update programs which utilizes filedeletion after update completion of No. (missing ofmacro command)

Loss of Back-up system and management
The system has designed to get back-up
automatically at 6:00 AM. Operator first applied
defect macro to production system and applied
automatically to back-up systems and lost entire
data.
From internal report by First Server
http://support2.fsv.jp/urgent/report.html

Detail of Incident
 Operator has not followed the operation manualand supervisor knew his activity because ofeffectiveness Operator applied his previous automated updating
commands without checking
 Operator usually automates procedures applying patches
and deleting unnecessary files and directory. He utilized
previous macro command he developed. He had not
noticed the mistake to delete entire all directory.

 Lack of testing procedure after update The operation manual mandates first test patches in a test
server and evaluate. He did not check after patch
application. He continued applying his program to theproduction servers.

Second incident
Salvaged data may include other customer privacy
or sensitive data
Deleted original data

Deleteddata
any data cannot besalvaged and no
original data (X) is
recovered into (Y)Other customer
Deleted data

Deleteddata

partial data issalvaged andpartial data isrecovered

Salvagetrial
Recovery from deleted files cause mess. All recovered User files are accessible from all users

Third party assessment
Lack of Governance Ignorance of standard operation in the manual No management oversight and conduct
 Lose communication between management and operators
 Operator did not wait for management approval for criticaloperation
 Operator did not report to the management after the outage
 No incident manual for data deletion and other problems
 Operators are confident enough having no major problems sincebusiness start. They think themselves confident enough tackle
without any written manual.
 No education for critical operation and risk avoidance Operator did not follow operation manual Operator has no knowledge recovery of data and tried torecover by utilizing free salvage software to recover Operator did not understand future “risk” with salvage activity

Discrepancy ofcertification and reality
 First Server acquired certifications ISMS
and Privacy Mark
Discrepancy between their daily conducts andISMS requirement

 Certifications are used for users’ “trust”
and good appearanceCustomers believe their data is protected as
private information
Identified private information is aboutcompany staffs
11

Time Line of incident
Incident

Salvagetrialcriticism

JulyAugustJuneIncident
noticeThird party
assessment

ISMS
interruption

Oct.
ISMS
resumptionDec.
P markcaution

12

Poor sanction forcertification
 First Server was banned ISMS certificationfrom August to OctoberSanction looks weak against incident First Server was not banned Privacy Markbecause of small amount of leakage
Identified private information is company staff
which are protectedService does not include back-up (contract)13

Use of Certification formarketing “certification” is good tool for sales andadvertisement
ISMS
Privacy Mark (domestic privacy and private
information protection certification)

 Customer trust on “certification”
Good explanation of provider selection
Accountability to their end-users (chain oftrust relations)Lessons learned fromincident Importance of understanding “certification”
Provider has certified its implementation ofISMS as entire businessCustomer understand ISMS certification as
the protection of date from various risks

 “certification” does not mean “trustworthy”
serviceProvider use “certification” for marketingCustomer use “certification” for trust

Gap model :information asymmetry
High
Actual implemented service level for certification

 Understanding ofrequirement forcertification system
 Perception andPenetration
 Clearness of definition Accountability
 Customer responsibility
 …etcLow(iv) Balanced
betweenperception andPotential gap exists when
expectation(iii) Lower User
Perception

apart from this line(i) Lower thanBaseline(ii) Higher
Expectation
Baseline as theimplementation of certification

User perception and expectation againstcertification

How certification system is used to fulfill user expectation andaccountability?

High16

Gap model
Four areas for consideration
HighBoth system and customer
expectation are lower (lessinterest)

Actual implemented service level for certification

Service level is reasonable but
customer do not know its
implemented level

Realistic area where both providerLow
implemented service and customer
expectation(iii) Lower User
Perception(iv) Balanced
betweenperception andexpectation(i) Lower thanBaseline(ii) Higher
Expectation

User expectation is higher
User perception and expectation against
than provider implementedcertificationlevelHigh17

Gap model・ISMS
SOA(statement ofApplicability) should be
exposed to customers⇒Implemented ISMS
management and controls
to reduce risk should be
disseminated・Privacy MarkDefinition should be matchedbetween provider andcustomers

High
Actual implemented service level for certification

Higher Expectation
should be adjusted

Low(iii) Lower User
Perception(iv) Balanced
betweenperception andexpectation？？

(i) Lower thanBaseline(ii) HigherExpectation

User perception and expectation againstcertification

High18

Gap modelHigh

Provider incentive issmall because of its
cost does not matchwith investment⇒potential incentives
should be prepared byauthorities⇒reduce a cot of“certification”
Example: PCIDSS

Actual implemented service level for certification•Low(iii) Lower User
Perception(iv) Balanced
betweenperception andexpectation(i) Lower thanBaseline(ii) HigherExpectation

User perception and expectation againstcertification

High19Gap model

No cloud specificcertification(iv) looks best positioning
but may sift to (ii) or (iii)
according to the lower
investment by provider
and the higher expectation/ perception change

High
Actual implemented service level for certification

Potential Risk for
Certification

Low

Balanced(iii) Lower User degrade(iv)expectation
between
Perception
perception andexpectation(i) Lower thanBaseline(ii) Higher
Expectation

degradeimplemented level

User perception and expectation against
certification

High206 Conclusion Current ISMS and Privacy Mark has revealed that
information asymmetry between provider and customer.
 Missing peace exists between customer expectation/perception
and provider implementation/investment

 The trend is apparent for cloud service.
 The certification should be neutral between user excessive
expectation and provider lower implementation.
 Current certification is not enough to fill the gap for cloudservices

 New model should be designed for accessing gap
between customer and provider implementation.
 The third party organization may balance user
expectation and provider implementation.

21

Thanks
for more information
yo-harada@iisec.ac.jp22