Cloud Storage as a Means for the US Government to Store Data under Various Security Designations - Case Study Example

Cloud Computing Table of Contents Cloud Computing Executive Summary 3 Assets of value 3 Goals and Values 4 Threats5 Vulnerabilities 7 Impacts 8 Initial Risks 10 Recommendations 11 Contingency 13 References 14 Executive Summary This paper examines the subject of cloud storage as a means for the US government to store data under various security designations such as SBU or CUI. It discusses the nature or security under each of the designations and the focuses on the potential underlying vulnerabilities that could threaten the integrity confidentiality, availability and authenticity of the data in cloud storage. These threats are typically classified as people, process and technology representing internal human resource weakness, infrastructural failures and technological vulnerabilities that can be exploited respectively. The potential vulnerabilities pre-set threats such as hacking and intrusion by malicious outsider and insider which in the case of the department of treasure and Defence have be recently evidenced by constant hacking and access of data. The possible impacts range from low medium to high which implies minimal damage and inconvenience toe to extreme injury to person and debilitations of the country’s economic military and health infrastructures which could have devastating consequences. The paper then recommend more rigorous encryption policies as well as better rating of staff and localization of cloud storage to limit physical access especially from abroad. Assets of value There are various designations for information security in the United States under which different Assets of value in document and media content are filed so as to differentiate them based on the level of security relate information they contain. One common designation is the Sensitive But unclassified (SBU), this is a broad category that compromises of information with sub designations such as For official use only (FOUO) or Law enforcement Sensitive as and homeland security data among: In addition the SBU also covers IRS inflation such as enforcement procedures, individual Tax records others (U.S. Department Of Energy, 2007). Sensitive security information is a category of SBU information and it covers data gathered during security operation that specified government agencies believe should be kept secret since its revelation would result in possible communication and transportation crisis or even security. Another designation is the Controlled Unclassified information, which was proposed after 9/11 when the then president Bush decided that the state was keeping too much information a secret although it had been acquired through taxpayer money (Bush, 2001). The Classification was meant to replace SBU, FOUO and LES and serve as a means through which to identify unclassified data not covered by executive order 12958or the Atomic energy act but still needed for dissemination. In retrospect when such data would be handled by client machines within enterprise owned hardware, it was easy to mitigate security risks through encryption, firewalls and anti-virus solution however the first line of defence was psychical separation of networks by controlling those who could access them. However in a cloud infrastructure, the data is in its entirety put in a cloud infrastructure provided by an outside provider, in this scenario the possible safeguards are relatively limited in comparison to the tradition model and the main point of security of the innovations above is predominantly depend on the skill and willingness protected the data and should any of this be compromised the sensitive data in cloud storage could easily be accessed by hackers. Goals and Values Some of the information under the aforementioned designations is personal in nature such as IRS records and although it is not classified, its revelation could be a breach to individual privacy, in addition the data collected in the course of criminal investigation if exposed could negatively affect or undermine the public image and strategy of certain individuals respectively (Sieroty, 2013). For this reason, confidentiality in cloud storage is imperative; to safeguard against leakage of data, several measure have been instituted by the government. One is the security controls assessment and operation authorization which ensure that cloud based systems are given the same accreditation as exiting systems or networks (Schultz, 2011) , these include definition of security requirements as well as thorough documentation and logging risk assessments and authorization designate by a Designated Approving authority. To ease availability and access to date for purposes of recovery and security the federal government cloud storage is required by law to keep the data in its servers in locations within the country since it is easier to protect data if it exists in a limited number of locations. Given the sensitivity of the data that will potentially host in the cloud infrastructure, it is vital that the government ensures there are facilities to prevent non repudiation of information. Take a scenario where someone in the system leaks or irregularly send government information to a third party; if they are suspected, there is a chance they may have eliminated the evidence to prove they sent such data. To curb this several methods have been implemented so including biometric systems that provide virtually undeletable and conclusive evidence of all the actions carried out on the system. This way the government will be better placed to handle and take preventive action against individuals who for political or /and activist reasons tend to expose private government data to the public potentially threating national security. Threats However, the system is threatened by several threats which could compromise the integrity, confidentiality and availability of the data in the system resulting in widespread inconvenience or security dangers to individual or organizations. The current government’s cloud computing system is not standardized across the various agencies and as a result there are several autonomous systems which however have to share resources and data for full functionality. The threat of non-standardization of system was most recently evidenced in the performance problem that hit the healthcare program since it involved the integration of several different systems on the same platform although most of them have multiple custom secured backdoors. As result, as soon as it came online the system would be overwhelmed by clients and it kept failing and denying millions access to the services it was meant to provide. A hypothetical scenario can be used to demonstrate the threat presented by the fact that cloud storage facile have to be sourced to non-government controlled companies which could be compromised and hacked by more skilled individual owing to the universal cloud access. The system could be infiltrated by identity thieves or individuals interested in acquiring private commercial information through industrial espionage. If human threats managed to access the cloud servers, they could alter information or use it to create fake identities which would be backed by the systems, in addition important data could be deleted or otherwise tampered with. While system failures in cloud computing such as the one in the medical program can be attributed to poor organization, lack of sufficient technical knowledge and other such factors, the people threats are more complicated. Individuals may attempt to access government data for purposes of whistle blowing if they believe the government is hiding data which should make public which is the motivation that drives “Hactivists” like Edward Snowden. One of the most notorious groups in connection to this is “anonymous” whose members frequently launch hacking campaigns on individuals, government or corporate databases. Their skill levels vary, some of the hackers have rudimentary hacking knowledge which they augur with available online hacking tools which are cheaply available exploit weaknesses in security systems and intrude upon them. Nevertheless, there are other more highly skilled and professional hackers and in the case of government some have worked for it so understand the system just as well if not better than and this makes them a major threat. Vulnerabilities One of the main technology venerability in government systems is the fact that many of the use outdated versions of website development options as well as poor encryption (Edwards, 2009). Through SQL injections, for example, Anonymous has been able to occasion numerous attacks on the department of energy servers in July 2013. By exploiting a breach in security vulnerabilities in an insecure and outdated version of adobe fusion, they were able to access over 100,000 names social security number and other detail form the department’s employees as well as their dependents and contractors. The usage of software that was both outdated and insecure by a government agency bespeaks underlying people vulnerability. This is because the programmer and security experts who were responsible for setting up the system must have been aware of the weakness and probably dismissed it. They also acquired 2800 bank account number all which were used for malicious purposes including banking fraud and cyber bulling. An example of process vulnerability is seen in the recent attack on treasury department websites in which a tiny nearly undetectable html code was added to their URLS redirecting all visitors to a website in the Ukraine, they hackers then used “Eleonore Exploit”, a hacking software to launch web based attacks on the department (Bits, 2010). In addition in this case scenario, one must be cognizance of the presence, albeit to a minor extent, of human vulnerability, given that they were able to figure out how the hack had been carried out only after it was done, while they could have detected it before it was launched if they had been more skilled or vigilant or both. However the people vulnerability are difficult to fully insulate against since no one is perfect and no matter how hard technicians work to develop a system (Hinduja and Kooi, 2013), there is always the chance that someone more skilled may override the safeguards and access the systems. The aforementioned example also falls under process venerability in which the systems supposed to work together to facilitate Medicare collapsed owing to poor configuration and integration since most of the government system were operated form backdoor silos that made integration on a single platform virtually impossible. Recently in another wave of hacking, Lauri Love who was working from southern England managed to access and hack hundreds of network in the united states and he access information on government employees more so service men and women (Mitchell, 2013). He was also able to access military and missile defence agency data and left “backdoors” which enable them to keep accessing these websites (Mitchell, 2013). This threat is particularly close to cloud computing given that they were hacking American networks while not in the country. The military has been one of the department where the uptake of cloud computing has been widely implemented and it was actually one of the first to apply the cloud systems. Evidently there is a serious risk associated with this since this kind of remote access would not have been possible to carry out the hacks. Impacts The FBI director has been quoted recently saying that it is possible that internet based attacks will pose a greater threat to the US government than Al Qaeda which is currently listed as America’s top security risk (Sprenger, 2013). In view of the potential consequences of the threats discussed above, it not difficult to imagine how that could be. If it is possible for hackers to access the department of defence computer and networks form a remote location and come in go as they please through backdoors, it means that at some point the very security of the American people may be in the hands of hackers. Several “worst” case scenarios come to mind when one considers the possible consequences of such intrusion, for example since the DOD controls the nuclear warheads and other weapons of mass destructions (Sprenger, 2013). Through cloud computing, their servers can evidently be they can accessed from England mean they could just as easily accessed from Iran or North Korea. If USAs enemies were to get access to the technology that could give them access to the defence servers, they could potentially, although it is unlikely , take over the systems and launch terror attack on America from the comfort of their own countries without fear of recrimination. Under FIPS 199 categorization, the worst case scenario could be classified as since it could result in colossal destruction of resources and major loss of life considering the technology could be in the hands extremist not unlike the ones behind the 9/11 attacks(Timothy, 2003). In addition, such intrusions to the cloud system could result in exposure of US assets abroad many whose lives would be jeopardized if their identities were revealed to their host countries. Aside from the security threat, other information that is stored in cloud storage and is vulnerable through process failures ultimately causing malfunctioning such as failing systems like the Medicare one could also result in negative impacts. The health insurance presents a perfect example of this, there were thousands of people who could not log in to access or register their insurance cover and this resulted in a serious inconveniences. This could be categorized as a low threat since it inhibited the mission capability of the websites involved and limited the access of users to the services for the duration when the system were malfunctioning. If one takes the computing failure up a notch hire, they would however realize scenarios far worse than mere inconvenience, the patient records stored in the serves are used by several public hospital to provide background information and history on various patients and through these doctors can derive necessary treatment information. This could be ranked as high given that loss of life would be a major consequence if medical databases from which vital data were compromised. Therefore if the databases we to be hacked or somehow fail due to poor integration and the data is altered, accidentally or otherwise, a lot of valuable infarction could be lost and this would endanger the lives of all the patients depending on the system. Finally it has been determined that a hacker with even the most rudimentary skills can access the servers in the Department of Treasure which apparently is still used outdated adobe ColdFusion based systems. The magnitude of the damage that could be inflicted on the country if this happened on a large scale is substantial, hacker could easily enter the system and cripple the economic system and this would result in chain reactions such as currency depreciation, wall street failure and other devastating effects which could potentially render the country impossible to run or govern effectively owing to a compromised financial base Initial Risks In the last few decades, the USA has been plagued by cyber-attacks most of them from within the country in the emerging trend of hactivims which is probably embodied by online societies such as Wikileaks and anonymous. The risk factor in respect to the technology threats can be therefore categorized as high given that many of the “Hactivists” organization have continuously carried out an unrelenting campaign despite the efforts to stop them including the arrests of some of the members. Such activities comprise the security organs since they may expose information not only to the public but to the nation’s enemies and this could later be used to copy technology or otherwise applied against the United States. The risk factor from process threats is medium in view of the fact that these can often be repaired through technology upgrades and in addition they are not malicious and are usually easy to remedy as soon as they are detected (Abouzakhar, 2009). The people threat should however be ranked higher since their failure to manage the system effectively is essentially what opens doors for the technology and process threats. The most serious threat so far has proven to be technological in which the flaws and weakness in the system are exploited by outsiders to access nervous databases. To remedy this the government should work on it policies and practices on encryption, evidently their system is not sophisticated enough otherwise the likes of Love would not have such an easy time going in and out of the system at virtually administrative levels. To this end the state should expend finance and human resources in coming up with the most sophisticated encryption systems around otherwise the data will remain vulnerable putting the cloud infrastructure and the system operated from them such as health and security in jeopardy. The technology used in securing data should not only be up to date but it should be having sufficient security concomitant with the sensitivity or the information stored therein (Sprenger, 2013). Overall the risk can be rated as high given the fact that today when not all the systems have been updated to the cloud platform and there have been so many threats and problems implying that the system may not be ready for full scale implementation as of yet. Recommendations It is evident from the above discussion that government cloud storage, in-spite of the immense resources expended in their procurement is still venerable to attack and failures (Federal Cloud Initiative, 2009). Given the security of the information stored therein, it is critical that preventive and remedial action is taken to reduce the potential risks to data and by extension its users and subjects. One of the main reasons the government databases have been so easy to hack is because the architecture in many installations is based on adobe ColdFusion platforms although it has been suspected and proven through intrusion that they system is neither secure nor current. Ergo the state needs to overhaul its information security infrastructure so that it can give users security and this will require a bottom up solution through which all the vulnerable software should be secured or replaced. Process vulnerabilities such as those evident in the frequent failure of the Medicare system are caused primarily by poor design and incorporation. To remedy this, the government should ensure that the infrastructure for different interdependent government agencies are compatible and easily integrated should the need arise. For this to happen the system administrators should work in corporation to develop mutual solutions and if possible the overall infrastructure should be designed and implemented by the same party to ensure seamless interaction and avoid server failure which in the long run affect the American people and result to significant losses in time and money (Kirchgaessner, 2013). To safeguard against process risks, the government can also institute infrastructure that offers the capacity to obtain operating systems that have be preconfigured in accordance with the strictest security guidelines. By applying such systems in the cloud storage, the developers can ensure the compatibility of the system with secure platforms. The employees working in the management of the cloud infrastructure and related system have proven to be either unskilled or incompetent as evidenced by the fact that some of the hackers can access their networks and even create access routes without detection. Technicians responsible for operating and managing the systems should be highly trained to start with and throughout their tenures, they should be provided with constant refresher courses to wise them up to the latest hacks and cracks that may be used against the systems (Parfomak, 2008). In addition harsher measures should be taken against anyone who knowingly leaks the content of government databases, the past the sentences have been relatively lenient and this may have served to embolden more “Hactivists” (Daugherty & Shochat, 2003). Organizations such as Anonymous can attack and gain ingress on government networks is evidence of the fact that the hackers are by far more skilled in programming than the staff manning the installations. At the end of the day, the system is only as good as those operating it therefore, until the most qualified people are in-charge of the system, it remains venerable to external threats. Another major people threat is internal in that those responsible for securing the data could exploit their access to it and leak or sell it for the sake of personal gain this is especially feasible in view often fact that much of the clouds infrastructure I manned by third party firms whose primary motive is profit (Abouzakhar, 2013). To insure against such a scenario, the government should institute incisive and thorough screening procedure for any firm before it is awarded a contract for managing the cloud storage facilities. The fact that USA cloud infrastructure could be intruded from the UK is wake up call to the reality and possibility of remote cyber threats and it has spurred co-operation between America and other industrialized nations in the common fight against cyber-terrorism. The UK government arrested Love for his crimes and they have been assisting with gathering evidence related to his and another such crimes. The divergence between the national CIIP policies is one of the hindrances that obstruct the collective efforts to handle external threats to cyber security and cloud facilities (Parfomak, 2008), however these nations are currently working towards developing policy to enable them take more resolute steps toward creating convections and mechanisms for protection of both local and global information environments. Contingency As aforementioned, possible worst case scenarios include infiltration by terror groups or collapses of online medical system resulting in loss of crucial data and endangering life and health. One possible contingency through which this could be addressed is by setting up backup servers on standby that should there be suspicion of incursion by malicious elements, the cloud services are not disconnected but transferred to the back up. References Abouzakhar, N. (2013). Critical infrastructure cybersecurity: A review of recent threats and violations. Proceedings of the European Conference on Informations Warfare, p1. Bits. (2010). Network World, 27(9), 8-8,10,12. Bush, G.W (2001) Executive Order on Critical Infrastructure Protection. Whitehouse. Retrieved from http://www.whitehouse.gov/news/releases/2001/10/20011016-12.html Daugherty, R., & Shochat, G. (2003, Winter). DEA analyst given one-year jail sentence for leaking unclassified information.News Media and the Law, 27, 25. Edwards, J. (2009). Cutting through the fog of cloud security. Computerworld, 43(8), 26-29. Federal Cloud Initiative‖(2009), Office of Management & Budget, General Services Administration, Federal CIO Council, Industry Advisory Council . Hinduja, S., & Kooi, B. (2013). Curtailing cyber and information security vulnerabilities through situational crime prevention.Security Journal, 26(4), 383-402. doi:http://dx.doi.org/10.1057/sj.2013.25 U.S. Department Of Energy. (2007). Identification and protection of unclassified controlled nuclear information.  Lanham: Federal Information & News Dispatch, Inc. Kirchgaessner, S. (2013). Cloud storage carries potent security risk. FT.Com, Retrieved from http://www.ft.com/cms/s/0/4729ed7c-3722-11e3-9603-00144feab7de.html Mitchell, P. (2013, Oct 29). US:Aussies hacked US computers: Court. AAP General News Wire. Parfomak, P, W. (2008) Vulnerability of Concentrated Critical Infrastructure: Background and Policy Options. CRS Report for Congress . Retrieved from https://www.fas.org/sgp/crs/homesec/RL33206.pdf Schultz, B. (2011). Cloud storage a STEEP CLIMB. Computerworld, 45(6), 20-22,24,26. Sieroty, C. (2013). Law & the cloud. Las Vegas Business Press, 30(47). Sprenger, S. (2013). DOD still working to set policies for investigating hacked contractors. Inside the Pentagon, 29(23). Timothy, L. T, (2003), Al Qaeda and the Internet: The Danger of Cyberplanning, Parameters, spring, pp. 112–123; Read More