Cloud Security WarsCloud Security Wars

Ikuo Takahashi

1

15

A long time agoin a network far ,far away

The word “hacker”used to be a respectful word for the master of

computer.However many hackers fell into the Dark World led by dark side of their

power-anger, exhibitionism and temporary joy. Internet has been messed up by the unprecedented

attacks from people who covet the Internet by lust, people who impose on others for economic interests, people who

juggle with the bot. This "Saga" is about the epic of the battle with the society, Engineers who crossed the line of social

activity, and ISP who stand up against the messed up Internet.

………………..

ハッカー

は、選ばれし者。

多数の者が、怒り、自己顕示欲、楽しみのために堕ちていった。

社会は、暗黒の技術者と永遠の初心者からネットワー

クを

守る決心をした。

2

Security Wars Theory

• Every Information Security issue can be explained by analogy of Star Wars

• Balance of “Force”-Hacker power

• Light side• Efficiency• Scalability

• Dark side• Security• Lack of

responsibility

VirtualizationRemote Computing

3

　セキュリティウォー

ズ理論

Factor Analysis of Cloud Computing

Virtualization

Remote

No standard

No location of data

Network Security

Beyond Boundary4

　仮想化因子と遠隔因子の影

響

possibility

Loss of governance

jurisdiction

complianceData protection

subpoenaE-discovery

1 2

Incident response

3 4 5

Quoted form ENISA　“ Cloud Computing－ Benefits, risks and recommendations for information security”

Risk analysis for Compliant Cloud Computing

5

Compliance/Governance Issues

No standard

Under Development

Network Security

Beyond Boundary

Incident Response

Subpoena/Accountability

Loss of Governance

Compliance

Data Protection/Data breach

Jurisdiction6

　コンプライアンス問題の位

置づけ

Behind Scenes

Network

Network Security

Beyond Boundary

Sovereign

Privacy ???Human Factor

7

　問題の潜在因子

Privacy and Security

Network

Network Security

Beyond BoundaryCompliance

Concern

“Cyber Warfare”

Privacy

Sovereign

Human Factors

Enforcement/Judicial

Jurisdiction

Organised Crime

Hacktivism

Innocent Users

8

　プライバシの微妙な役割

Spectrum of Cyber Attack

Cyber crime

Cyber terrorism

Cyber Warfare

natureorganization

armed attack

Damage

State

Damage CI

money

Issues1)private as State

-State Responsibility2)Political motive

vs. Monetary greed

3) Jus in Bello vs.Serious Crime

use of force

　攻撃の分布と概念の限界

9

Analysis of “Cyber Warfare”

10

“Cyber Warfare”

Sovereign

Human Factors

Bot Net

Mass Society

Technology

Attribute

Asymmetric

Innocent users

Definition Issue

Privacy

Order 66 vs ”Bot net” Order

• Order 66– Holoscan appeared on the

palm of his gauntlet ”It is time” the holoscan said.”Execute Order Sixty-Six”

– Standing Order Number One was,apparently,Kill Everything That moves.

– Combat droids were equipped with sophisticated self-motivators that kicked in automatically.

• Star Wars ep3 Chapter 18

• Bot net Order– Bot net were equipped to attack

the target by D-Dos or posting spam

– They communicate each other with sophisticated self-motivators that kicked in automatically. They change their using port or protocol in order to hide themselves.

11

　ボットオーダー

とオー

ダー66

の類似

Is this WAR?• Presumably

– Start from actual fact.

• definition of “War”– “asymmetric war”– no nation, no blood

• Defend the mass user– Refer; “Wire fraud

recovery Act”

•“Victory?” Yoda echoed with great skepticism.• ”The shroud of the dark side has fallen. Begun,this clone War has!”

•Master Yoda after “War of Geonosis”

12

Asymmetric Warfare

• Definition– war between belligerents whose relative military

power differs significantly, or whose strategy or tactics differ significantly.

• e.g. Guerilla War– Guerrilla warfare is the irregular warfare and

combat in which a small group of combatants use mobile military tactics in the form of ambushes and raids to combat a larger and less mobile formal army.

13

　非対称戦争としてのサイバ

ー

戦争

Lack of balance

• No standard to get the information outside the boundary(Criminal, Administrative)

• Very difficult to discuss about privacy vs. security– Defend Innocent users– Prevent innocent users to

be troopers

14

Sovereign

Human Factors

Enforcement/Judicial

Jurisdiction

Organised Crime

Hacktivism

Innocent Users

Privacy

　バランスの喪失

Who will bring the balanceof Light side and Dark side?

• “Force” will resolve such problems.– Reveal the “Two Faces of Privacy”

– Framework and industrial standard to get the information outside the boundaries

– Transparent Cloud Defense System

15

　バランスをもたらすのは、

ルー

クなのか。

Two Faces of Privacy

• When talking about privacy, people agree that privacy is essential to their life.

• (Japan) MIC had been insisting that ISP’s security activity is infringing secrecy of communication.

• Privacy is least importance between price, function and privacy in actual trade-offs.

• Users reliable person’s security activity is preferable activity.(IPA research)

16

　プライバシのトウー

フェイ

ス

Framework and industrial standard

• Cloud Computing Convention Initiative (?)– Information Security Standard all over the world

– Applicable law of privacy

– Industrial Standard for administrative investigation

– Industrial Standard for Forensic research of cloud stored data

– Define the domicile at Civil litigation

– ….17

　産業標準と枠組の必要性

Transparent Cloud Defense

• ISP activity– security

– phishing

– inappropriate information

– copyright

• Domain Registrar's take down procedure

18

　透明性ある中間防御

ISP’s grief

• Vador didn’t intend to kill Padome.– “I’m very sorry, Lord

Vador.(..) It seems in your anger, you killed her”

• “No…no. it is not possible” (ep3) – Darth Vader

ＩＳＰの悲しみ

・言論の自由の制限のつもりはない

・どのように・何を・コストは誰が

Does not intend to regulate “Freedom of

speech” concepts

How to control?What control?Who control?

Who pay for costs?

19

Why Han Solo fight for the peace?

• Han – “I’m not on this mission for

your revolution. Economics interest me, not politics .There’s business to be done under any government.”

• Ep4 Page172

• Cloud security issues are external inefficiencies.

• May the force be with you.

20

　フォー

スのご加護を