Information Loss

When information is deleted or altered without a backup, it may be lost forever. Information also can be lost by unlinking it from its indices, deleting its identifying metadata, or losing its encoding key, which may render it unrecoverable. Another way data/document loss can occur is by storing it on unreliable media. And as with any architecture—not just cloud computing—unauthorized parties must be prevented from hacking into the system and gaining access to sensitive data. In general, providers of cloud services have more resources at their disposal than their individual clients typically have.

Examples

• Basic operational failures, such as server or disk drive crashes.
• Data center reliability, backup, and disaster recovery/business continuity issues.
• Implementation of information purging without your approval (e.g. purging all data over three years old without regard to your retention schedule or existing legal holds).

The Fixes

• Agreement by cloud provider to follow standard operating procedures for data backup, archiving, and retention.
• Standard procedures for information purges that require your sign-off before they are completed.
• Check your insurance coverage. Are you covered for the costs or liability associated with a breach or loss of information that is stored in the cloud?
• Clear delineation of the process for notifying the client of a security breach or data loss.

Information Breaches

Many times damage to information is malicious, while other times damage is unintentional. Lack of training and awareness, for example, can cause an information user to accidentally compromise sensitive data. Organizations must have proactive IG policies that combat either type of breach. The loss of data, documents, and records is always a threat and can occur whether cloud computing is utilized or not.

But the threat of data compromise inherently increases when using cloud computing, due to “the number of and interactions between risks and challenges which are either unique to cloud, or more dangerous because of the architectural or operational characteristics of the cloud environment.”

Examples

• Lack of document life cycle security (DLS) technologies, such as data loss prevention (DLP) and information rights management (IRM) technologies.
• Insufficient authentication, authorization, and audit (AAA) controls to govern login access.
• Ineffective encryption and software keys, including lost keys or inconsistent encryption.
• Security challenges related to persistent data or ineffective disposal methods.
• Inability to verify disposal at the end of information life cycle.

The Fixes

• DLS implementation where needed to protect information from creation to their final disposition.
• Strong encryption to protect sensitive data at rest, in use, and in transit.
• IG policies for data and document security during the software application design phase as well as testing and auditing the controls for those policies during live operation.
• Secure storage, management, and document destruction practices.
• Contractual agreement by cloud service providers to completely delete data before storage media are reused by other clients.
• Check your insurance coverage. Are you covered for the costs or liability associated with a breach or loss of information that is stored in the cloud?
• Clear delineation of the process for notifying the client of a security breach or data loss.

The Enemy Within: Insider Threats

Since the advent of the National Security Agency controversy and the slew of examples in the corporate world, the threat of the malicious insider is well known. “This threat is amplified for consumers of cloud services by the convergence of IT services and customers under a single management domain, combined with a general lack of transparency into provider process and procedure” (emphasis added). It is important to understand your cloud provider's security procedures for its employees: How are they screened? Are background checks performed? How is physical access to the building and data center granted and monitored? What are its remedial procedures for noncompliance?

When these security, privacy, and support issues are not fully investigated, it creates an opportunity for identity thieves, industrial spies, and even “nation-state sponsored intrusion. The level of access granted could enable such an adversary to harvest confidential data or gain complete control over the cloud services with little or no risk of detection.”

Examples

• A cloud provider's employee steals information to give or sell to one of your company's competitors.
• Inadequate screening processes (by your company or a cloud provider) can result in the hiring of people with criminal records, granting them access to sensitive information.
• A cloud provider's subcontractor steals information to give or sell to one of your company's competitors.
• A cloud provider's employee allows unauthorized access to data that your company believes is secure in the cloud.
• The physical cloud storage facility lacks security, so anyone can enter the building and access information.

The Fixes

• Implementation of DLP and IRM technologies and related technology sets at all stages of DLS.
• Assessment of suppliers’ practices and complete supply chain, especially those services that are subcontracted.
• Screening and hiring requirements (e.g. background checks) for employees as part of contract with cloud provider.
• Transparent policies regarding information security, data management, compliance, and reporting, as approved by the client.
• Clear delineation of the process for notifying the client of a security breach or data loss.

Hacking and Rogue Intrusions

Although cloud computing providers, as a rule, invest heavily in security, they also can be the target of attacks, and those attacks can affect many client enterprises. Providers of cloud infrastructure service (e.g. network management, computing power, databases, storage) offer their customers the illusion of unlimited infrastructure expansion in the form of computing, network resources, and storage capacity. Often this is coupled with a very easy sign-up process, free trials (even for anonymous users), and simple activation with a credit card. This is a boon to hackers who can assume multiple identities. Using these anonymous accounts to their advantage, hackers and spammers can engage in criminal operations while remaining elusive.

Examples

• Cloud services providers have often unknowingly hosted malicious code, including Trojan horses, keystroke loggers, bot applications, and other programs that facilitate data theft. Recent examples include the Zeus botnet and InfoStealer.
• Malware can masquerade as downloads for Microsoft Office, Adobe PDFs, or other innocuous files.
• Botnets can infect a cloud provider to gain access to a wide range of data, while leveraging the cloud provider's control capabilities.
• Spam is a perennial problem—each new countermeasure is met with new ways to sneak spam through filters to phish for sensitive data.

The Fixes

• IG policies and monitoring controls must require tighter initial registration and thorough user verification processes.
• IG policies and technologies to combat credit card fraud.
• Total network monitoring, including deep content inspection.
• Requirement that the cloud provider regularly monitor public blacklists to check for exploitation.

Insecure Points of Cloud Connection

By their very nature, cloud computing solutions involve the movement of information. Information moves from a workstation in your network to the cloud, from the cloud to a mobile device user, from an external partner to the cloud and then to one of your workstations, and so on. Further, information may be moved automatically from an application in the cloud to an application you host internally and vice versa. The movement of information complicates the process of securing it, as it now must be protected at the point of origin, the point of receipt, on the device that transmits it, on the device that receives it, and at all times when it is in transit.

An application programming interface (API) is a way of standardizing the connection between two software applications. APIs are essentially standard hooks that an application uses to connect to another software application—in this case, a system in the cloud. System actions like provisioning, management, orchestration, and monitoring can be performed using these API interfaces.

It comes down to this: a chain is only as strong as its weakest link, so APIs must be thoroughly tested to ensure that all connections abide by established policy. Doing this will thwart hackers seeking work-arounds for ill intent as well as valid users who have made a mistake. It is possible for third parties to piggyback value-added services on APIs, resulting in a layered interface that is more vulnerable to security breaches.

Examples

• Anonymous logins and reusable passwords can undermine the security of an entire cloud community.
• Unencrypted transmission or storage and unencrypted verification allow successful man-in-the-middle data theft.
• Rigid basic access controls or false authorizations pose a threat.
• Poor management, monitoring, and recording of cloud logins and activity make it difficult to detect malicious behavior.
• Weak APIs provide opportunities for data compromise.
• Dependency on unregulated API interfaces, especially third-party add-ons, can allow critical information to be stolen as necessary connections are made.

The Fixes

• Utilization of multiple logon authentication steps and strong access controls.
• Encryption of sensitive data during transmission.
• More robust and secure API access control.
• An understanding of the security model of cloud provider APIs and interfaces, including any third-party or organization-created dependencies.
• Understanding how the API impacts associated cloud usage.

Issues with Multitenancy and Technology Sharing

Basic cloud infrastructure is designed to leverage scale through the sharing of components. Despite this, many component manufacturers have not designed their products to function in a multitenant system. Newer architectures will evolve to address this issue.

In the meantime, virtual computing is often used, allowing for multiple instances of an operating system (OS) (and applications) to be walled off from others that are running on the same computer. Essentially, each instance of the OS runs independently, as if it were the only one on the computer. A “virtualization hypervisor mediates access between guest operating systems and the physical compute resources” (like central processing unit processing power). Yet flaws have been found in these hypervisors “that have enabled guest operating systems to gain inappropriate levels of control or influence on the underlying platform”—and therefore indirectly impact the other guest OSs running on the machine. To combat this, “security enforcement and monitoring” of all shared computing resources must be employed. Solid partitions between the guest OSs—known as compartmentalization—should be employed to ensure that one client's activities do not interfere with others running on the same cloud provider. Customers should never have access to any other tenant's “actual or residual data, network traffic” or other proprietary data.

Examples

• Joanna Rutkowska's Blue Pill root technique, which describes how an unauthorized user could intercept data by using virtual hardware called a hypervisor. The Blue Pill would be undetectable as long as the host system was functioning properly. Rutkowska also developed a Red Pill, which could detect a Blue Pill hypervisor, allowing the owner to eliminate it.
• Kostya Kortchinksy's CloudBurst is another example of hypervisor exploitation.

The Fixes

• Security IG that leverages best practices for installation, configuration, monitoring, testing, and auditing of cloud computing resources.
• Requirements for monitoring the computing environment for any rogue intrusions or misuse of cloud resources.
• Control and verify access. Promote a more secure two-factor authentication procedure.
• Enforceable service-level agreements (SLAs) for patching software bugs, addressing data breaches, and fixing vulnerabilities.
• An IG policy that requires regular audits and evaluations to detect weaknesses in cloud security and configuration.

Hacking, Hijacking, and Unauthorized Access

Hacking into accounts to assume the identity of an authorized user has been happening almost since personal e-mail existed. It can be as simple as stealing passwords with a keystroke logger. Attack methods such as social engineering (e.g. phishing), fraud by identity theft, and exploitation of software vulnerabilities are still effective at compromising systems. Most people recycle a few passwords and reuse them for multiple accounts, so once one is breached, criminals can gain access to additional accounts. If login credentials are compromised, a hacker can monitor nearly everything your organization is doing: a less passive hacker might alter or destroy sensitive documents, create false information, or replace your links with fraudulent ones that direct users to sites harboring malware or phishing scams. Once they have control, it can look like your organization is the origin of the malicious downloads or information capture. From here, the attackers can assume the good name and reputation of an organization to further their attacks.

Examples

• Examples are widespread in the general population; however, no clear instances of this occurring with cloud services providers are known (as this book goes to press).

The Fixes

• IG policies should clearly state that users and providers should never reveal their account information to anyone.
• An IG policy should require more secure two-factor authentication techniques to verify login identity, where possible.
• Require your cloud services provider to actively monitor and log all activity in order to quickly identify users engaging in fraudulent actions or those that otherwise fail to comply with the client's IG policy.
• Understand, analyze, and evaluate the cloud provider's contract, especially regarding security protocols. Negotiate improved terms in SLAs to improve or enhance security and privacy.

Who Are Your Neighbors?

Knowing your neighbors—those who are sharing the same infrastructure with you—is also important, and, as we all know, good fences make good neighbors. If the cloud services provider will not or cannot be forthcoming about who else is sharing its infrastructure services with your organization and this becomes a significant issue, you may want to insert contract language that forbids any direct competitor from sharing your servers. These types of terms are always difficult to verify and enforce, so moving to a private cloud architecture may be the best option.

Examples

• The Internal Revenue Service (IRS) utilized Amazon's Elastic Compute Cloud service. When the IRS asked Amazon for a certification and accreditation (C&A) report, Amazon declined. (Note: The C&A process was developed to help ensure compliance with NIST standards and mandated by the Office of Management and Budget, which oversees Federal Information Security Management Act of 2002 compliance.)
• Heartland, a payment processing corporation, suffered a data breach in 2008. Hackers stole account details for over 100 million credit and debit cards. This data was stored on Heartland's network, which the hackers broke into using information (pertaining to employees, corporate structure, company networks, and related systems) it had stolen in the weeks leading up to the major breach.

The Fixes

• An IG policy that requires full disclosure of activity and usage logs, and related information. Audit the policy for compliance.
• Investigate the architecture of your cloud services provider (e.g. version levels, network OSs, firewalls, etc.).
• Robust and vigilant supervision, logs, and reporting of all system activity, particularly that requesting expansive and detailed reports on the handling of sensitive information.

Additional IG Threats and Concerns

A primary selling point of cloud computing is that enterprises are freed up to focus on their core business rather than being focused on providing IT services. Modulating computer hardware and software resources without making capital expenditures is another key advantage. Both of these business benefits allow companies to invest more heavily in line-of-business activities and focus on their core products, services, and operations. However, the security risks must be weighed against the financial and operational advantages. Further complicating things is the fact that cloud deployments often are enthusiastically driven by advocates who focus inordinately on potential benefits and do not factor in risk and security issues. Additional examples of IG concerns are listed next:

• Lack of clarity about who owns the information (and if that changes at any point).
• Risk of association with any larger failures of the cloud provider.
• Inability of the cloud services provider to manage records at the file level.
• Inability to closely follow the user's retention schedule and produce certificates of destruction at the end of the information life cycle. This may result in information that is held for too long and ends up costing the client unnecessary expense if it is deemed to be responsive to litigation or other legal action.
• Lack of RM functionality in many cloud-based applications. This problem is not unique to cloud platforms, but the key difference is that internal storage resource systems may have functionality that supports integration with a RM solution. It is unlikely that a cloud provider will provide the option of integrating your in-house RM system with its system. Too many potential security, access control, and performance issues may result.
• Inability to implement legal holds when litigation is pending or anticipated.
• Poor response time—inability to deliver files quickly and in line with user expectations.
• Limited ability to ensure that your cloud provider meets your duties to follow regulations related to the governance of your information.
• Jurisdiction and political issues that may arise due to the fact that the cloud provider resides outside of the client's geographic region.
• Storage of personally identifiable information (PII) on servers in Europe or other locales that prohibit or restrict the release of PII back to the United States (or home country of the cloud services client organization).¹³

An analysis of an organization's exposure to risk must include checking on software versions and revision levels, overall security design, and general IG practices. This includes updating software, tools, and policy, as needed.

Finally, for each of these challenges, “IG policies and controls to secure information assets” and “IG policies and controls to protect the most sensitive documents and data” are a key part of the solution.

New CIS Controls for Mobile Guide¹⁴

Consistent Security Is the Goal

In March 2019, the Center for Internet Security (CIS) released the Mobile Companion Guide to help organizations map the CIS controls and their implementation in mobile environments.¹⁵ In the companion guide, the focus is on a consistent approach to applying the security recommendations in both Google Android and Apple iOS environments. Factors such as who owns the data and who owns the device affect how the device should be secured. The Mobile Companion Guide explores bring-your-own device (BYOD), corporate-owned, personallyenabled (COPE), fully managed, and unmanaged devices.

• BYOD (bring your own device): Devices are owned by the end user but occasionally are used for work purposes. Access from BYOD devices to organizational resources should be strictly controlled and limited.
• COPE (corporate-owned, personally enabled): COPE devices work in a fashion similar to BYOD. Restrictions will be applied to the device, but generally don't prevent most of what the user intends to do with the device.
• Fully managed: Devices within this deployment scenario are typically locked down and only permitted to perform business functions. This means that employees have a second device for personal use.
• Unmanaged: A popular model for small companies and startups, this is the most dangerous scenario to the enterprise and should be avoided, if possible.

The Guide also looks at systems that administer and monitor devices, such as enterprise mobility management (EMM), mobile device management (MDM), mobile application vetting (MAV), and mobile threat defense (MTD). The CIS Mobile Companion Guide includes this checklist to track implementation of the 20 controls on mobile devices.

All organizations operate mobile devices and need to adopt a security mindset and harden the devices to protect against the unique challenges of on-the-go mobile computing environments. The CIS Mobility Guide provides an excellent overview of how to address this challenge. The complete guide can be downloaded from https://www.cisecurity.org/blog/new-release-cis-controls-mobile-companion-guide/.

SharePoint IG Features

SharePoint as a product family has been available since late 2000. In that time many things have changed, including the underlying development technologies and platforms. During the changes the product developed a set of rich capabilities to support information governance. From a basic information management perspective SharePoint supports file versions, approvals, metadata, workflows, and a host of other expected capabilities. Since 2010, SharePoint has supported not just records but also basic eDiscovery capabilities including holds. SharePoint 2016 introduced data loss prevention support as well.

SharePoint's most basic unit of control is a content type. The content type wraps up a set of properties and behaviors including what metadata columns are allowed and which ones are required, retention policies, available workflows, retention policies, and more. Content types are not defined at a farm (installation) level. Nor are they defined at a web application level (fully qualified name). Instead, content types are defined at a site collection level or a site level. A site collection is—as the name suggests—a collection of sites. The fact that content types are defined at such a low level reduces the consistency across different areas of the business.

SharePoint does offer a content type hub which can publish content types to every site collection—minimizing the potential impact of having multiple definitions for the same type of content; however, the out-of-the-box functionality leaves opportunities for third parties to come in to offer a complete solution that can audit when individual site collection owners have modified the corporate published types.

Storage in SharePoint exists in either a list or a library which itself is located in a site. A list is simply a collection of rows which can have attachments and support versioning. A library is a collection of files and folders. Both lists and libraries use the same content type approach and therefore each item can have its own workflows, retention policies, can be declared as a record, and so on. While most of the considerations for information governance occur at a content type level, versioning is implemented in either the list or library.

Some options for information governance can be applied to a list or library. Most of the time the functions are under-the-covers being implemented as information governance controls on the default content type rather than on the list or library itself.

Lists and libraries support two different mechanisms for records management. The first method declares a record by sending it to a records center. Each implementation can have one or more records centers. Once the record is sent to a records center it can be removed from the originating location, replaced with a link to the location in the records center, or left intact. Records can be declared manually or through the use of workflows.

The second records management implementation is referred to as in-place records management and the declaration of a record marks the information so that even users with permission to the item can't take prohibited actions, such as deleting the record. In-place records management resolves some of the concerns with findability of records. However, in-place records management does expose a large retention problem.

SharePoint, out-of-the-box, provides no mechanism for site or site collection lifecycle management. The result is that when an entire site should be destroyed because it's reached its expiration the process must be done manually or via an automated mechanism not built into SharePoint. This is particularly problematic when the records inside the site have different retention schedules where some should be deleted at one interval and others at another interval. Managing this process is left to third parties or organizations to solve themselves.

In addition to records management, SharePoint supports in-place holds. The holds can be triggered through the eDiscovery mechanisms or done manually. Starting with SharePoint 2013, a document on-hold can be modified, though the version that was placed on hold may not be destroyed. Management of holds is performed through an eDiscovery center. eDiscovery in SharePoint is SharePoint only-scoped and therefore represents one more repository to be managed when responding to a request.

Office 365 Infrastructure

It's important to understand that Office 365 is built on top of the Microsoft Azure services and is delivered from Microsoft Azure datacenters. Microsoft maintains numerous certifications for overall compliance and specific compliance with various industry regulations. This means that the physical and data security of the Microsoft data centers which service Office 365 have been thoroughly evaluated.

Additionally, Office 365 is built on top of the Azure Active Directory service, which allows for corporations to synchronize their internally managed active directories to an Azure hosted replica. This replica can be used only as a directory or, with password synchronization, for authentication. Passwords synchronized to Azure Active Directory go through an additional SHA128 hashing process to ensure their safety.

Microsoft offers a variety of authentication security options—some of which are not included in all Office 365 licenses—that allow for multifactor authentication as well as other limitations and controls including rules based on where the login attempt is coming from. For organizations that do not want to accept Microsoft's safeguards for authentication or have additional requirements, authentication can be performed through a federated authentication provider including third parties or organization hosted Active Directory Federation Services (ADFS) which is an included part of your Windows server license. ADFS servers allow for even more fine-grained control of who can login at what times from what locations and what they must do to prove their identity.

Office 365 IG

IG in Office 365 starts with all of the features in SharePoint for SharePoint and OneDrive content and all of the features and capabilities conveyed by nature of the base infrastructure as well as additional capabilities that are unique to Office 365. Features like customer key allows organizations to bring their own encryption keys so that Microsoft isn't able to provide decrypted information even if they're required by a court or government to turn over customer information. Though organizations would presumably be required to provide their keys to lawful authorities, having the request go directly to the organization allows them to exercise their legal rights to appeal the request.

More broadly, Office 365 has a security and compliance center which provides a platform view of many information governance concerns. Data governance and data loss prevention are both across-service features that apply to Exchange and SharePoint. This provides a single approach that functions across the service regardless of whether the data is stored or transmitted. These features are, at the time of this writing, integrating Azure information protection labels and experiences in Outlook and SharePoint including mobile clients.

While these information governance capabilities do not use the historical SharePoint approaches for data loss prevention nor records management, the fact that they can be applied across the entire offering make them a compelling solution for addressing the multiple repository problem that plagues all large organizations. While the scope extends only to the Microsoft offerings, this can represent a substantial portion of an organization's information governance needs.