BalticCloud

Status update

2010-10-18T18:47:00.002+03:00

This blog has been inactive for a while. This is directly connected to the fact that the project has ended. This was fun, many thanks to everyone involved!

A bit of advertisement: some of the BC people continued to work in the area of cloud computing by joining http://www.pawnpromotion.com/ .

The inconvenient aspect: security

2009-07-17T17:00:00.003+03:00

When designing a system there's always a trade-off between usability and security. Sales people always try to sell you the new and marvelous system, which is better in every possible way than anything you've seen before. One of the key selling points of the cloud computing is the economic benefit of renting a hardware or a platform instead of buying it. While in many cases this is indeed so, one shouldn't ever forget about the possible security issues.

A data center hosting multiple applications is a much more interesting target for attacks than a single company with a limited computer park. Do you think that your cloud provider can handle these attacks better than you? Will your business survive if you loose/expose sensitive data? What are the ways to minimize the threat?

Confidentiality is not the only property people think of when talking about security of applications, but it's the easiest to understand (especially for the management guys :) ). If the data is located outside your domain and it is unencrypted at any point in time, then it can be compromised (leaked or changed). What could be done about that?

Well, the "easiest' way would be to sign service level agreement with the cloud provider and make them bear financial responsibility if the data gets compromised. Not an easy task for many obvious reasons. One should at least check if the data center/cloud provider has a security certificate, e.g. ISO:IEC_27002. On the connected matter - I wonder when the insurance companies will start offering to insure your business against losses/exposure of data on clouds?

Another option to minimize the security risk would be to use a hybrid cloud approach: with a private cloud (in-house) processing the sensitive data and all of the not-so-critical data processed outside your domain, for example in AWS.

Cryptographers are actively looking for a formally secure solutions that could allow you to store and process data on cloud in an encrypted manner. The recent paper by Craig Gentry from IBM research titled "Fully homomorphic encryption using ideal lattices" is exactly about that. It presents a theoretical framework that allows to process encrypted data without ever decrypting it at a server-side. The bad thing -- it is very far from being practical because of the computational time and space complexity. A practical fully homomorphic encryption scheme will be a very strong argument for cloud computing.

More reading material:

Cloud security - a blog entry by the Berkley group behind the "Above the clouds" whitepaper
Gartner: Seven Cloud Computing Security risks
Forrester: A Close Look At Cloud Computing Security Issues

Establishing BC and more

2009-04-27T18:51:00.004+03:00

1. A lot has been going on in connection with BalticCloud. The financing of the project was finally decided upon. It won't be a long-term project (at least, not under the umbrella of BalticGrid), but exact actions and milestones are still under development. Hope to finalize everything this week.

2. Ubuntu release 9.04 now features several cloud technologies: Eucalyptus and OpenNebula. Evaluating/building clouds is getting easier. Small note though - Ubuntu comes with IPv6 turned on by default. Might slow down a network quite a lot. If you are not using IPv6, just turn it off.

3. Eucalyptus went commercial, though stays opensource. See more at Under the radar. Congratulations to the Eucalyptus team! Hopefully, this will result in another quality opensource product.

4. McKinsey recently published a report on commercial values behind the cloud hype. The report itself is not too wrong, but it probably wasn't written by techies. Thorsten (from Rightscale) lists several inaccuracies that bring the value of the report to a much lower level.

First steps: testing and teaching

2009-04-12T18:29:00.005+03:00

BalticCloud is getting its momentum: first instances of clouds were deployed in Estonia, Lithuania and Belarus.

Technical details: we have decided to go with Eucalyptus software, a rapidly developing open-source solution for creating cloud systems (on the level of OS provisioning). Current deployed version is 1.4, but we are looking forward to 1.5 release (RC is already available) and Rightscale's plans to allow registering also Eucalyptus-based systems with their platform.

Meanwhile, I'm still slowly composing a crash course on cloud computing that is due to be run in mid-May in University of Tartu (many thanks to Eero and Marlon for the opportunity). Alan Williamson's talk at the Cloud Bootcamp in NY is a great base for that.

First entry

2009-03-27T21:19:00.004+02:00

Wow, first entry in the BalticCloud blog. Can you believe it? Naturally, I cannot resist putting an image with clouds on it (and me acting as a watermark :) ).