CIPART: CLOUD INTELLIGENT PROTECTION AT RUN-TIME

Organisations, small and large, increasingly rely upon cloud environments to supply their ICT needs because clouds provide a better incremental cost structure, resource elasticity and simpler management. This trend is set to continue as increasingly information collected from mobile devices and smart environments including homes, infrastructures and smart-cities is uploaded and processed in cloud environments. Services delivered to users are also deployed in the cloud as this provides better scaleability and in some cases permits migration closer to the point of access for reduced latency.

Clouds are therefore an attractive target for organised and skilled cyber-attacks. They are also more vulnerable as they host environments from multiple tenant organisations with different interests and different risk aversion profiles. Yet clouds also offer opportunities for better protection both pro-actively and reactively in response to a persistent attack.

This project aims to develop novel techniques for intelligent cloud protection by advancing the state of the art in system modelling at run time, attack scenarios based analysis, novel techniques for selecting countermeasures and remedial actions and novel techniques for re-perimeterisation of the cloud environment. The methodology adopted combines fundamental research on knowledge representation, probabilistic analysis and machine learning with empirical and experimental studies in an industrial test-bed environment.

Additionally, the project also aims to achieve a better understanding of the business models and incentives involved in the relationships between cloud tenants and hosting organisations in the provision of security services based on measures of cost, risk and value and to propose new models that facilitate sharing of risk and exchange of security relevant information, which would in turn allow to simplify security management and provide better protection.

The project will deliver tangible outputs that are directly applicable to the security of cloud environments in terms of their resilience to compromise, efficient management at run-time, protection of assets and the relation of cloud protection environments to the business models.

These outputs impact directly a broad range of companies including: cloud service providers, providers of security services and software for cloud infrastructures and cloud users. Amongst cloud users, it will impact in particular SMEs who rely on public clouds, their incremental cost structure and elasticity in order to host part of their computing infrastructure and delivery, and cannot afford significant investments in security management. Improving the resiliency of the cloud infrastructure will enable not only to reduce risks increased through co-tenancy but also to share the risk between tenants as well as between tenants and provider and to manage them better.

The results from the project will also benefit directly organisations focussing on promoting standards and best practice in cloud environments such as the Cloud Security Alliance and ENISA amongst others.

The project will also benefit the increasingly large open source community (Open Stack, Open Nebula) working towards the development of cloud environments as the results of this project will lead to tools and techniques that are more broadly applicable than the target environment in which they are tested, and we aim to release as many of the components of the framework as open source software. The BT environment has itself a large degree of compatibility with open environments (see BT Letter of Support).

Finally we expect the results of the project to contribute to open standards and in particular to a closer alignment between network and systems management standards, grid standards and security standards including amongst others DMTF, TM Forum, Open Grid Forum, OASIS and NIST.