We have a HTTP communication currently in between an app engine and a compute engine. What would be the best way secure the communication without providing a secure layer at the HTTP.
Are there native Google functionalities that are well suited - any VPC configuration, VPN technologies, peering? What would you recommend we start to explore?
Thank you!
First, an approach could depend on where are your App Engine and Compute Engine instances located: are they part of the same or different projects, reside in the same or different zone or region, do they communicate via Internal or External IP.
Google uses authentication, integrity checks and AS128 encryption to protect data at one or more network layers when that data goes outside physical boundaries not controlled by Google.
Data in transit inside a physical boundary controlled by Google is not necessarily encrypted because rigorous physical security measures are in place by default, but authentication and integrity are always applied.
More details can be found in the document Encryption in Transit in Google Cloud.
Next, it'd be good to figure out what security risks you expect regarding your data in transit. Speaking about risks, potential vulnerabilities and threats as well as their probability and feasibility should be assessed. For example, for the data transferred between two services communicating via Internal IPs in the same subnetwork of the same zone, threats and vulnerabilities are quite limited compared to public network.
In case the security requirements are so high that the underlying network can't be trusted, Google VPC and VPN go beyond the scope, and you have to encrypt at the Level 7. That is why using HTTPS seems like a logical solution in this case.
perhaps this isn't the best place to ask this, but I wanted to be educated.
I would like to have a Google sheet interact with data on an oracle server.
I have been reading the Google Apps Script guide for setting up JDBC connections, and note that I would need to whitelist a range of IP addresses in order for this to work.
I was told by our infosec department that our db is only allowed to be accessed by onsite servers or through VPN connection, which negates using Google apps script JDBC.
My question is: what is the risk of whitelisting these IP address ranges, is spoofing a google app script IP address within the range plausible or overly cautious? What other factors am I not aware of that I should be considering?
You are correct in that Apps Script needs you to allow your database to accept connections from Apps Script in order to use JDBC with that database. There is no reasonable workaround that would not also violate the rules your infosec department has put in place.
As for whether those rules are overzealous, bare in mind that security folks need to be very cautious as a rule. This discussion on StackExchange may be helpful.
So, I've been reading about security in relation to desktop applications and database servers. Previously when I've built applications that are linked to a database, I've taken the easy route and simply stored the connection string hard coded in the source code directly. This has worked since the binaries were not distributed to third parties. However, now I'm working on a project whose binaries are bound for third party use, and in this case the communication with the server becomes a security issue that I need to deal with.
Since it is a priority that there be no direct connection to the remote database from the client machine, I understand that a server/client database service is a good choice. In this case, the client machine sends requests using TCP to a server, which then processes the request using stored procedures and responds accordingly to the client.
My questions in relation to this are:
i. Would this setup be an advisable one, or are other setups of which I am unaware more advisable for the kind of project I am working on?
ii. How does one go about securing such a connection? I can easily set up an SSL connection to the server using a security certificate generated by OpenSSL, however I'm not sure whether this is the correct way of securing the connection for a desktop application, or whether this method is primarily used for HTTPS. And WHEN should one in general secure the connection (are there instances where this wouldn't matter, for instance if all I do is send booleans back and forth?)? Any good resources that discuss these issues? For instance, I have a lot of application installed on my Windows PC that are networked, but I don't see many of them installing a security certificate on my PC. What gives?
Full disclosure: I'm a C++ (hobbyist) programmer using Boost libraries for my network programming needs and OpenSSL for my SSL cryptography. However, I hope this can be answered without paying too much attention to these facts :)
Answers:
i. Having your application talk to a web service that then talks to the database is a better setup. This abstracts the database away from the clients (and therefore direct access from the internet).
ii. This depends on what the threats to your system are. If the data you are vending from the web service mentioned above is data that is not sensitive, and is not user specific (say an app that allows searching of public photo galleries, so your web service simply returns a result set with URLs) then you might be able to get by with simply using SSL. Other apps get around installing their own cert in a myriad of ways. They can either get a cert from a CA like verisign, so your computer already trusts it. Or they can deploy the public cert with the binary of their app, and handle it inside of their app (this is a form of certificate pinning).
ii part 2. If you need the clients to authenticate, for reasons of either wanting to make sure that not just anyone can use your web service, or to support a more advanced authorization model, then you would need to implement some sort of authentication. That would be a much bigger question to address.
Make sure you use CA-signed certificates, and not self-signed. You might also want to consider mutual authentication between your service and the database.
Not sure is this belongs to stackoverflow or stackexchange. Mods - please point me towards the right platform.
I am unable to find statistics for an average network latency (due to network calls) and average cost hike (because these platforms also charge for network ingress/egress) due to the amount of web-service calls involved - especially when we use different providers for webapp hosting and database hosting. Pretty much everything is on SSL to add more delay. Is this delay/cost noticeable to a consumer ? I understand caching will help, but there's a limit to that.
Just to add some context - I am wondering if it's a smart decision for a startup to go with PaaS (I am planning to use Cloudbees/mongolab); or prefer rolling out everything on IaaS (like EC2). I guess GAE will not have such issues because everything Datastore is a part of their cloud ?
Thanks !
Disclaimer: I'm working at CloudBees. Contact me ndeloof#cloudbees.com if you want to discuss specific application constraints
CloudBees (and probably other PaaS, can't tell) don't bill for network traffic. Compared to an IaaS that would bill I/O, network, CPU cycles, etc, a PaaS offer a higher level abstraction then pricing model.
Network latency indeed is a major topic being hosted on a PaaS, that may be hosted on another continent. CloudBees offer US-east and EU-west regions to host application. For European customers, being hosted in EU zone, with low-latency network connection is a major improvement.
Hosting on a IaaS vs a PaaS can make sense, but probably not as your startup is in early stage. Use the PaaS as a booster to get quicly online and deliver features to your customers. If/when you're successful, maybe you'd prefer for whatever reason to switch (partially?) to a IaaS, and even later follow Facebook and Google building your own DataCenter :P
We have many startups as CloudBees customers, that benefit high level service to reduce Time-to-market, and focus on company actual business. Even working on an IaaS is fun for engineers, from business perspective it's not really what you want developers to focus on when your company has to be quick on a competitive market - and there's lot's of other topics you can have engineers to have fun with ;)
I don't get your comment on GAE. Google is indeed hosting his own DataStore. A PaaS like CloudBees relies on partner SaaS for Mongo (mongoHQ.com) but as this one is hosted on AWS as well network latency is the same as if CloudBees hosted it's own mongo instances.
I am asking this in very general sense. Both from cloud provider and cloud consumer's perspective. Also the question is not for any specific kind of application (in fact the intention is to know which type of applications/domains can fit into which of the cloud slab -SaaS PaaS IaaS).
My understanding so far is:
IaaS: Raw Hardware (Processors, Networks, Storage).
PaaS: OS, System Softwares, Development Framework, Virtual Machines.
SaaS: Software Applications.
It would be great if Stackoverflower's can share their understanding and experiences of cloud computing concept.
EDIT: Ok, I will put it in more specific way -
Amazon EC2: You don't have control over hardware layer. But you can take your choice of OS image, Dev Framework (.NET, J2EE, LAMP) and Application and put it on EC2 hardware. Can you deploy an applications built with Google App Engine or Azure on EC2?
Google App Engine: You don't have control over hardware and OS and you get a specific Dev Framework to build your application. Can you take any existing Java or Python application and port it to GAE? Or vice versa, can applications that were built on GAE be taken out of GAE and ported to any Application Server like Websphere or Weblogic?
Azure: You don't have control over hardware and OS and you get a specific Dev Framework to build your application. Can you take any existing .NET application and port it to Azure? Or vice versa, can applications that were built on Azure be taken out of Azure and ported to any Application Server like Biztalk?
Good question! As you point out, the different offerings fit into different categories:
EC2 is Infrastructure as a Service; you get VM instances, and do with them as you wish. Rackspace Cloud Servers are more or less the same.
Azure, App Engine, and Salesforce are all Platform as a Service; they offer different levels of integration, though: Azure pretty much lets you run arbitrary background services, while App Engine is oriented around short lived request handler tasks (though it also supports a task queue and scheduled tasks). I'm not terribly familiar with Salesforce's offering, but my understanding is that it's similar to App Engine in some respects, though more specialized for its particular niche.
Cloud offerings that fall under Software as a Service are everything from infrastructure pieces like Amazon's Simple Storage Service and SimpleDB through to complete applications like Fog Creek's hosted FogBugz and, of course, StackExchange.
A good general rule is that the higher level the offering, the less work you'll have to do, but the more specific it is. If you want a bug tracker, using FogBugz is obviously going to be the least work; building one on top of App Engine or Azure is more work, but provides for more versatility, while building one on top of raw VMs like EC2 is even more work (quite a lot more, in fact), but provides for even more versatility. My general advice is to pick the highest level platform that still meets your requirements, and build from there.
This is an excellent question. Full disclosure as I am partial to Azure but have experience with the others.
Where I think Azure stands out from the others is the quick transition from on prem to the cloud. For example -
SQL Azure - change connection string, upload DB, go!
Queues work a lot like MSMQ.
Blobs are pretty much blobs any way you shake them but they scale like crazy.
The table storage component is good because it provides incredible scalability for name/value pairs - but takes some getting used to.
Service Bus is my favorite of the services because it allows for a variety of communications paradigms. Two SB endpoints first try to connect to each other, if they cannot, then they route through the cloud - makes for very secure and scalable processing when firewalls tend to get in the way.
Access control list - paired typically with the service bus to make sure the right people access the right things - think SAML in the cloud.
I hope that helps!
My cloud experience is currently limited to Salesforce.com
For standard business operations and automation it provides a significant number of features that allow us to get apps up and running very quickly. We are particularly benefitting from the following:
Security (Administrators can control access to objects and fields)
Workflow & Approvals
Automatic UI generation
Built in reporting and dashboards
Entire system (including our custom changes) is accessible via web services
Ability to make the data in the system available through public sites (e.g. eCommerce)
Large library of third party apps to solve standard problems
The platform does NOT solve every problem.
I would not use the platform to model a nuclear power station or build the next twitter.
The major points of cloud computing is to save on costs by paying for usage and enable immediate deployment of computing resources.
The costs are not purely x amount of cents per instance per hour. The costs include maintenance, development, administration, etc. The huge benefit of cloud, in my mind is to liberate the customers from having to manage anything that is not within the realm of their core business competency. If I am an insurance business, I want my developers to concentrate on my insurance problems that help solve needs of my claims, rates, etc. I would rather avoid dealing with problems of email servers, file servers, document repositories, and administrating OS patches, service packs, etc.
Thus, in my opinion, the biggest benefits are derived from the SaaS and PaaS cloud offerings. One should go to IaaS only when PaaS or SaaS have serious restrictions to specific needs (i.e. I need to install a set of proprietary COM components and Azure does not support them).
SaaS is good for commodity type of applications that are not the core line of business for the client, but are more of a utility. These are your typical Messaging systems, Portals, Document Repositories, Email systems, CRMs, ERP's, Accounting, etc. etc. etc. Why reinvent the wheel by writing your own when you can customize a well supported third party product.
PaaS is great for core line of business software that supports companies' main business offering. Abstracts clients from having to deal with OS management and lets clients concentrate on the business system development - something that noone else can do for the client.
One can also take advantage of the benefits of PaaS (let's say, Google App Engine) and extend it, at times and if necessary, by pulling out some virtual machines from IaaS providers (e.g. Amazon) to do some number crunching then just send back the output to Google App Engine.
This way, you get the best of both worlds -- you can rapidly develop scalable apps in GAE, then you can always augment it by running any program you want from Amazon virtual machines.
This keeps changing, now Windows Azure also supports VM, so it is also an IaaS provider now.
Now how about Free Amazon EC2 for a year to do a better comparision. Check this out.
http://www.buzzingup.com/2010/10/amazon-announces-free-cloud-services-for-new-developers/