Security and the Cloud: Should We Really Keep Everything On-prem?

Welcome to a nuanced exploration of pivotal considerations surrounding cloud adoption in the context of wafer fabrication. For those reading sceptically, uncertain about the merits of cloud integration, or perhaps prompted by concerns about lagging behind competitors—this blog endeavours to shed light on key areas of relevance.

Introduction

For those reading this blog, the chances are you (or perhaps your boss) remain unconvinced about the merits of cloud adoption, yet are open to participating in the ongoing debate. Alternatively, there might be a concern of falling behind industry peers, perhaps heightened by recent security incidents such as the hacking of X-Fab. By the end of this short article, you will have gained valuable insights into the significant areas of cloud security, with the anticipation that such information will contribute to a more informed decision-making process.

Firstly, this is about using a cloud service, not running your own systems in the cloud. There are good arguments for that too, but that’s not what this article is about. So, the areas deemed worthy of exploration within this context include:

• Security - It is a paramount concern that influences the reluctance of fabs to embrace cloud services, often accompanied by apprehension about entrusting sensitive data to cloud platforms.
• Type of service - If you’re running it on-premise, you’re probably managing it. Would you prefer to be buying software or a service?
• Cost - One of the supposed benefits of the cloud is less overall running cost. How much truth is in that? 
• Reliability and criticality - What about backups and disaster recovery and failover and downtime and maintenance and…?
  
  ‍

Recognising the complexity of these topics, we aim to take a segmented approach, with this blog dedicating its focus to the critical factor of security. Subsequent entries promise a comprehensive discussion on the remaining aspects. 

Security

We’re going to start with a simple one. Is your fab in any way connected to the internet? If you’re genuinely air-gapped, then it's reasonable to assume you already have a high level of security. But, if you’re not actually air-gapped, then you could actually improve your security by using a cloud service rather than running that service on-prem. Not instantly obvious perhaps, but let us explain. 

My fab is connected to the internet already

The most compelling argument that exists for this is a simple one. Microsoft, AWS, IBM and Google all run respectable professional public clouds. If the service we’re talking about connecting to runs on any one of them, it’s fair to say they have similar approaches to cybersecurity.

Microsoft alone employs 3500 cybersecurity professionals to maintain the security of Azure and together they spend a lot on cybersecurity improvements. That’s an awful lot more person-hours on security than most are going to be able to apply from their team. Every single one of them is contributing to the security of a system running in their cloud.

“Aha!”, you say, “that tells me that the underlying public cloud infrastructure that the service is running on is probably as secure as anything connected to the world could be, but that doesn't mean that the service running on it is, right?” And yes, that’s a fair concern. As one of those service providers, we can confirm that we do not employ 3500 cybersecurity professionals. But because we run our service on Azure, we don’t need to. More than half our fight is already done for us and the remainder is a lot easier. For example:

• Staying on top of security patches: Not something we need to worry about. Azure does almost all of it for us. The only thing it doesn’t do is update our own code dependencies, so we have Snyk do that for us.
• Anti-virus: Don’t want viruses in your systems? Tick. That’s an easy built-in feature.
• Secure data: All storage is encrypted without us having to do anything special and we can do the same with data in transit.
• Secret management: There’s a whole infrastructure designed by those 3500 cybersecurity professionals that we can use right off the shelf.
• Access management: Active Directory–a directory service built by Microsoft–is built into everything so we just have to define what the roles should be and who has access. There’s not many roles, and only some very trusted people.
• Security auditing: Every action in every piece of infrastructure is logged by default and we can feed that all in very easily to our security monitoring systems to identify any suspicious activity.
  
  ‍

In discussing the ease of these security measures, perhaps we’ve been slightly frivolous. However, despite the casual tone, the implementation of security measures when using cloud technologies is notably simpler when compared with organisations that manage their own hardware. 

My fab is air-gapped right now

On the other hand, maybe you’re a fab that is actually air-gapped. You’ve got a solid on-site security team and excellent anti-social-engineering measures. Why introduce any risk? Fair question. We’d argue that this is going to become an increasingly challenging problem for you and maybe now’s the time to get ahead of the problem. Tools on your shop floor are already getting more modern, with virtualised metrology and off-site telemetry feeds for predicting failure rates using machine learning. Some of these systems just can’t be run on site and you’ll increasingly have to do without the more advanced aspects of your tooling to maintain your air gap. Over time this will take its toll, and your competitors will begin to pull away.

At this point it’s worth mentioning that SEMI has put together standards in the cybersecurity space. These address risks like bringing tools into your network with embedded software on them as well as defining how to set up your fab network to secure it, while still enabling external communication. We’d suggest that you should treat a cloud service no differently. It is entirely possible to use a managed service, in the cloud, connected to your fab, while still relying on purely outbound connectivity from your fab, leaving you entirely in control of what data is provided to the service and what you do with any data made available by that service in return.

In summary

If you’re already “internet-enabled” in your fab, then we’d argue that using a reputable public cloud service is actually more secure than running that same service on-prem.

If you’re completely offline, we’re not going to argue that using a cloud service is more secure than not connecting to the internet. What I am arguing though, is that at some point you’re going to have to anyway, so you’re better off getting on top of this now rather than waiting until you’re forced into it by the market. 

‍

Author: Ray Cooke, VP of Engineering at Flexciton

‍