Transcript Security Guidance for Critical Areas of Focus in Cloud Computing CSA White Paper Review OWASP Facilitated by Marjorie Meyer Kansas City Chapter [email protected] 913-906-0991 Education Project Copyright 2007 ©

Security Guidance for Critical Areas
of Focus in Cloud Computing CSA
White Paper Review
OWASP
Facilitated by Marjorie Meyer
Kansas City Chapter
[email protected]
913-906-0991
Education Project
Copyright 2007 © The OWASP Foundation
Permission is granted to copy, distribute and/or modify this document
under the terms of the OWASP License.
The OWASP Foundation
http://www.owasp.org
Cloud Security Alliance
Founded in November, 2008 to promote best
practices for security in Cloud Computing
White paper is the organization’s first initiative
Promote education, awareness of cloud security
solutions and common level of understanding to
consumers and providers
OWASP
2
http://www.cloudsecurityalliance.org/
http://www.linkedin.com/groups?gid=1864210
OWASP
3
Cloud Computing Principal Characteristics
Abstraction of
infrastructure
Resource
democratization
Services oriented
architecture
Elastic Dynamic
Resources
Utility model of
consumption
Abstract network,
compute, storage
resources from
application to pool
resources
Pay for what you use
OWASP
4
The OpenCrowd Taxonomy – http://www.opencrowd.com/views/cloud.php/2
OWASP
5
Cloud Service Delivery Models – SPI Model
Software as a service (SaaS)
least open greater security taken on by provider
Platform as a service (PaaS)
Extensibility and security must be leveraged by
customer
Infrastructure as a service (IaaS)
Great extensibility and least amount of security
responsibility by the provider
OWASP
6
Service Deployment & Consumption Models
OWASP
7
IBM Cloudburst – Private Cloud Offering
http://www.ibm.com/ibm/cloud/cloudburst/
OWASP
8
Domain 1 -Infrastructure as a Service
OWASP
9
Amazon Elastic Compute Cloud (Amazon EC2) Security
http://awsmedia.s3.amazonaws.com/pdf/AWS_Security_Whitepaper.pdf
OWASP
10
http://calculator.s3.amazonaws.com/calc5.html
OWASP
11
Domain 1 -Platform as a Service
OWASP
12
http://code.google.com/appengine/
OWASP
13
Domain 1 -Software as a Service
OWASP
14
http://www.ibm.com/ibm/cloud/ibm_cloud/
OWASP
15
Cloud Model mapped to Security Model
OWASP
16
Domain 15 - Virtualization
Vulnerabilities found in existing web applications
with greater risk due to the dynamic nature of
virtual machines
Difficult to achieve and maintain consistent
security because new virtual machines can be
spun in a few clicks
Network context is lost as VMs move freely from
one physical box to another
Controls must be in place so only appropriate
individuals can dispatch a VM
OWASP
17
Virtualization security advantages
Increased redundancy
May reduce data co-mingling issues
System recovery can be simpler
Defined memory space for each VM helps in
resisting buffer overflows
OWASP
18
Virtualization security guidance
Each VM needs to be configured to an
appropriate locked-down state
Controls needed to avoid cloning miss-configured VM
VM’s need to be fully patched
All images must be managed, both on and off-line
Backup strategies of archiving VMs will lead to VM
sprawl
Augment platform security with 3rd party
security mechanisms
OWASP
19
Virtualization guidance cont’d
VM-based controls such as firewall, application
control, IDS/IPS, log inspection, integrity
monitoring and web application protection are
necessary to provide comprehensive threat
protection for virtual environments
Log inspection and integrity monitoring must be
deployed at VM level
Create a “gold standard” VM and clone away
from this base
OWASP
20
Domain 2 -Governance & Risk Management
Scrutinize the provider’s security capability – this
onus is on the customer. Obtain all policies and
procedures of the provider’s Information
Security Management System
Audit and monitor key risk and performance
indicators; also the financial viability of the
provider
Obtain 3rd parties of the cloud provider
OWASP
21
Potential Conflicts and Issues
Many public IaaS have blanket bans on
customers running network scans, undermines
vulnerability scanning as a security control
Multiple storage providers for a single
application raises issues
OWASP
22
Domain 3 - Legal
Contracts are key, but may present challenges
due to dynamic nature
Potential conflicts due to cross border data transfers
and laws the provider must comply with and those
governing the customer
 Plan for an expected and unexpected
termination of the contract and orderly return or
disposal of your assets
OWASP
23
Risk Example – Google Docs
http://epic.org/privacy/cloudcomputing/google/ftc031709.pdf
EPIC requesting HTTPS encryption be enabled by default for the entire Gmail,
Docs or Calendar session http://files.cloudprivacy.net/google-letter-final.pdf
OWASP
24
Domain 4 - Electronic Discovery
Challenges the presumption that organizations
have control over data which they are legally
responsible
Must have mutual understanding of
responsibility for litigation hold, discovery
searches, expert testimony
Records and data must be preserved as
authentic and reliable, including metadata, log
files
OWASP
25
Domain 5 – Compliance and Audit
Classify data and system to understand
compliance
Maintain the right to audit on demand
Perform external risk assessments
Examine the scope of SAS 70 Type II audits and
ISO 27001 certifications
OWASP
26
Domain 6 - Information Lifecycle Management
 Privacy restrictions for data
Policies and processes for data retention and
destruction (retention easy to demonstrate, but
destruction may be very difficult)
 Penalty and recovery of data breech costs
Logical segregation of duties, isolation of
production environment , etc.
OWASP
27
Domain 7 - Portability and Interoperability
SaaS – perform regular backups and ensure
format is usable and not proprietary to the
provider.
IaaS – deploy applications in runtime in a way
that is abstracted from the machine image.
Backups should be machine independent and
moved outside the Cloud regularly
PaaS – Customer’s goal should be for portability
to prevent potential lock-in to a single
development environment
OWASP
28
Domain 8 - Business Continuity & Disaster
Recovery
Risk of insider threats from within the cloud
provider
Ensure job duties are compartmentalized and
knowledge is restrict to that which is needed to
perform job duties
Onsite inspections
Disaster recovery and business continuity
OWASP
29
Domain 9 - Data Center Operations
Customer support mastery
Can another client’s business fluctuations impact
your experience
For SaaS is data secured in a way that prevents
tampering by all system admins and 3rd parties?
OWASP
30
Domain 10 - Incident Response
 Stipulate your access and encryption
requirements; only decrypt for the
application that has been created to
manage the data
 Security Operation Centers must provide for
multi-tenant cloud providers
 Notification process more complex.
Application owners and who to contact in
case of an incident has to be built, which
maps differently than SOC/SIM models in
use today
OWASP
31
Larger scale and audience for incidents
 Cloud Computing Community incident
database has captured the following types
of incidents over that past 18 months:
– • Malware infection.
– • Data breach.
– • Man-In-The-Middle discovery.
– • Session hijacking.
– • User impersonation.
Cloud Computing Community Incident Database:
http://wiki.cloudcommunity.org/wiki/CloudComputing:Incidents_Database
OWASP
32
Domain 11 - Application Security
Evaluate current practices and standards to the
different Cloud platform
 In IaaS
The same precautions used to hardens hosts running
in the DMZ should be applied to the virtual images
Build custom operating system and application
platform images that only have the capabilities
necessary to support the application stack.
Design in controls to secure Inter-host
communications
OWASP
33
Domain 11 -Paas & Iaas Platform Impacts
Secret keys are used to identify a valid account.
Use best practices and standards for handling
key material
Ensure sensitive information will not leak during
processing. Filtering and masking is needed to
handle exception and debugging logging,
because the storage of is shared and managed
by an outside party
Network and Enterprise Service Bus will be
shared. Application’s assumptions of trust be reevaluated
OWASP
34
SLDC Impacts
Similar to operating an application at a Managed
Service Provider, but Cloud may have a limited
duration of persistent data
Application’s Production and parts of Test
environments run with different trust
assumptions
OWASP
35
Domain 11 - PaaS Application Security
Integration & Middleware API’s application
building blocks on top of IaaS
Constraints on what services the application can
request of the operating system.
Environment may limit access to well defined parts of
the file system for multi-tenants
The body of knowledge of Web-based and nTier application vulnerabilities and mitigation has
not yet developed for PaaS environments
OWASP
36
Domain 11 - SaaS Application Security
Applications can be customized by adding code
extensions
Data exchanged through the SaaS’s external
API’s are subject to the security policy and
standards for any type of external data
exchange
OWASP
37
SaaS SDLC
Must trust that the vendor’s development
lifecycle is a secure as the enterprise’s
Should assume that malicious actors will react
ruthlessly to examine any exposed code, just as
JavaScript, Flash and others have been attacked
OWASP
38
Microsoft’s Global Foundation Services
Security Development Lifecycle
“Security Auditing and Reporting is provided via logs generated by
perimeter firewalls, intrusion prevention systems, and network devices
are collected centrally via the SYSLOG protocol and stored as files.
Cryptographic hash is generated on the file and stored along with
relevant file statistics in the same database.
Once hashed, the individual log files are compressed and stored on
redundant file archive servers.
Customized management packs created for Microsoft Operations
Manager (MOM) and Microsoft System Center Operations Manager
provide real-time alerting and health monitoring”
http://www.globalfoundationservices.com/security/documents/SecuringtheMSCloudMay09.pdf
OWASP
39
Domain 12 -Encryption and Key Management
Core mechanism to secure the Cloud is through
strong encryption with key management.
Unencrypted data in the Cloud should be
considered lost.
Create a chain of separation and chain of
custody by separating the data and the keys.
No single entity should be able to do everything.
OWASP
40
Domain 13 -Identity Management
Starting point is enabling Single Sign On in your
own enterprise applications
Identity as a Service solutions may simplify
complexities
ID service will become another Cloud provider to
manage
OWASP
41
Domain 13 -Identity and Access Management
 Robust federated identity management capability needed
Architecture & systems
User and access lifecycle management
Audit & compliance
 Critical to ask Cloud provider their support of federation
standards, many are immature in support of SAML, WSFederation and Liberty ID-FF federation standards
 Advocate XACML compliant entitlement management;
avoid authorization proprietary to the cloud provider
OWASP
42
Domain 14 – Storage, Confidentiality, Integrity,
Availability
Cloud provider should be utilizing strong storage
encryption that renders data unreadable when
storage is recycled, disposed of, or accessed by
any means outside of authorized applications.
Concerns on layers of abstraction potentially
hiding a storage subsystem
Data access subsystem (e.g., grid storage system)
should not copy private cloud data into the public
cloud
Ramifications of storage in a foreign governing
entity
OWASP
43
Domain 14 - Storage Management
Understand how encryption is managed for
multi-tenants
Granular encryption policies supported by
multiple keys per customer to limit the scope of
breaches
OWASP
44
Group feedback/discussions
 Domain 4 - Co-mingling of data could result in a
subpoena revealing unencrypted data, with potential
unauthorized access given to a competitor.
 Domain 5 - Legal complexities occur as is needed under
PCI standards passing onto their subcontractors the
same obligation to safeguard data and requirements that
to ensure these mandates are fulfilled. There are
concerns raised by companies claiming compliance. In
one instance a company indicated compliance to
PCI/DSS, but the findings were credit card transactions
being redirected to an outside third party processor.
OWASP
45
Group feedback/discussions
 Domain 11 - The Saam, ATAM and CIMM and other
existing best practices in mitigating risks early in
software development cycle should be used early.
Gather business and user requirements and document
cloud architectural and design approaches. The
movement to a cloud platform provides new challenges
to be addressed in converting applications to new
environments.
 We caution that software design reviews, checklists and
certifications maybe limited by the knowledge, guidance,
variances in participation, pressure for conformance and
differences perceived of compliance.
OWASP
46
Group feedback/discussions
Domain 14 - Discussed a finding of a private
cloud service that using a process of unencrypting data during processing. The
provider was placing backups on same physical
storage space as used for production.
OWASP
47