Join Nebula's Director of Security Research, Dr. Bryan Payne, as he discusses why deploying a secure private cloud matters and how to mitigate and protect against malicious activities occurring on your network. During this webinar Bryan will provide insight on: * Why security even matters in a private cloud * Steps to deploy a secure private cloud * Mitigation strategies to prevent attacks

1. © 2015 Nebula, Inc. All rights reserved.
(cloud) Computing for the Enterprise
Private Cloud Security
Practical Solutions for a Challenging Problem
Bryan D. Payne
March 18, 2015

2. © 2015 Nebula, Inc. All rights reserved.
“Why
Security
Ma/ers
In
A
Private
Cloud”

3. © 2015 Nebula, Inc. All rights reserved.
Public
Private

4. © 2015 Nebula, Inc. All rights reserved.
Private
Network
Internet
Storage
Email
LDAP
NTP
VLAN
Tunnels
SIEM
DNS
PKI

5. © 2015 Nebula, Inc. All rights reserved.
Storage
Email
LDAP
NTP
VLAN
Tunnels
SIEM
DNS
PKI

6. © 2015 Nebula, Inc. All rights reserved.
Storage
Email
LDAP
NTP
VLAN
Tunnels
SIEM
DNS
PKI
1
2
3

7. © 2015 Nebula, Inc. All rights reserved.
Intelligence
Services
Serious
Organized
Crime
Highly
Capable
Groups
MoFvated
Individuals
Script
Kiddies
Likelihood
of
A,ack
Sophis2ca2on
&
Likelihood
of
Exploita2on
Source:
OpenStack
Security
Guide

8. © 2015 Nebula, Inc. All rights reserved.
Compromise
User
System
VM
Breakout
API
Vuln
Dashboard
Vuln
Access
Cloud
As
Admin
Access
Cloud
As
Outsider
Access
Cloud
As
User
View
Other
Instances
Abuse
Cloud
Resources
View
Data
In
Cloud
View
Data
In
Cloud
Modify
LDAP
View
External
Data
Follow
VLANs
into
Corp
Net
Spear
Phishing
IniMal
Access
Touch
Cloud
Exploit
Cloud
Exploit
Enterprise
Compromise
Instance

9. © 2015 Nebula, Inc. All rights reserved.
Known
hardware
and
soIware
OrchestraFon
+
=
Security
Opportunity

10. © 2015 Nebula, Inc. All rights reserved.
API Endpoints
Web Dashboard
Compute
Node
Compute
Node
Storage
Node
Storage
Node
Guest
ManagementData
Management and Control Plane Services
Cloud Users / Administrators
Cloud Operators
Instance
Instance
Instance
Instance
External

11. © 2015 Nebula, Inc. All rights reserved.
OpenStack
Projects
“The
Glue”

12. © 2015 Nebula, Inc. All rights reserved.
Cloud
A/ack
Vectors
MiFgaFon
Strategies
API
Endpoints
Service
hardening,
mandatory
access
controls,
code
audits
Web
Dashboard
CSP,
expected
domains,
HTTPS,
HSTS,
allowed
referrers
InformaMon
Leakage
SSL/TLS,
disable
memory
dedup,
randomize
resource
assign
VM
Breakout
Service
hardening,
mandatory
access
controls,
code
audits
Hardware
Sharing
Avoid
bare
metal
instances,
avoid
device
pass-­‐through
Default
Images
Secure
and
maintain
default
images
Secondary
AYacks
Least
priv,
mandatory
access
controls,
SSL/TLS,
strong
auth

13. © 2015 Nebula, Inc. All rights reserved.
Threat: Information Leakage
• TLS for network services
– API endpoints
– Web dashboard
– Log feeds
– AD / LDAP
– External Storage
• Cross-VM attacks (timing, cache effects, etc)

14. © 2015 Nebula, Inc. All rights reserved.
Threat: VM Breakout
• Mandatory access controls
– SELinux + KVM (SVirt)
• Build hardening
– Remove unused device models from QEMU
– Compiler hardening flags
• General Node Hardening
– De-privilege node, with respect to cloud
– Boot + Runtime attestation, SELinux, etc

15. © 2015 Nebula, Inc. All rights reserved.
Threat: Control Plane Compromise
• Layers of Security
– Firewall (bi-directional on control plane)
– Limit propagation of sensitive data
– Unique secrets everywhere
– Audit network service interface bindings
– TLS, SELinux, boot + runtime attestation
• Primary Focus: Limit damage from a bad actor
on the control plane

16. © 2015 Nebula, Inc. All rights reserved.
Threat: Vulnerabilities Upstream
• Targeted security audits
– Work closely with OpenStack and Linux
communities
• Aggressive security update policies
– Cloud-specific triage process
– Be prepared to test and rollout quickly

17. © 2015 Nebula, Inc. All rights reserved.
Threat: Poor Entropy for Instances
• Mix entropy from multiple sources
– Hardware generated from multiple vendors
• Distribute securely / fairly
– Entropy stream distributed throughout cloud
– Available to all instances, using RNG Tools

18. © 2015 Nebula, Inc. All rights reserved.
Storage
Email
LDAP
NTP
VLAN
Tunnels
SIEM
DNS
PKI

19. © 2015 Nebula, Inc. All rights reserved.
Email:
bryan.payne@nebula.com
TwiYer:
@bdpsecurity