Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Security in the Cloud


Published on

"Security the Cloud" - webinar slides on 27th Oct 2011

Published in: Technology, Business
  • Be the first to comment

Security in the Cloud

  1. 1. Prabath  Siriwardena  –  Software  Architect,  WSO2  
  2. 2. WHY  ?  
  3. 3. Cloud  Computing  
  4. 4. Cloud  Computing  
  5. 5. As  a  Service  ?  
  6. 6. As  a  Service  ?  Pay  per  use   Resource  Sharing  Self  service  provisioning   Unlimited  Resource  
  7. 7. •  In  public   –  IaaS,  PaaS,  SaaS  available  on  the  Internet   –  Use  one  of  the  cloud  service  providers   –  Information  is  stored  and  managed  by  provider  under  SLA  •  In  Private   –  Have  a  cloud,  in-­‐house   –  IaaS  provides  by  hardware  on  your  data  centers   –  PaaS  running  on  your  IaaS   –  SaaS  executing  on  your  PaaS  •  Or  use  both   –  Hybrid  Cloud  
  8. 8. Enterprise  IT  in  2010  
  9. 9. Enterprise  IT  in  2015+  
  10. 10. What  do  you  expect  from  a  platform  ?  
  11. 11. •  Public  Cloud   –  Fast  time  to  market   –  Makes  it  easier  to  write  scalable  code  •  Private  Cloud   –  Give  each  team  their  own  instant  infrastructure   –  Govern  centrally  but  code  and  deploy  by  team   –  Automated  governance,  registry,  identity   –  Instant  BAM  
  12. 12. •  Distributed  /  Dynamically  Wired  (works  properly  in  the  cloud)   –  Finds  services  across  applications     –  Reuse  services  from  other  departments  e.g.  People  information  required  by  all  of  Finance,   Engineering  and  Sales  •  Elastic  (uses  the  cloud  efficiently)   –  Scales  up  and  down  as  needed   –  Some  departments  might  want  varying  resources  with  varying  bandwidth  with  varying   priority  •  Multi-­‐tenant  (only  costs  when  you  use  it)   –  Virtual  isolated  instances  to  facilitate  isolation  between  departments  etc.   –  e.g.  Sales  vs.  Finance  tenants.  Finance  want  complete  isolation  for  some  sensitive  services  •  Self-­‐service  (in  the  hands  of  users)   –  De-­‐centralized  creation  and  management  of  tenants   –  No  need  to  come  to  IT  department  to  gain  access  –  served  via  portal  –  no  need  to  be  on  the   queue  or  waiting  list  •  Granularly  Billed  and  Metered  (pay  for  just  what  you  use)   –  Allocate  costs  to  exactly  who  uses  them   –  Bill  and  cost  various  departments  per  use     –  Get  rid  of  the  situations  where  unused  computing  assets  lying  in  one  department  while  the   other  departments  are  starving  for  the  same  •  Incrementally  Deployed  and  Tested  (supports  seamless  live  upgrade)   –  Not  disrupt  other  operations  
  13. 13. ProviderIAAS   N   F   Application   N   F   Middleware   N   F   Guest  OS   F   N   Hypervisor   F   N   Storage   F   N   Hardware   Organization F   N   Network  
  14. 14. ProviderPAAS   M   L   Application   M   L   Middleware   F   N   Guest  OS   F   N   Hypervisor   F   N   Storage   F   N   Hardware   Organization F   N   Network  
  15. 15. ProviderSAAS   M   L   Application   F   N   Middleware   F   N   Guest  OS   F   N   Hypervisor   F   N   Storage   F   N   Hardware   Organization F   N   Network  
  16. 16. IaaS   PaaS   SaaS   Data   Organization   Organization   Organization  Applications   Organization   Shared   Service  Provider   Systems   Service  Provider   Service  Provider   Service  Provider   Storage   Service  Provider   Service  Provider   Service  Provider   Network   Service  Provider   Service  Provider   Service  Provider  
  17. 17. SAAS  More  Control   PAAS   IAAS  
  18. 18. Private   Public   Compliance   Organization   Service  Provider   Governance   Organization   Service  Provider   Security   Organization   Service  Provider   Operations   Organization   Service  Provider   Risk   Organization   Shared   Cloud  Owner   Organization   Service  Provider    or  leased  Use  limited  to     Organization   Public  
  19. 19. Public  Ownership   Hybrid   Private  
  20. 20. Multi-­‐tenancy  
  21. 21. •  Can  be  used  to  give  departments  their  own   PaaS  world  to  operate  in  •  Yet  all  share  same  hardware  resources   –  Not  all  departments  need  resources  at  the  same  time   –  Really  pay  per  use   –  Opportunity  to  unify    departmental  level  small  server  pools    •  Drastically  reduce  admin/management  costs   –  One  software  installation  to  maintain  •  Use  differentiated  QoS  
  22. 22. Multi-­‐tenancy  ¡  Three  possible  ways   §  Machine  per  tenant   §  VM  per  tenant   §  Share  machine/VM  across  tenants  ¡  Challenges   §  Data  isolation   §  Logic  isolation     §  Security  
  23. 23. Data  Isolation  –  Separated  DB   Multi-­‐tenancy  
  24. 24. Data  Isolation  –  Shared  DB  /  Separate  Schema   Multi-­‐tenancy  
  25. 25. Data  Isolation  –  Shared  DB  /  Shared  Schema   Multi-­‐tenancy  
  26. 26. Data  Access  -­‐  Security  Patterns  Trusted  Database  Connections  
  27. 27. Data  Access  -­‐  Security  Patterns  Trusted  Database  Connections  
  28. 28. Data  Access  -­‐  Security  Patterns  Trusted  Database  Connections  
  29. 29. Data  Access  -­‐  Security  Patterns  Secure  Database  Tables   GRANT SELECT, UPDATE, INSERT, DELETE ON [TableName] FOR [UserName]
  30. 30. Data  Access  -­‐  Security  Patterns  Tenant  View  Filter   CREATE  VIEW  TenantEmployees  AS     SELECT  *  FROM  Employees  WHERE  TenantID  =   SUSER_SID()
  31. 31. •  Data  Confidentiality/Integrity/Availability  •  Data  Lineage  •  Data  Provenance  •  Data  Remanence  
  32. 32.                      Data  Confidentiality/Integrity/Availability   Storage   Processing   Transmission   Confidentiality   Symmetric   Homomorphic   SSL   Encryption   Encryption   Integrity   MAC   Homomorphic   SSL   Encryption   Availability   Redundancy   Redundancy   Redundancy  
  33. 33. cloud  security     forxg  vhfxulwb    Homomorphic  Encryption   cloud   forxg   security     vhfxulwb     cloud   security     forxg   vhfxulwb    
  34. 34. Vendor   CVE   KVM   32   QEMU   23   VMWare   126   XEN   86  •  VM  Escape  (Host  code  execution)  •  Guest  code  execution  with  privilege  
  35. 35. •  Identity  Management  •  Access  Management  •  Key  Management  •  System  &  Network  Auditing  •  Security  Monitoring  •  Security  Testing  &  Vulnerability  Remediation  •  System  &  Network  Controls  
  36. 36. •  Controls  over  identity  information  Identity  Management   •  Strong  Identity  Management  system  for  cloud   personnel   •  Large  scale  needs  for  authenticating  cloud   tenants  and  users   •  Federated  Identity   •  Audits  for  legal  activities   •  Identity  Recycle?   •  Means  to  verify  assertions  of  identity  by  cloud   provider  personnel  
  37. 37. •  Cloud  personnel  shall  have  restricted  access  to  Access  Management   the  customer  data   •  Multifactor  authentication  for  highly  privileged   operations   •  Large  scale  needs  for  authenticating  cloud   tenants  and  users   •  Least  privileged  principal  and  RBAC   •  White-­‐listed  IPs  for  remote  access  by  cloud   personnel    
  38. 38. •  Encryption  the  key  to  protect  data  in  transit  and   at  rest  Key  Management   •  All  keys  secured  properly   •  Effective  procedures  to  recover  from   compromised  keys   •  Effective  procedures  for  key  revocation      
  39. 39. System  &  Network  Auditing   •  All  security  related  events  must  be  recorded  with   all  relevant  information   •  Generated  audit  events  must  be  logged  in  near   real-­‐time  manner   •  Integrity  &  confidentiality  of  audit  logs  should  be   protected   •  Audit  logs  needs  to  be  securely  archived    
  40. 40. •  Generation  of  alerts  in  recognition  of  a  critical  Security  Monitoring   security  breach   •  Delivery  of  security  alerts  in  deferent  means   securely   •  Cloud  wide  intrusion  and  anomaly  detection   •  Periodic  checks  to  make  sure  monitoring  system   runs  healthy    
  41. 41. •  Well  defined  set  of  security  test  cases   •  Separate  environments  for  development,  Security  Testing   testing,  staging  and  production   •  Patch  management  
  42. 42. System  &  Network    Controls   •  Should  be  implemented  for  infrastructure   systems   •  Network  isolation  in  between  different  functional   areas  in  the  cloud   •  Assure  the  integrity  of  OSes,  VM  images  and   infrastructure  applications   •  Isolation  between  different  VMs    
  43. 43. •  Abuse  &  nefarious  use  of  cloud  computing   •  Password/key  cracking,  DDOS,  CAPTCH   solving  farms,  building  rainbow  tables  •  Insecure  interfaces  and  APIs  •  Malicious  insiders  •  Shared  technology  issues  •  Data  loss  and  leakage  •  Account  or  service  hijacking  •  Unknown  risk  profile