The document outlines a 12 step guide to securing cloud deployments using open source tools. It discusses responsibilities in securing infrastructure, protecting networks using tools like VPCs and firewalls, hardening machine images, encrypting data at rest and in transit, patching and access control for instances, application security best practices, auditing and monitoring, validation testing, automating security processes, and updating security policies. The steps provide a continuous process to improve cloud security.

1. 12 Steps to Cloud Security
A guide to securing your cloud deployment using open
source tools
Vishnu Vettrivel
Principal Engineering Lead, Atigeo
@cloudronin

2. Step 1: Know your responsibility
• Cloud providers are
responsible for some parts
of the infrastructure stack.
• The other parts of the
security stack is your
responsibility.
• You are usually
responsible for Application
Security, Policies and
configuration, machine
images etc.

3. Step 2. Protect your Network
• Use Defense in Depth and
services like:
• Virtual Private Clouds
• Network ACLs
• Routing rules
• Proxy Servers
• NAT
• Firewalls
• Application
• Host
• Network

4. Step 3: Protect your Machine Images
• Be sure your harden your
images first
• Turn off insecure ports
and services
• Change default
passwords.
• Install AV Software
• Consider using a Baseline

5. Step 4: Protect your Data at Rest
• Know the different Cloud
storage mechanisms and
their Security implications.
• De-Identify when possible
• Understand the choices of
Encryption primitives like
key strength and Ciphers
types.
• Don’t forget Secure
Archival and Disposal of
Data.

6. Step 5: Protect your Data in Transit
• Use secure application
protocols whenever
possible.
• TLS
• SSH
• RDP
• Securely Tunnel traffic
when not possible:
• IPSEC
• SSL VPN
• SSH
• Use a Key Management
System

7. Step 6: Protect and Patch your
Instances
• Define and Categorize
Cloud based assets
• Watch out for Zero Days
• Classify Risk
• Patch Affected Systems
• Use a Configuration
Management System

8. Step 7: Protect Access to your
Instances
• Create Individual User
accounts
• Use Role based Access
• Grant Least privilege
based on Business Need
• Enable Multi-Factor
Authentication for
Privileged Users
• Audit all User Activity
• Federate all User Access
through a Directory
Service

9. Step 8: Protect your Applications
• Implement AAA
(Authentication,
Authorization and
Auditing).
• Familiarize yourself with
the OWASP Top 10
Application Security
Flaws.
• Follow Secure
Development Best
Practices.

10. Step 9: Audit and Monitor your Cloud
• Gather monitoring data at
a secure and separate
Network
• Establish baselines
• Monitor all layers and
Protocols
• Deploy the IDS behind the
Network firewall
• Fine tune alert levels
• Use redundant alerting
channels

11. Step 10: Validate your Protection
• Test Network,
Infrastructure and
Applications separately for
Security Vulnerabilities
periodically
• Check for Input validation,
session manipulation,
authentication and
information leakage
• Use 3rd
Party Tools where
possible

12. Step 11: Automate Everything
• Use a Configuration
Management System
• Employ Continuous
Integration and Delivery.
• Automated Provisioning
helps:
• Documentation
• BCP/DR Planning
• Change Management
• Treat Infrastructure as
Code.

13. Step 12: Update your Security Policy
•Define security scope and
boundaries
•Select proper risk
Assessment Methodology.
•Align policies to Contractual
Obligations
•Choose a suitable Security
control framework

14. Step 13 ? There is no magic bullet!
• Some things are easier
and some are harder in
the Cloud
• Conventional security and
compliance concepts still
apply in the cloud.
• The 12 Steps will get your
started on your continuous
security improvement
cycle

15. Resources
 https://s3.amazonaws.com/awsmedia/AWS_Security_Best_Practices.pdf
 http://checklists.nist.gov/
 https://www.us-cert.gov/
 https://www.owasp.org/index.php/Top_10_2013-Top_10
 https://www.cert.org/incident-management/
 http://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPractices.html
 https://en.wikipedia.org/wiki/Penetration_test
 http://www.drdobbs.com/architecture-and-design/top-10-practices-for-
effective-devops/240149363
 https://en.wikipedia.org/wiki/Information_security_management_system

16. Thank You
Vishnu Vettrivel
Principal Engineering Lead, Atigeo
@cloudronin
@atigeo xpatterns.com
linkedin.com/
company/atigeo