Take a leap in the past to better understand the present and discover our advice about how to make your cloud platforms secure ! Find out how we went from on-premise IT to the agility of today's cloud, and how it changed the many faces of IT security. Cloud Security Day - May 17th, 2018

1. A history and status of cloud security
Thibault Koechlin – Emile Heitor

2. Internalized
Information
System
2
1990 – 2018: 50 shades of hosting
00’s
IS moved to the
datacenter
10’s
IS on SaaS
2016
On premise
datacenters
90’s

3. EVERYTHING ON
PREMISE,
DAD’S IT
3
LEGACY: 1990 - 2000

4. • IT « controls » the servers
– Near to no industrialisation
– No patching, partner’s strenght merely ignored
– Local threats (floppies, co-workers, pirates)
– First Internet accesses, almost no filtering
4
Self-hosted

5. • Targeted attacks, infosec is not even a thing (phrack: 85)
• From the defense PoV, we were pretty much naked
5
Self-hosted

6. WHEN
HYBRIDIZATION
WAS NOT EVEN A
BUZZWORD YET
6
BUBBLES : 2000 - 2010

7. • Links on the rise, world is connecting fast
• Datacenters are slowly ruling the industry, but
– Low to no standardization & security
– Public infrastructure
– Clear text protocols
• Development methods
– Near to no versioning mechanisms
– Near to non existing code reviews
7
Internet is the worm

8. • The pivot: Internet is now part of the network
• From the attacker’s PoV, the era of memleaks has begun
• From the protection PoV, risk analysis early stages
8
First paradigm shift

9. VIRTUALIZATION
OPENS THE PATH
TO
INFRASTRUCTURE
AS CODE
9
DEMATERIALIZATION:
2010 - 2016

10. • Mature virtualization technologies but
– Increasing number of ghost machines
– Deployments are now available for everyone
– Wider security risks
– Expensive downtimes
• Even wider exposure
– OVH, Online, Hetzner: temporary that lasts
– Low costs mean more and more exposure
10
VMWare, Xen, KVM…

11. • Better infrastructure issues handling, but now emerges the DDoS threat
• Virtualization security is still not a read deal as blue / red pill attacks are
still technical fantasies
– XEN : 2003
– XEN sold to Citrix : 2007
– First XSA : 2011 (last XSA : 262)
11
Defensive maturity

12. • While SQLi exist from ~ 2000, this area has witnessed their rise
– Memleaks are less common
– Updates are (hpefully) available regularly
– Hardening solutions are getting robust
– « Web » vulnerabilities are far more accessible
• From days to hours to exploit
• Attacks are being more common as the surface grows ~
12
Attackers maturity

13. • IT security policies :
– Patching policy
– Actual audit
– Number of home made services increases the attack surface
• Having a WAF / IDS / IPS is still not a common practice
13
How to evaluate your partners

14. • Shift : VMs, VMs everywhere
• From the attacker PoV
– « OR 1=1 » era : Web security breaches are sadly common
– More trivial exploit creation
– Classic mafias entered the arena and are making big money with it
• On the defense side
– Intrusion threat is now taken seriously
– Virtual machines are often still ignored
14
Second paradigm shift

15. OPS IS A THING
FROM THE PAST!
15
AGILITY DRIVING
CHAOS: 2016 - NOW

16. 16
Who needs a sysadmin?

17. • Sane best practices
– Continuous integration
– Code repositories
– Orchestration & Industrialization
– Greater communities and cooperation
• Wrong ideas have landed
– No need for system experts anymore
– Thanks to disposable machines, no need for research and deep dive
• And also bad reflexes
– Million of ghost containers, thousands of images
– Low cost infrastructures, what about durability?
– New shadow-IT format: container being the new Schrödinger’s box
17
CI: container’s bright side

18. 18
But wait, there’s more!

19. • How reversible is my partner technology, how does it bound to a
particular SaaS or cloud provider?
• New technologies such as serverless give the illusion of isolation
– Access control is more important than ever
– Code reviews must be the norm
• Extra care to be bound to a particular solution : thus the importance of
your partner in your cloud journey!
19
Reversibility & Durability

20. 20
A new context
Pass****

21. • Availability
– No more control on maintenance activity
– Ephemeral platforms
– Auto-scaling: the partner must adapt to new methodologies
• Confidentiality
– What / where is my storage? Is it encrypted? Who has the keys?
– Are the rights to my assets regularly reviewed?
• Integrity
– Are the limits between user and group privileges tight enough? « We’ll use root as it’s
easier »
– MFA is not even a choice?
• Traceability
– Automated reporting?
– Recurring audits on rights and accesses (scout2, trusted advisor…)
21
How to evaluate my partner’s integrity?

22. DON’T
PANIC
22
SO WHAT?

23. Chemin du Dévent 7
1024 Ecublens, Switzerland
+41.21.625.6990
contact@net4all.ch
@Net4allCH