This document discusses security challenges with enterprise applications in cloud environments. It notes that traditional security controls are lost with different cloud layers and that visibility and understanding risks are important. The document outlines the threat lifecycle and how the landscape is changing. It argues that establishing baselines, choosing compensating controls, and incident detection and response are needed. Specific challenges with encryption, single sign-on, and application monitoring in cloud are discussed. The key takeaways are that cloud security problems are multifaceted and that visibility and action are important pillars across the threat lifecycle.

1. Reasoning About Enterprise Application
Security in a Cloudy World
@Zulfikar_Ramzan / CTO / www.elastica.net

2. THREAT LIFECYCLE
Firewalls, NGFW IDS/IPS, AV, AMP Forensics, IR Tools
Rethinking Security: Being Threat Centric
BEFORE
Controls
DURING
Identification
AFTER
Response

3. Key Cybersecurity Hurdles
Proliferation
of New
Technologies
Evolution of
Threat
Landscape
Increase of
Complexity

4. GRC: What Matters?
Compliance: Highly complex, one-size fits all, dynamic.
What do you ultimately care about: Visibility. Have to
understand risks we are trying to mitigate.

5. Traditional Security Operation Center (SOC)

6. Outside the Visibility of Existing SOC
Unmonitored
activities
Outside
SOC reach

7. Key Enterprise SaaS Security Challenges
Make it
work vs.
Approval
No
Visibility
App /
Action
No Events
for SEIM
to
Consume

8. Application Security Over Time
OWASP Top 10 – 2010 (old) OWASP Top 10 – 2013 (New)
2010-A1 – Injection 2013-A1 – Injection
2010-A2 – Cross Site Scripting (XSS) 2013-A2 – Broken Authentication and Session Management
2010-A3 – Broken Authentication and Session Management 2013-A3 – Cross Site Scripting (XSS)
2010-A4 – Insecure Direct Object References 2013-A4 – Insecure Direct Object References
2010-A5 – Cross Site Request Forgery (CSRF) 2013-A5 – Security Misconfiguration
2010-A6 – Security Misconfiguration 2013-A6 – Sensitive Data Exposure
2010-A7 – Insecure Cryptographic Storage 2013-A7 – Missing Function Level Access Control
2010-A8 – Failure to Restrict URL Access 2013-A8 – Cross-Site Request Forgery (CSRF)
2010-A9 – Insufficient Transport Layer Protection 2013-A9 – Using Known Vulnerable Components (NEW)
2010-A10 – Unvalidated Redirects and Forwards (NEW) 2013-A10 – Unvalidated Redirects and Forwards
3 Primary Changes:  Merged: 2010-A7 and 2010-A9 -> 2013-A6
 Added New 2013-A9: Using Known Vulnerable
Components
 2010-A8 broadened to 2013-A7

9. Where Controls are Lost
9
Layer On Prem IaaS PaaS SaaS
App/Data
Middleware
OS
Virtual
Physical

10. ESTABLISH SECURITY BASELINE
CHOOSE AND APPLY
COMPENSTATING CONTROLS
Gartner Public Cloud Management Lifecycle
INCIDENT DETECTION INCIDENT RESPONSE MANAGEMENT

11. Establish a Security Baseline
Baseline: Need to understand where you are right now
Basic Discovery: Table stakes (any Firewall / NGFW can do it)
Interesting challenge: Audit (what’s enterprise ready for you
specifically?)
ADMINISTRATIVE INFORMATIONAL
BUSINESS
ACCESS
DATA
SERVICE
COMPLIANCE

12. Choose and Apply Compensating Controls
12
VISIBILITY
ACTION
User Service ObjectAction
ACTION
VISIBILITY

13. Incident Detection
13
Policies and controls identify specific tangible behaviors. But
what about sophisticated threats that fall outside their scope?
SIGNATURES HEURISTICS
BEHAVIOR-
BASED
ANALYSIS
ANOMALY
DETECTION

14. Incident Response Management
14
Attackers are constantly evolving and adapting. Threats will
eventually get through. The question is no longer “What if?”,
but “What now?”
INFORMATION
ASYMMETRY
FAVORS
ATTACKERS
PRE-THINK
RESPONSE;
HARD TO DO
AFTER THE
FACT
INTEGRATE;
DON’T BOLT
ON

15. The SaaS Security Landscape
ENCRYPTION
SINGLE SIGN ON
SAAS APPLICATION MONITORING AND CONTROL

16. ENCRYPTION: PROBLEM OR PANACEA?
ENCRYPTION
ENCRYPT
IN TRANSIT
ENCRYPT
AT REST
ENCRYPT
IN USE (?)
We don’t leverage
SaaS Apps only for
STORAGE
Crypto is a GREAT
TOOL; but great
tools can be greatly
MISUSED

17. SINGLE SIGN-ON: PANACEA?
PHISHING
MALWARE
DATA
BREACH
MALICIOUS
INSIDER
WELL
MEANING
INSIDER
EASE OF
MANAGEMENT
CONTROL
THE FRONT
DOOR

18. Cloud Services Security Problem
18
Visibility Security Compliance Risk Governance

19. Thank you
TAKEAWAYS
SaaS Security and GRC Problem Multifaceted
Consider full threat lifecycle: Before, During,
After
Visibility and Action are Key Pillars
@zulfikar_ramzan @ElasticaInc