Secure Cloud Infrastructure Secure, Compliant, Highest Performing Scott Lynn & Darren J Moffat Solaris Core Technologies January 2016

2. Copyright © 2015, Oracle and/or its affiliates. All rights reserved. |
Secure Cloud Infrastructure
Secure, Compliant, Highest Performing
Scott Lynn & Darren J Moffat
Solaris Core Technologies
January 2016

3. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
200M
Experian
Mar ‘14
150M
eBay
May ‘14
22M
Education
July ‘14
SA Banks
OCT ‘13
Credit
Cards
150M + Code
Adobe Oct ‘13
98M
Target
Dec‘13
20M
Credit Bureau
12M
Telecom
Jan ‘14
56M
Home Depot
Sep ‘14
Immigration
June’14
Personal
Records
76M
JPMC
Oct ‘14
The Age of Mega Breaches
3Copyright © 2015, Oracle and/or its affiliates. All rights reserved. |
53M
Sony
Dec ‘14
227M
80M
Anthem
Feb ‘15

4. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Social Attacks
Command &
Control
Brute Force
Hacking
Malware
SQL Injection
Attack
Stolen Credentials
Typical Attack Vectors
4Copyright © 2015, Oracle and/or its affiliates. All rights reserved. |

5. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
COMMAND
SERVER
ATTACKER
DOWNLOADED
MALWARE
PHISHING
ATTACK
XSS OR SQL
INJECTION
ATTACK
Anatomy of an Attack – Starts with Phishing

6. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
ESTABLISH MULTIPLE
BACKDOORS
DUMPING PASSWORDS
DOMAIN CONTROLLER
GATHERING
DATA
Anatomy of an Attack – Establishes a Foothold

7. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
EXFILTRATE DATA
VIA STAGING SERVER
ANYWHERE
IN THE WORLD
Anatomy of an Attack – Exfiltrates Data, Covers Tracks.

8. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Risks are Outside; Vulnerabilities Within
8

9. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Threat #1:Stolen privileged user credentials
People
9

10. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
100%
Of investigated data breaches
involved stolen credentials
10
Source: Mandiant Threat Report, 2015

11. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |Oracle Corporation - Confidential 11Oracle Company Confidential – Shared Under Terms of OPN NDA 11
How the Sony Breach Changed Security

12. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Oracle Solaris Mitigates Credential Abuse/Misuse
Delegation
Activity-based user access
Time-Based Control
Control when users can
perform actions
Remote Auditing,
Logging and Alerting
Audit entries sent to secure
server; can’t be tampered
12

13. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Threat #2:Unpatched and misconfigured
systems
Platform
13

14. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
99.9%Of the exploited vulnerabilities
were compromised more than
a year after the CVE was
published
14
Source: Verizon Data Breach Investigations Report, 2015

15. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Exploited Vulnerabilities Compromised
15
74%
OF ORGANIZATIONS
TAKE 3 MONTHS+
TO PATCH
Source: Verizon Data Breach Investigations Report, 2015; IIOUG Data Security Survey, 2014

16. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
The age of
“If it ain’t broke, don’t fix it,”
is over!
16

17. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | 17
It’s important to patch quickly and often…
Patching on other systems takes significant time and money.
Firmware
Virtualization
OS
Database
Application Other Systems:
• Different tools
• Different patches
• Possible conflicts
• Downtimes
• Manual Rollback

18. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Dramatically Simpler Lifecycle Management
Solving patching and configuration vulnerabilities.
1818
Firmware
Virtualization
OS
Database
Application
Oracle Solaris:
• Secure
• Pre-tested
• Single-source
patching.
1-Step Security Patching1-Step Rollback

19. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Simple Administration
Major Financial Customer’s Experiences Patching Oracle Solaris vs. Red Hat
19
Red Hat
Enterprise Linux
Solaris 11
16X
Servers/Admin
MANAGE
4000300020001000
250
4000
Machines/Administrator
1-Step Security Patching

20. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Simple & Tailorable Compliance Reporting
20

21. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Stop Malware Before It Gets In
Immutable Systems and Virtual
Machines
– Can’t establish a foothold
– Prevent administrator mistakes
– Update even though it’s unwritable
by users and applications
Tamper Evident Software
– Firmware to Applications
– Install only known, trusted software
– Not signed; won’t install
– Verified Boot
21

22. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Secure Lifecycle Done Right
Secure
• Immutable Systems and Virtual
Machines
• Tamper Evident Software
• Verified Boot
Simple
• 1-step patching
• Integrated snapshots
• 1-step rollback
Effective
• Tested together
• From firmware to
applications
22
Firmware(
Virtualiza.on(
OS(
Database(
Applica.on(

23. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Large City in Germany
Automatic Patching
23

24. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Threat #3:Direct data access
Data
24

25. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
$194*
The average cost per record
stolen in a data breach.
25
Source: Symantec http://www.databreachcalculator.com/GetStarted.aspx

26. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
52%
34%
11%
4%
Database
Network
Application
Middleware
IT Layers Most Vulnerable To Attacks
67%
15%
15%
3%
Database
Network
Application
Middleware
Allocation of Resources To Secure IT Layer
Source: CSO Online MarketPulse, 2013
Network Security is Not Enough: Protect the Data!

27. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Only Platform to Protect Applications in Memory
Silicon Secured Memory
• First ever hardware based memory
protection
• Stops attackers from accessing
application memory inappropriately
• Always on without compromise
• Improved efficiency & more secure
and higher available applications
• Compatible with current applications
27
Application Memory
Pointer “B”
GO
M7 Processor
Pointer “A”
GO
Pointer “Y”

28. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
• No performance loss
• Automatically accelerates Java, Oracle
Database, OpenSSL/TLS, and custom
applications
• Meet compliance with high performance
disk encryption
• SPARC M7 Silicon Secured Memory
• Integrates with Oracle Key Manager
28
Affordably
Encrypt Everything, Everywhere, All the Time
Applications
Java
Oracle Database
Operating
System Utilities
Storage
Virtualization
Firmware
Protected at rest, in motion, and in memory

29. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
New Exploit mitigation features: sxadm(1M)
NXSTACK
Non Executable Stack
Been around since Solaris 2.6 but now controlled via sxadm(1M)
Now on by default
Tag at build time with: -z nxstack=enable|disable
NXHEAP
Non Executable Heap
New in 11.3, not enabled by default since there are a small number of
legitimate uses for an executable HEAP.
Tag at build time with: -z nxheap=enable|disable
ASLR
Address Space Layout
Randomisation
Added 11.1
sxadm get -p Parsable status output
sxadm delcust Go back to vendor delivered defaults
Install Time Policy svccfg extract security-extensions
29

30. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Modernising Firewall in Oracle Solaris 11.3
• OpenBSD PF firewall ported and integrated into Oracle Solaris
• Choose either IPfilter or PF – only one can be active
– pkg:/network/firewall
– pkg:/network/firewall/ftp-proxy
– pkg:/network/firewall/pflog
• Rules in pf.conf(4)
• Logging is via new dladm(1M) controlled links
• SMF svc:/network/firewall
• Start Transition: IPfilter is now Obsolete & may be removed in a future
release
30

31. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Modernising SSH
• Oracle Solaris 9 added first OpenSSH version, become forked SunSSH over time.
• OpenSSH (+ some patches) in Oracle Solaris 11.3
– GSS credential storage
– PAM Service Name per SSH userauth method as per SunSSH (PAM can’t be disabled)
– DisableBanneroption for ssh client
• Install either SunSSH or OpenSSH or both
– only one can be default ssh(1) and sshd(1M) , either or both can be installed
– Set default via pkg mediator when both installed
• SMF svc:/network/openssh
• Start Transition: SunSSH is now Obsolete & may be removed in a future release
31

32. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Oracle Security Inside and Out
Layers of the Stack
Oracle Corporation - Confidential 32
S EC UR I TY
S EC UR I TY
S EC UR I TY
S EC UR I TY
S EC UR I TY
S EC UR I TY
S E C U R I T Y
Governance Risk & Compliance
Access & Certification Review, Anomaly Detection,
User Provisioning, Entitlements Management
Mobile Security, Privileged Users
Directory Services, Identity Governance
Entitlements Management, Access Management
Encryption, Masking, Redaction, Key Management
Privileged User Control, Big Data Security, Secure Config
Application + User Sandboxing, Delegated Admin
Anti-malware system, Data + Network Protection
Compliance Reporting, Secured App Lifecycle
Secure Live Migration
Immutable Zones
Independent Control Plane
Cryptographic Acceleration
Application Data Integrity
Verified Boot
Disk Encryption,
Secured Backup,
Enterprise Key Management
SPARC/Solaris

33. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | 33
BUILT-IN SECURITY INSIDE AND OUT SAVES
TIME, MONEY AND REDUCES RISK
Mitigates credential
abuse/misuse
Secure lifecycle done right
Encrypt everything, everywhere,
all the time

34. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Q&A
34

35. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. | 35