Security architecture best practices

SecurityArchitecture
Best Practices
for
SaaSApplications
24-March-2014

EII Customers & Project EngagementsAgendaInstructions
US | UK | BENELUX | ME | IND©1996-2015 Aspire Systems, Inc.
If you have any questions, please type them in the question tab located at
the top
We will provide answers during the Q&A session towards the end of
the webinar
Thanks for your participation and enjoy the session
Request all to take part in the survey that pops up
In case if you do not receive answers to your question today, you will
certainly receive answers via email shortly

EII Customers & Project EngagementsAgendaSpeakers
Janaki Jayachandran Jothi Rengarajan
Cloud Solutions Architect,
Aspire Systems
Principal Architect – SaaS Solutions,
Aspire Systems
Global technology services firm with core DNA of software engineering
Specific areas of expertise around Software Engineering, Enterprise
Solutions, Testing and Infrastructure & Application Support
Vertical focus among Independent Software Vendors and Retail, Distribution
& Consumer Products
1400+ employees; 100+ active customers
ISO 9001:2008 and ISO 27001 : 2005 certified
Presence across US, UK, Benelux, Middle East and India
Recognized five consecutive times as “Best Place to Work for” by
GPW Institute
About Aspire

EII Customers & Project Engagements
Shared Responsibility Model
Infrastructure and network related security risks and solutions
Security considerations in each of the architecture layers
Data isolation risks and mitigation plans
Overview of OWASP Security threats
AgendaAgenda

“…sometimes risk is compensated with opportunity…”

Why Digitize?EII Customers & Project EngagementsAgendaThe Ever-growing Security Threat
Unsafe websites detected per week
Jan 2007 – Mar 2015

Why Digitize?EII Customers & Project EngagementsAgendaThe Ever-growing Security Threat
Sites hosting malware detected per week
Jan 2007 – Mar 2015

Why Digitize?EII Customers & Project EngagementsAgendaNotorious Nine Cloud Threats
Source: CSA Notorious Nine Top Threats
Data Breaches Data loss
Account/Service
traffic hijacking
Insecure APIs Denial of Service
Malicious
Insiders
Abuse of cloud
services
Insufficient Due
Diligence
Shared
Technology

Why Digitize?EII Customers & Project EngagementsAgendaMajor Data Breach Incidents on Cloud
2015
• In February 2015, Anthem suffered a data breach of nearly 80 million records.
2014
• In August 2014, nearly 200 photographs of celebrities were posted to the image
board website 4chan.
• In September 2014, Home Depot suffered a data breach of 56 million credit card
numbers.
• In October 2014, Staples suffered a data breach of 1.16 million customer payment
cards.
2013
• In October 2013, Adobe Systems revealed that their corporate data base was hacked
and some 130 million user records were stolen.
• In late November to early December 2013, Target Corporation announced that data
from around 40 million credit and debit cards was stolen.

Why Digitize?EII Customers & Project EngagementsAgendaShared Responsibility Model
SaaS ISVs most commonly
use IaaS services to deliver
their solution.

Why Digitize?EII Customers & Project EngagementsAgendaShared Responsibility Model
• Compliance with customer
privacy and data protection
laws
• Management of
passwords/private keys
• IDM Management and access
control
• Application authentication
mechanism
• Management of OS, Security
patches, etc.
SaaS Provider - ISV
• Physical support of
infrastructure
• Physical infrastructure
security and availability
• OS Patch management and
hardening procedures
• Security platform
configuration, maintenance
and monitoring
• Increased ownership on
managed services
Cloud/Infra Provider

Why Digitize?EII Customers & Project EngagementsAgendaHow Safe Is Your Data?

Why Digitize?EII Customers & Project EngagementsAgendaHow safe is your data?
United States
United Kingdom
Canada
Australia
Germany
Source: Hogan Lovells White Paper on Governmental Access

Why Digitize?EII Customers & Project EngagementsAgendaHardware Level Risks
Virtualization
software used
Implement encryption best
practices at all
layers/services
Logically group
environments and restrict
access within them
Leverage Dedicated Tenancy
level groupings to minimize
risks
Define the protocol for accessing
keys

Why Digitize?EII Customers & Project EngagementsAgendaOS Security and Access
Patch management
Operating
System
Anti-Virus and Anti-
malware
OS Monitoring
Penetration testing and
vulnerability scanning
Data Redundancy

Why Digitize?EII Customers & Project EngagementsAgendaNetwork Security and Access
Compliance standards –
PCI, HIPPA, etc.
Network firewall Virtual Private Network
Single Sign On Inter region and intra
region transfer of data
Backup data storage
location and access
control

Why Digitize?EII Customers & Project EngagementsAgendaInternational Security Standards
 COBIT 5 – Controls and Assurance in the Cloud
 CSA Guides
 AICPA Service Organization Control (SOC) 1 Report
 AICPA/CICA Trust Services (SysTrust and WebTrust)
 ISO 2700x— Information security management system (ISMS)
 Cloud Security Matrix—By Cloud Security Alliance
 NIST SP 800-53—The NIST IT security controls standards, Health Information Trust Alliance
(HITRUST)
 BITS—The BITS Shared Assessment Program
 contains the Standardized Information Gathering (SIG) questionnaire and Agreed Upon
Procedures (AUP).
 European Network and Information Security Agency (ENISA)
 Cloud Computing—Benefits, Risks and Recommendations for Information Security.

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaSaaS Security Architecture Goals
Protection of information. It deals with the prevention and detection of
unauthorized actions and ensuring confidentiality, integrity of data.
SaaS Application Security Areas
• Database access control
• SaaS application access control
• Access control for third party applications/ Mobile layer which are integrated
to your SaaS application
• Data at transit security
• Data at rest security
• Audits

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaTenant Data Isolation
Design for a Hybrid Approach

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaTenant Data Isolation
DB
Interceptor
Service
Security
Scanner
Tenant Based
View Filter

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaACL Architecture

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaRole Based Access Control (RBAC) - Authentication
Custom Username
Password
Authentication
AD Integrated
SSO
Open ID
Authentication
Multi factor
authentication
Hybrid
Authentication
Support

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaRole Based Access Control (RBAC)
ACL For
Resources
Web
Endpoints
Rest
Endpoints
Actions
Data
Fields
Identity Management
ACL Metadata/ Definition
service
Decision Service
Enforcement Service

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaREST API Access Control
Identity
• Common
identity for an
application
• Granular User
Identity
Sources
• External
Applications
• Mobile
Applications
Mechanisms
• Access Keys
• OAUTH 2.0

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaOWASP – Top Threats
A1
Injection
A2
Broken Authentication and
Session Management (was
formerly A3)
A3
Cross-Site Scripting (XSS)
(was formerly A2)
A4
Insecure Direct Object
References
A5
Security Misconfiguration
(was formerly A6)
A6
Sensitive Data Exposure
(merged from former A7
Insecure Cryptographic
Storage and former A9
Insufficient Transport Layer
Protection)
A7
Missing Function Level
Access Control
(renamed/broadened from
former A8 Failure to
Restrict URL Access)
A8
Cross-Site Request Forgery
(CSRF) (was formerly A5)
A9
Using Known Vulnerable
Components (new but was
part of former A6 –
Security Misconfiguration)
A10
Unvalidated Redirects and
Forwards

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaSecurity Testing
Dynamic
Testing
Static
Testing
Security
Verification

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaData at Transit and Rest
Data at Rest
• Adopt Symmetric Key encryption
• Use Strong Keys
• Encrypt Your Encryption key
• Use Strong Key Stores
• Keep the Key Away From Data
Data at Transit
• Browser to web. This can be secured via https.
• Between web and services. This can also be secured using https in case of
rest services
• Direct access to application services - secured via https or you could use
message encoding. If it is soap based services use ws* security protocol
• Application to database – Servers such as oracle and MSSQL server
support

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaSecurity Audit
User Action Audit
• Audit all user actions
• Capture the entry URL, time, location details, browser details,
response status, any exceptions
• Provide analysis on the user actions
• Can be customized at application layer or can use the webserver
logs

Event Audit
• Audit positive events, more importantly
audit negative events
• Should cover,
• Who does the action?
• What action is performed?
• What is the context in which the
operation is performed?
• What time is the action performed?
• Audit details stored in a separate datastore
for better performance
• Real-time audit details – audit cache server

Transaction and Change Audit
• Transaction Audit
• Snapshot: Exact copy of the row stored in history tables
• More suitable if requests to access past data are more
• More data growth
• Change Audit
• Only the delta of the state change captured as part of change tables
• More suitable when changes need to be reported and past data are not required
much
• Used more for Security tracking purposes
• Easier to implement by using methods available out of the box in RDBMS such as CDC
for SQL server
• Asynchronous Mode : For better performance and if we wish that audit should not roll
back the transactions it is advisable to audit in a asynchronous thread.

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaAnti-Patterns
Let me summarize some of the anti-patterns in security of a SaaS
application. Unfortunately we also find it a lot in practice.
• Opening the DB access to tenants directly
• Depending on the developers to handle tenant isolation
• Storing Keys for encryption loosely
• Storing connection strings without encryption
• Encrypting unnecessary data
• Loose physical access policy for the production database
• Rigid access control tied to roles instead of privileges
• Depending on developers to handle authorization checks
• Loose authentication mechanism for rest service calls or other gateways
• Lack of access control enforcement at the service layer
• Lack of Audits

Security architecture best practices

More Related Content

What's hot

Similar to Security architecture best practices

More from Aspire Systems

Recently uploaded

Security architecture best practices