Good Fences Make Good Neighbors: Rethinking Your Cloud Selection Strategy

RSA Conference, February 2014. http://www.rsaconference.com/events/us14/agenda/sessions/952/good-fences-make-good-neighbors-rethinking-your

Transcript

1. SESSION ID: Bryan D. Payne Director of Security Research
 Nebula
 @bdpsecurity Good Fences Make Good Neighbors: Rethinking Your Cloud Selection Strategy •CSV-W01
2. #RSAC Cloud Security Today u Cloud has lots of momentum u Lots of concerns about security u What’s the real story? !2
3. #RSAC What this talk will cover u What does it take to secure an IaaS cloud? u Specific ideas to improve your cloud or select a cloud provider. !3
4. #RSAC What this talk will NOT cover u A cloud comparison u A one-size-fits-all cloud security cookbook !4
5. #RSAC Talk Outline u Cloud Introduction (demo!) u IaaS Architecture Details u Security Differentiators u Virtualization Stack Security (demo!) u Questions & Wrap-up !5
6. #RSAC Cloud Service Models !6 Today’s Talk
7. #RSAC Public Cloud u Users: Anyone with a credit card u Provider u Doesn’t trust users u Doesn’t want to violate users privacy ! u Monitoring at network edges u Fraud prevention u Network reputation concerns u Broad compliance concerns !7
8. #RSAC Private Cloud u Users: Part of a common organization u Provider u Trusts users (at some level) u Has full access to data / workloads ! u Security from top to bottom u Design undergoes great scrutiny u Enterprise integration u Targeted compliance concerns !8
9. #RSAC Know Your Neighbors u Who are your neighbors (other users)? u Who is your cloud admin / operator / builder? u Who else has privilege on the cloud? u Who should? u Who does? !9
10. #RSAC Demo: How Things Can Go Very Wrong !10
11. Understanding IaaS Cloud Architectures
12. #RSAC User Perspective u Launch instances u Take snapshots u Flexible storage options u API + web dashboard !12
13. #RSAC Admin / Operator Perspective u Create & manage users, projects, quotas, etc u Configure cloud u Monitor cloud events, logs, health, etc u API + web dashboard !13
14. #RSAC Builder Perspective u Software engineer & DevOps u Designs and creates cloud u Controls security domains u Many services to setup & manage !14
15. #RSAC Cloud Simplicity !15 Compute Object Storage Example services from OpenStack.
16. #RSAC Individual Services !16 Network Image Identity Dashboard Volume Compute Object Storage
17. #RSAC Security Domains !17 Network Image Identity Dashboard Volume Compute Object Storage
18. #RSAC Gated Interconnects !18 Network Image Identity Dashboard Volume Compute Object Storage
19. #RSAC Map Data Paths !19 Network Image Identity Dashboard Volume Compute Object Storage
20. #RSAC Secure design complete… !20 …or  is  it?
21. #RSAC Individual Services !21 Network Image Identity Dashboard Volume Compute Object Storage
22. #RSAC Lots of Glue !22 DNS Metering Automation Load Balancing Monitoring Billing Databases Orchestration Alarming Messaging Account Maintenance Certificate   Authorities Network Image Identity Dashboard Volume Compute Object Storage
23. #RSAC Data Paths !23 DNS Metering Automation Load Balancing Monitoring Billing Databases Orchestration Alarming Messaging Account Maintenance Certificate   Authorities Network Image Identity Dashboard Volume Compute Object Storage
24. #RSAC Message Plumbing !24 DNS Metering Automation Load Balancing Monitoring Billing Databases Orchestration Alarming Messaging Account Maintenance Certificate   Authorities Network Image Identity Dashboard Volume Compute Object Storage
25. #RSAC Billing Plumbing !25 DNS Metering Automation Load Balancing Monitoring Billing Databases Orchestration Alarming Messaging Account Maintenance Certificate   Authorities Network Image Identity Dashboard Volume Compute Object Storage
26. #RSAC Alarm Plumbing !26 DNS Metering Automation Load Balancing Monitoring Billing Databases Orchestration Alarming Messaging Account Maintenance Certificate   Authorities Network Image Identity Dashboard Volume Compute Object Storage
27. #RSAC SSL / TLS Plumbing !27 DNS Metering Automation Load Balancing Monitoring Billing Databases Orchestration Alarming Messaging Account Maintenance Certificate   Authorities Network Image Identity Dashboard Volume Compute Object Storage
28. #RSAC Under Cloud Admin Plumbing !28 DNS Metering Automation Load Balancing Monitoring Billing Databases Orchestration Alarming Messaging Account Maintenance Certificate   Authorities Network Image Identity Dashboard Volume Compute Object Storage
29. #RSAC So Much Plumbing! !29 DNS Metering Automation Load Balancing Monitoring Billing Databases Orchestration Alarming Messaging Account Maintenance Certificate   Authorities Network Image Identity Dashboard Volume Compute Object Storage
30. #RSAC !30
31. #RSAC OpenStack Security Guide u http://doc.openstack.org/sec/ u Security guidance on deploying OpenStack (IaaS Cloud) u Written in one week u Diverse group of authors u Continued contributions accepted through GitHub !31
32. #RSAC Cloud Security Domains !32 API Endpoints Web Dashboard Compute Node Compute Node Storage Node Storage Node Guest Management Data Management and Control Plane Services Cloud Users / Administrators Cloud Operators Instance Instance Instance Instance External
33. #RSAC Example API Action: Launching an Instance !33 Source: http://docs.openstack.org/training-guides/ External Management
34. #RSAC Security Challenges in the Cloud u Audit trails u Controlling access u Defense in depth / Layered security u Protecting bridge points u API Endpoints u Virtualization Security !34
35. #RSAC !35 Source: http://xkcd.com/908/
36. Cloud Security Differentiators
37. #RSAC Security Certifications u Necessary, but not sufficient u Mapping to cloud not always clear u Not a useful place to differentiate !37
38. #RSAC !38 High capability $$$$ Targeted Low $ Widespread Intelligence Services Organized Crime Highly Capable Groups Motivated Individuals Script Kiddies ISP Intercept Hypervisor Breakout Distributed Denial of Service Advanced Persistent Treat Automated Exploitation Tools Complex 0-day Development Service Brute Force Supply Chain Attack Mass Phishing Spear Phishing Social Engineering (Employee) Threats Source: OpenStack Security Guide
39. #RSAC !39 Cloud  Attack  Vectors Mitigation  Strategies API  Endpoints Service  hardening,  mandatory  access  controls,  code  audits Web  Dashboard HTTPS,  HSTS,  CSP,  allowed  referrers,  disable  HTTP  trace   Information  Leakage SSL/TLS,  disable  memory  dedup,  random  assignments VM  Breakout Service  hardening,  mandatory  access  controls,  code  audits Hardware  Sharing Avoid  bare  metal  instances  /  device  pass-­‐through Default  Images Secure  and  maintain  default  images Unsecured  Instances User  and/or  tenant  level  network  isolation  for  instances Secondary  Attacks Least  privilege,  mandatory  access  controls,  strong  auth
40. #RSAC Major Security Considerations u High level architecture has different security domains u End to end protection of network traffic u Protected virtualization stack u Protected API endpoints u Ability to update easily u Physical security at the datacenter !40
41. #RSAC Case Study: TLS in the Cloud !41 External Management Client SSL / TLS Termination Load Balancing Backend Service Backend Service Backend Service Backend Service Internal SSL certificate Customer-facing SSL certificate HTTP Header Inspection
42. #RSAC Case Study: API Endpoint Protection !42 External Management Bob Compute Storage Mallory Identity Database Message Queue
43. #RSAC !43 Source: http://xkcd.com/424/
44. Securing the Virtualization Stack
45. #RSAC What Is The Security Concern? !45 From Perez-Botero et al, Characterizing Hypervisor Vulnerabilities in Cloud Computing Servers, In Proceedings of the Workshop on Security in Cloud Computing (SCC), May 2013. u Hypervisors have vulnerabilities u A VM-breakout is among the worst exploits for cloud Breakdown of Hypervisor Vulnerabilities
46. #RSAC Other Virtualization Considerations u Bad actors on the control plane u Hardware emulation, entropy considerations for VM u Side channel cache attacks !46
47. #RSAC Mitigation Strategies u Mandatory access controls (KVM+SVirt & Xen+XSM) u Minimize & harden QEMU software stack u Runtime monitoring u Security updates !47
48. #RSAC Demo: Layered Security Mitigates Attacks !48
49. Questions
50. Time For Action
51. #RSAC Your Next Steps !51 Securing Your Own Cloud Evaluating 3rd Party Cloud Threat model? Who has privilege? Can you audit everything? Identify security controls? Security-driven architecture? Bryan D. Payne http://www.bryanpayne.org