Chief Evangelist, CloudPassage! • Former! – Industry Analyst @ 451 Research – Information Security Office @ UofL and bank in Bermuda – Product, Program and Engineering Manager @ Q1 Labs – Linux guy at a few ISPs
Firewall Automation Two-Factor Authentication Server Account Management Server Security Events & Alerting Server Vulnerability Scanning Security and compliance automation for public, private and hybrid cloud servers System Integrity Monitoring & IDS ü Eliminates barriers to cloud hosting adoption! ü Enables cloud hosting & IaaS compliance! ü Purpose built for cloud from the ground up!
Network connectivity as a service – From a flat, shared network to per-tenant routers with private networks – API to let 3rd party vendors ‘plug in’ • e.g. Nicera Network Virtualization Platform (NVP)! – Supports virtual port isolation, virtual port mirroring, QoS, security profiles and detailed per-port statistics. !
Identity service used by OpenStack for authentication (authN) and high-level authorization (authZ) – Currently supports token-based authN and user-service authorization. – Recently re-architected to allow for expansion to support proxying external services and AuthN/AuthZ mechanisms • e.g. oAuth, SAML and openID in future versions.! keystone user-‐create -‐-‐name=nova \ -‐-‐pass=Sekr3tPass \ -‐-‐tenant_id=[the uuid of the tenant] \ -‐-‐[email protected]
have security groups, infrastructure firewall rules and Keystone for authentication so we don’t need to secure the images.” – OpenStack Admin with a Plan.! l&WFSZPOFIBTBQMBOUJMM UIFZHFUQVODIFEJOUIF NPVUIz–.JLF5ZTPO�
security is only so good in multitenant clouds ! • The ultimate target is the endpoint! – So secure it • You wouldn’t leave your doors unlocked…! – Would you?
hardened OS often is the last line of defense in the event of a security compromise.! • It is important to note that hardening is not a panacea for security. ! – It is just another layer in a good security model. • By definition, any machine that is accessible on a network and running services is potentially insecure.! – (i.e. pretty much any server)
isn’t being used…why keep it?! • If the server doesn’t need to " " " " serve web pages! – Remove PHP, Apache/nginx • If it’s not a database server! – Remove MySQL/PostgreSQL
servers/clients • Leverage the firewall and other tools! – Source of corporate network / admin network range – 3rd-party tools like fail2ban • Don’t allow ‘server hopping’! – Most people use keys without passwords to make things easier L • Facilitate on-demand access using two-factor authentication!
for Cloud Environments • You’ve locked down your server based on the Top 5! – And other guides • Now What?! • Rely on a tools built for continuous cloud security:! Dynamic Cloud Firewall Automation Two-Factor Authentication Server Account Management Server Security Events & Alerting Server Vulnerability Scanning System Integrity Monitoring & IDS
Firewall Automation Two-Factor Authentication Server Account Management Server Security Events & Alerting Server Vulnerability Scanning Security and compliance automation for public, private and hybrid cloud servers System Integrity Monitoring & IDS ü Eliminates barriers to cloud hosting adoption! ü Enables cloud hosting & IaaS compliance! ü Purpose built for cloud from the ground up!
cloudpassage
lara
tammyeverts
dougneiner
michaelherold
jeffersonlam
garrettdimon
destraynor
bluesmoon
philnash
morganepeng
rmw
trishagee
![© 2012 CloudPassage Inc.! Thank You! Andrew Hay [email protected] @andrewsmhay](https://files.speakerdeck.com/presentations/5089a69cbc9e810002012599/slide_35.jpg){kind=link}