12 Steps to Cloud Security

Cloud architects and managers looking for a simpler introduction to the world of cloud security will benefit greatly from this talk. Using the 12 steps as a guide, attendees will be able to understand various security domains outlined, and to implement a cloud security framework of their own using open source solutions alone.

Transcript

1. 12 Steps to Cloud Security A guide to securing your cloud deployment using open source tools Vishnu Vettrivel Principal Engineering Lead, Atigeo @cloudronin
2. Step 1: Know your responsibility •  Cloud providers are responsible for some parts of the infrastructure stack. •  The other parts of the security stack is your responsibility. •  You are usually responsible for Application Security, Policies and configuration, machine images etc.
3. Step 2. Protect your Network •  Use Defense in Depth and services like: •  Virtual Private Clouds •  Network ACLs •  Routing rules •  Proxy Servers : Nginx •  NAT •  Firewalls •  Application : modsecurity •  Host : iptables •  Network : pfSense
4. Step 3: Protect your Machine Images •  Be sure your harden your images first •  Turn off insecure ports and services •  Change default passwords. •  Install AV Software •  Consider using a Baseline •  Tools: OpenScap
5. Step 4: Protect your Data at Rest •  Know the different Cloud storage mechanisms and their Security implications. •  De-Identify when possible •  Understand the choices of Encryption primitives like key strength and Ciphers types. •  Don’t forget Secure Archival and Disposal of Data. •  Tools: Luks, dm-crypt
6. Step 5: Protect your Data in Transit •  Use secure application protocols whenever possible. •  TLS •  SSH •  RDP •  Securely Tunnel traffic when not possible: •  IPSEC •  SSL VPN •  SSH •  Use a Key Management System •  Tools: OpenSwan, OpenVPN
7. Step 6: Protect and Patch your Instances •  Define and Categorize Cloud based assets •  Watch out for Zero Days •  Classify Risk •  Patch Affected Systems •  Use a Configuration Management System •  Tools: OpenVAS
8. Step 7: Protect Access to your Instances •  Create Individual User accounts •  Use Role based Access •  Grant Least privilege based on Business Need •  Enable Multi-Factor Authentication for Privileged Users •  Audit all User Activity •  Federate all User Access through a Directory Service •  Tools: SSSD, OpenLDAP
9. Step 8: Protect your Applications •  Implement AAA (Authentication, Authorization and Auditing). •  Familiarize yourself with the OWASP Top 10 Application Security Flaws. •  Follow Secure Development Best Practices. •  Tools: Jenkins, PMD, FindBugs
10. Step 9: Audit and Monitor your Cloud •  Gather monitoring data at a secure and separate Network •  Establish baselines •  Monitor all layers and Protocols •  Deploy the IDS behind the Network firewall •  Fine tune alert levels •  Use redundant alerting channels •  Tools: ElasticSearch, LogStash, Kibana, Watcher, Nagios
11. Step 10: Validate your Protection •  Test Network, Infrastructure and Applications separately for Security Vulnerabilities periodically •  Check for Input validation, session manipulation, authentication and information leakage •  Use 3rd Party Tools where possible •  Tools: Metasploit, Kali Linux, OpenVAS
12. Step 11: Automate Everything •  Use a Configuration Management System •  Employ Continuous Integration and Delivery. •  Automated Provisioning helps: •  Documentation •  BCP/DR Planning •  Change Management •  Treat Infrastructure as Code. •  Tools: Chef, Puppet, Ansible, Docker, Kubernetes, Openshift
13. Step 12: Update your Security Policy •  Define security scope and boundaries •  Select proper risk Assessment Methodology. •  Align policies to Contractual Obligations •  Choose a suitable Security control framework •  Tools: OpenFISMA, PTA
14. Step 13 ? There is no magic bullet! •  Some things are easier and some are harder in the Cloud •  Conventional security and compliance concepts still apply in the cloud. •  The 12 Steps will get your started on your continuous security improvement cycle
15. Resources §  https://s3.amazonaws.com/awsmedia/AWS_Security_Best_Practices.pdf §  http://checklists.nist.gov/ §  https://www.us-cert.gov/ §  https://www.owasp.org/index.php/Top_10_2013-Top_10 §  https://www.cert.org/incident-management/ §  http://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPractices.html §  https://en.wikipedia.org/wiki/Penetration_test §  http://www.drdobbs.com/architecture-and-design/top-10-practices-for- effective-devops/240149363 §  https://en.wikipedia.org/wiki/Information_security_management_system
16. Thank You Vishnu Vettrivel Principal Engineering Lead, Atigeo @cloudronin @atigeo xpatterns.com linkedin.com/