Gaps in the Clouds by Robert Fritz

OWASP Montreal - June 18th - Gaps in the Clouds

MAIN PRESENTER: Robert Fritz

ABSTRACT: Cloud technology offers agility and scaling, and a chance to break away from legacy IT choices. Unfortunately, skipping traditional IT activities often results in poorly patched systems, out of date firewalls, and overprovisioned entitlements wielded by admins whose “day job” is development. Boundaries of accountability and responsibility amongst cloud providers and consumers are confusing, vague, and shift, making security difficult to manage. In such an environment, a “BP-spill” event, where cost wins over safely safety, is likely. This talk will dive down into the cracks between the layers of cloud, and share some of the exciting dirt we have seen and expect to see in coming years.”
BIO: Robert Fritz has been practicing security his entire career. Rob started as an Air Force lieutenant at Langley AFB and later at the Pentagon in Washington DC, building and managing classified networks. Finding he was getting too far from technology after a brief stint flying, he left the military to get back to the tech, and built security tools for HP in their HP-Unix lab. Over time he found himself in more and more security design discussions, so co-authored HP’s Commercial Application Threat Analysis Methodology, building an internal consulting practice at HP. This quantitative approach, led to two pending patents, an external-facing consulting practice, and his contributions to NIST IR-7502, the Common Configuration Scoring System (CVSS follow-on). He is the former lead editor for the Center for Internet Security’s HP-UX Benchmark, and current lead for the Android Benchmark. Robert now works for Morgan Stanley as global head of the Strategic Consulting team in the Security Architecture group, and leads the team’s cloud and social-media security practices.
WHEN: June 18th 2014
WHERE: 700 Rue Wellington, Floor 2, Montreal, QC H3C 3S4
EVENT SPONSOR: Morgan Stanley http://www.morganstanley.com/
PROGRAM:
18:00-18:30 Networking and Morgan Stanley Hosted Pizza and Soft Drinks
18:30-18:45 OWASP Chapter & Morgan Stanley Welcome
18:45-19:45 Main presentation - "Gaps in the Clouds" Robert Fritz
19:45-20:00 Open discussion and questions
20:00-... Optional, informal networking at Aziatic - 626 rue Marguerite-d'Youville, Montréal, QC H3C 1W7

Transcript

1. Cloud Computing Security
   Robert Fritz(VP),
   Cloud Security Practice Lead
   

   View Slide

2. 2
   Welcome
    Morgan Stanley Welcome and Acknowledgements
    Morgan Stanley Canada Services Lead: Alan Vesprini(ED)
    Out of Town Guests:
    Reuben Wells(MD), John Panzica(ED), William Ma
    Material Contributors:
    Rares Pateneau(ED), David Mirza-Ahmad, Guillaume Ross, Mickael Emirkanian–Bouchard, Oscar Isasmendi-Gallo(VP), Mia
   Kilborn, John Otterson(VP)
    Event Contributors
    Andrew Graham, Guillaume Ross, Siddharth Kashyap, Levon Petros, Mathias Sofer, Rob Ierfino, Vanessa Houle, Mehdi
   Bennani
    OWASP Welcome and Acknowledgements :
    Jonathan Marcil, Chapter President
   Represented by Michael Robillard, and Marius Popescu
   

   View Slide

3. 3
   About Me
    Local Security Architecture Lead
    Global Lead for Strategic Consulting , driving control agenda for:
    Cloud, Social Media, Mobile Computing, and Pioneer
    Security work for 15+ years,
    US Air Force, Hewlett-Packard, now Morgan Stanley
    Patents Pending:
    Including part of HP’s Threat Analysis Methodology
    Lead Editor of Two Center for Internet Security Hardening Benchmarks
    HP-UX and Android
    Contributor to NIST IR7502:
    Metrics For Software Security Configuration Vulnerabilities
   

   View Slide

4. 4
   What is “Cloud?”
   

   View Slide

5. How Much Cloud?: a Delivery Model
   

   View Slide

6. Where is the Cloud?:
   An Access Model
   HOW?
   WHAT?
   WHO?
   

   View Slide

7. • Ability to assign a cost to a unit of resource and charge
   by amount of resources used
   Metered
   • Ability to provision resources in real time in
   response to workload runtime events
   Automated
   Provisioning
   • Ability to add and remove resources for a
   workload without the workload being
   aware of it
   Dynamic
   Provisioning
   • Ability to add and remove resources
   to the pool without Interruption of
   service to active workloads
   Elastic
   Internet Technology
   Foundation
   

   View Slide

8. Cloud Vendor Landscape
   • Who will own the new infrastructure and the new customers
   – Operationally: Keys and Management
   – Technology: Abstraction and Hardware
   – Data: e.g. Uploading to Amazon is free, getting it back costs $$
   – Expertise: Who will be the new “experts”
   8
   

   View Slide

9. Cloud Vendor Landscape:
   Examples
   9
   Azure IaaS
   Azure PaaS
   Office 365
   Google
   Compute
   Google App
   Engine
   Google
   Enterprise /
   Apps
   Traditional
   (But Future
   Speculation)
   PaaS:
   Force.com
   Salesforce /
   AppExchange
   Amazon AWS
   Heroku
   Elastic
   Beanstalk
   Private IaaS:
   OpenStack,
   CloudStack,
   Citrix Cloud
   Platform
   Private
   PaaS:
   OpenShift,
   Cloud
   Foundry
   SaaS
   PaaS
   IaaS
   Private Cloud:
   Mix n Match
   |Dedicated Public Cloud Offerings---------------------------------------|
   

   View Slide

10. Security Layers
    Assuming Commercial IaaS / Custom PaaS
    10
    Traditional Application Security
    Cloud Provisioning Broker
    Host Access Broker
    Multi-Tenancy
    Container
    OS or Platform Layer
    •“No IT Work” / Patch
    •Snapshot Proliferation
    •Pre-Pwned Marketplace
    Images
    Application Administrator
    End User
    Provisioning Administrator
    (Owns Firewall / Deployment)
    OS/Platform Troubleshooting
    Internet
    Mid-Talk Quiz: Any Guesses on the Most Common Firewall Rules/ SGs?
    

    View Slide

11. Security Challenges:
    Hidden Costs
    • Hidden Costs
    – Adding missing security infrastructure and services
    – Managing conflicting assumptions of security responsibility
    – Managing external change
    – Lock-In
    • Cloud Offerings often don’t include:
    – Consistent authentication standards to and amongst cloud service
    vendors
    – Access and entitlements management
    – Data security
    – Application and infrastructure audit and reporting
    – Attack detection/monitoring
    • Cloud security still maturing; existing solutions may not address all gaps
    11
    

    View Slide

12. Stop the Bleeding: PaaS/SaaS
    Data Exposure
    • Data Exfiltration from Infrastructure we Don’t Control
    – Encryption Brokers (eg: CipherCloud)
    • Encrypt Data, and you don’t “Care”
    • BUT: You can’t process cipher text
    • Easy: Cold Storage (Panzura/ RiverBed)
    • Tricky: PaaS/SaaS Applications
    – Identify and Baseline Secret Data: What really is secret?
    – Identify which operations *must* cloud executed
    » Preserve Search and Sort in Some cases
    » Search / Sort Locally for others
    • Data Exfiltration from Infrastructure we Do control:
    – Adapt DLP-classic to HTTP(s) or consume compliance-mail Feeds
    – Monitor Perimeter (look for undercover cloud adoption: eg: SkyHigh)
    12
    

    View Slide

13. 13
    Case Study in AWS IaaS:
    Who’s Job is Security?
    Their Job
    • Have NIDS for their Network
    • Scan their apps
    • Separate their tenants / users
    NOT Their Job
    • OS and Up
    • Manage Entitlements and Identity
    • Entitlements are inconsistent
    and overbroad
    • Amazon Says “Buy a Broker”
    

    View Slide

14. 14
    Case Study in AWS IaaS:
    What you get with Amazon IAM
    • Recent Enterprise Offering
    Authentication
    • In-GUI :“Global root” permissions per service
    • Granular Entitlement Requires Dozens of pages of
    hand-crafted JSON
    • “All or Nothing” Permissions Model the Norm
    • AMI, Network, IP, and resource permissions new
    Entitlements:
    • Cloud Trail: Raw Dump to S3 Bucket
    Audit
    

    View Slide

15. 15
    Case Study in Force.com/SalesForce:
    What you get with SFDC
    • Username / Password Default
    • SAML Optional
    Authentication
    • API and UI- based Entitlements Provisioning
    • Very Little Entitlement Hierarchy but very Inter-
    Dependent
    • Easy to Overprovision
    Entitlements:
    • Inconsistent Coverage
    • Only some via API
    • Some require screen scraping
    • Missing Authorization Failures Entirely
    • direct path access
    Audit
    

    View Slide

16. 16
    Case Study in SaaS:
     SaaS Vendors Want to Share Data
     Box: Fishing-Friendly Invites from Outside Firm-Created User
     Box Doesn’t Limit or Audit Sharing of Materials from Non-Firm Folders
     Google Apps: allows In-Document Code that Can Create External-Facing Data Flow
     Doing Business on Social Vendors’ Sites:
     Poor validation of participants’ identity or business affiliation
     Attacks from and propagated by multiple sources; insecure laptops or network (e.g.
    open Wi-Fi) via social networking platforms
     Sites want to grow content volume; firms like us want to know who they are talking to
     Security barriers that increase confidence but decrease volume often removed by sites
    (OAUTH 2.0)
    

    View Slide

17. 17
    Questions?
    

    View Slide