Cloud Security: Infrastructure, Data Security, and Access Control

Adapted from slides by Keke Chen

Suggested Readings• Reference book: “Cloud Security and Privacy: An

Enterprise Perspective on Risks and Compliance (Theory in Practice)”, Tim Mather et al. http://www.amazon.com/Cloud-Security-Privacy-Enterprise-Perspective/dp/0596802765

• Security Guidance for Critical Areas of Focus in Cloud Computing V3.0, https://cloudsecurityalliance.org/guidance/csaguide.v3.0.pdf– Cloud Security Alliance

Outline

• Overview• Infrastructure Security• Data Security• Identity and access management• Audit, compliance and federation of clouds• Security and privacy concerns• Security as a service• Network security, policies (research)

• What makes Cloud Security different from Normal Cyber Security Systems?

How Does Cloud Security Differ?

Cloud Security Standards• Cloud Security Alliance

– Security Guidance for Critical Areas of Focus in Cloud Computing– Top Threats to Cloud Computing – Cloud Audit (A6Automated Audit,Assertion,Assessment,and

Assurance API)• NIST Cloud Security Initiative

– Guidelines on Security and Privacy in Public Cloud Computing • Military IASE standards from DISA-CSD • Federal Government

– FedRAMP(2011)– Evolved from NIST 800-053, from 2009– Assessment procedures

• OASIS Identity in the cloud– Open standards for identity deployment, provisioning and

management

Different Kinds of Clouds (NIST)

Private versus Public Cloud Security

Security and Who Owns a Cloud?

Dimensions of Security

Tradeoffs and Security Provisions

Cloud Alliance 7 ConcernsDomain GUIDANCE DEALING WITH SECURITY

Governance and Enterprise Risk Management

Govern and measure enterprise risk

Legal Issues: Contracts and Electronic Discovery

Protection requirements, security breach disclosure laws, regulatory requirements, privacy requirements, international laws

Compliance and Audit Proving compliance during audit

Information Management and Data Security

Identification and control of data in cloud. CAI

Portability and Interoperability Move data services from one provider to another, interoperability

Traditional Security, Business Continuity and Disaster Recovery

Security of operational processes and procedures (security, business continuity and disaster recovery

Data Center Operations Evaluation of Stability, On-going services

Domain GUIDANCE DEALING WITH SECURITY

Incident Response, Notification and Remediation

Provider and user levels to enable proper incident handling and forensics

Application Security +Application migration

Encryption and Key Management Appropriate encryption and scalable key management

Identity and Access Management Organization’s identity, access controls

Virtualization Multi-tenancy, VM isolation, VM co-residence, hypervisor vulnerabilities

Security as a Service Third part facilitated security assurance, incident management, compliance attestation, identity and access oversight

NIST

• Guidelines on Security and Privacy in Public Cloud Computing, Wayne Jansen and Timothy Grance, NIST, January 2011 http://csrc.nist.gov/publications/drafts/800-144/Draft-SP-800-144_cloud-computing.pdf

Security: Pros v Cons of Cloud

• Staff Specialization. • Platform Strength. • Resource Availability. • Backup and Recovery.• Mobile Endpoints.• Data Concentration.• Data Center Oriented.• Cloud Oriented.

• System Complexity. • Shared Multi-tenant

Environment. • Internet-facing Services• Loss of Control.• Botnets.• Mechanism Cracking

Overview

• Infrastructure – IaaS, PaaS, and SaaS

• Focus on public clouds – No special security problems with private

clouds – traditional security problems only

• Different levels– Network level– Host level– Application level

Infrastructure Security

• Confidentiality and integrity of data-in-transit– Amazon had security bugs with digital signature on

SimpleDB, EC2, and SQS accesses (in 2008)• Less or no system logging /monitoring

– Only cloud provider has this capability– Thus, difficult to trace attacks

• Reassigned IP address– Expose services unexpectedly – Spammers using EC2 are difficult to identify

• Availability of cloud resources – Some factors, such as DNS, controlled by the cloud

provider. • Physically separated tiers become logically

separated – E.g., 3 tier web applications

Network level

Private Cloud Network Security

• Hypervisor security– “zero-day vulnerability” in VM, if the

attacker controls hypervisor

• Virtual machine security– SSH private keys (if mode is not

appropriately set)– VM images (especially private VMs)– Vulnerable Services

Host level (IaaS)

• SaaS application security– Example: In an accident, Google Docs

access control failed. All users can access all documents

Application level

• Data-in-transit• Data-at-rest• Processing of data, including

multitenancy• Data lineage• Data provenance• Data remanence

Data Security

• Data-in-transit– Confidentiality and integrity

• Data-at-rest & processing data– Possibly encrypted for static storage– Cannot be encrypted for most PaaS and

SaaS (such as Google Apps) prevents indexing or searching

• Research on indexing/searching encrypted data

• Fully homomorphic encryption?

Data Security

• Definition: tracking and managing data• For audit or compliance purpose• Data flow or data path visualization

– E.g. data transferred to AWS on date x1 at time y1 and stored in a bucket on S3 example.s3.amazonaws.com, then processed on date x2 at time y2 on EC2 in ec2-67-202-51-223.compute-1.amazonaws.com, then stored in another bucket, example2.s3.amazonaws.com, then brought back locally on date x3 at time y3, …

• Time-consuming process even for inhouse data center– Not possible for a public cloud

Data lineage

• Origin/ownership of data– Verify the authority of data– Trace the responsibility – e.g., financial and medical data

• Difficult to prove data provenance in a cloud computing scenario

Data provenance

• Data left intact by a nominal delete operation– In many DBMSs and file systems, data is

deleted by flagging it.

• Lead to possible disclosure of sensitive information

• Department of Defense: National Industrial security program operating manual– Defines data clearing and sanitization

Data remanence

• The provider collects a huge amount of security-related data– Data possibly related to service users– If not managed well, it is a big threat to

users’ security

Provider’s data and its security

• What kinds of protocols and techniques are needed/used?

What Do You know about Identity and Access Management?

• Traditional trust boundary reinforced by network control – VPN, Intrusion detection, intrusion

prevention

• Loss of network control in cloud computing

• Have to rely on higher-level software controls– Application security– User access controls - IAM

Identity and Access Management

• IAM components– Authentication– Authorization– Auditing

• IAM processes– User management– Authentication management– Authorization management– Access management – access control– Propagation of identity to resources– Monitoring and auditing

Identity and Access Management

IAM functional architecture

Avoid duplication of identity, attributes, and credentials and provide a single sign-on user experience SAML(Security Assertion Markup Lang).

http://shibboleth.internet2.edu/docs/internet2-mace-shibboleth-arch-protocols-200509.pdf

Automatically provision user accounts with cloud services and automate the process of provisioning and deprovisioning SPML (service provisioning markup lang).

http://www.oasis-open.org/standards#spmlv2.0

Provision user accounts with appropriate privileges and manage entitlements XACML (extensible access control markup lang).

Authorize cloud service X to access my data in cloud service Y without disclosing credentials Oauth (open authentication).

IAM standards and specifications

SAML Example

ACS: Assertion Consumer Service SSO : single sign-on

SPML example

XACML Example

PEP: policy enforcement point(app interface)PDP: policy decision point

OAuth example

• OpenID• Information Cards• Open Authentication (OATH)

• Issues for OpenID– Phishing – malicious relying party

forwards end-user to bogus identity provider authentication page

– Allows sniffing of certificate and replay

IAM standards/protocols

Difference Open ID versus Oauth (Thanks to Wikipedia)

• Dealing with heterogeneous, dynamic, loosely coupled trust relationships

• Enabling “Login once, access different systems within the trust boundary”– Single sign-on (SSO)– Centralized access control services– Yahoo! OpenID

IAM practice- Identity federation

Audit, compliance and federation of clouds

NIST: Interactions between Actors in Cloud Computing

40

Cloud Consumer

Cloud ProviderCloud Broker

Cloud Auditor

The communication path between a cloud provider & a cloud consumerThe communication paths for a cloud auditor to collect auditing informationThe communication paths for a cloud broker to provide service to a cloud consumer

Cloud Carri

er

41

The Combined Conceptual Reference Diagram

Cloud Carrier

Cloud Consumer

CloudAuditor

Cloud Broker

SecurityAudit

PrivacyImpact Audit

Performance Audit

Cloud Service

Management

Service Layer

Business Support

Pri

vacy

ServiceArbitrage

Service Aggregation

Service Intermediation

Sec

uri

ty

Provisioning/Configuration

Portability/Interoperability

Physical Resource Layer

IaaS

SaaS

PaaS

Resource Abstraction and Control Layer

Hardware

Facility

42

Cloud Provider: Service Orchestration

Service Layer

Physical Resource Layer

IaaS

SaaS

PaaS

Resource Abstraction and Control Layer

Hardware

Facility

Cloud Provider

Biz Process/Operations

App/SvcUsage

Scenarios

Software as a Service

Application Development

Develop, Test, Deploy and

Manage Usage

Scenarios

Platform as a Service

Infrastructure as a Service

IT Infrastructure& Operation

Develop, Test, Deploy and

Manage Usage

Scenarios

Federation of Clouds/Hybrid Clouds 1. • Using multiple clouds for different applications to

match needs (local cloud and cloud bursting) • Allocating components of an application to

different environments (e.g., compute vs database tiers), whether internal or external (“application stretching”)

• Moving an application to meet requirements at specific stages in its lifecycle, from early development through unit test, scale testing, pre-production and ultimately full production scenarios

Federation of Clouds/Hybrid Clouds 2. • Moving workloads closer to end users across geographic

locations, including user groups within the enterprise, partners and external customers

• Meeting peak demands efficiently in the cloud while the low steady-state is handled internally

• Keeping large data within country, geography or organization while allowing global distributed computation

• Maintaining confidential data on better protected clouds while allowing distributed computation on more computationally efficient ones.

Key Security and Privacy Issues

• Governance -- control and oversight over policies, procedures, and standards for application development, as well as the design, implementation, testing, and monitoring of deployed services.

Key Security and Privacy Issues

• Compliance -- conformance with an established specification, standard, regulation, or law. – Data location --- trans-border data flows include whether the

laws in the jurisdiction where the data was collected permit the flow, whether those laws continue to apply to the data post transfer, and whether the laws at the destination present additional risks or benefits

– Laws and Regulations --- OMB, Clinger-Cohen Act, FISMA, NARA (archives), HIPPA, PCI DSS (cards)

– Electronic Discovery --- FOIA, litigation

Key Security and Privacy Issues

• Trust– Insider Access --- (esp. DOS)– Data Ownership --- Privacy versus data ownership.– Composite Services --- Nesting and layering of

services, trust is not transitive, liability and performance guarantees

– Visibility --- detailed network and system level monitoring, oversight

– Risk Management

Security as a Service

• Origins: Email Spam• Today

– Email Filtering– Web Content Filtering– Vulnerability Management– Identity Management as a service– Etc.

• Naming: SaaS – NOT to be confused with Software as a Service!SecaaS: Security as a Service (Cloud Security Alliance)

https://cloudsecurityalliance.org/wp-content/uploads/2011/09/SecaaS_V1_0.pdf

SaaS Categorization by CSA

CSA: Cloud Security Alliance1. Identity and Access Management 2. Data Loss Prevention3. Web Security4. Email Security5. Security Assessments6. Intrusion Management7. Security Information and Event Management (SIEM)8. Encryption9. Business Continuity and Disaster Recovery10. Network Security

Identity and Access Management (IAM)

• SAML, SPML, XACML, (MOF/ECORE), OAuth, OpenID, Active Directory Federated Services (ADFS2), WS- Federation

• Commercial Cloud Examples– CA Arcot Webfort – CyberArk Software Privileged Identity Manager– Novell Cloud Security Services– ObjectSecurity OpenPMF (authorization policy automation, for private

cloud only)– Symplified

• Threats addressed– Identity theft, Unauthorized access, Privilege escalation, Insider threat,

Non-repudiation, Excess privileges / Excessive access, Delegation of authorizations / Entitlements, Fraud

Data Loss Prevention• Monitoring, protecting, and verifying the security of data• by running as a client on desktops / servers and running rules

– “No FTP” or “No uploads” to web sites– “No documents with numbers that look like credit cards can be emailed” – “Anything saved to USB storage is automatically encrypted and can only

be unencrypted on another office owned machine with a correctly installed DLP client”

– “Only clients with functioning DLP software can open files from the fileserver”

• Related to IAM • Threats Addressed

– Data loss/leakage, Unauthorized access, Malicious compromises of data integrity, Data sovereignty issues, Regulatory sanctions and fines

Web Security

• Real-time protection – On-premise through software/appliance installation– Proxying or redirecting web traffic to the cloud provider

• Prevent malware from entering the enterprise via activities such as web browsing

• Mail Server, Anti-virus, Anti-spam, Web Filtering, Web Monitoring, Vulnerability Management, Anti-phishing

• Threats addressed– Keyloggers, Domain Content, Malware, Spyware, Bot Network,

Phishing, Virus, Bandwidth consumption, Data Loss Prevention, Spam

Email Security

• Control over inbound and outbound email• Enforce corporate polices such as acceptable use and spam• Policy-based encryption of emails• Digital signatures enabling identification and non-

repudiation • Services

– Content security, Anti- virus/Anti-malware, Spam filtering, Email encryption, DLP for outbound email, Web mail, Anti-phishing

• Threats addressed– Phishing, Intrusion, Malware, Spam, Address spoofing

Security Assessments• Third-party audits of cloud services or assessments of local systems via

cloud-provided solutions• Well defined and supported by multiple standards such as NIST, ISO, and CIS• Additional Cloud Challenges

– Virtualization awareness of the tool– Support for common web frameworks in PaaS applications– Compliance Controls for IaaS, PaaS, and SaaS platforms

• Services– Internal and / or external penetration test, Application penetration test, Host and

guest assessments, Firewall / IPS (security components of the infrastructure) assessments, Virtual infrastructure assessment

• Threats addressed– Inaccurate inventory, Lack of continuous monitoring, Lack of correlation

information, Lack of complete auditing, Failure to meet/prove adherence to Regulatory/Standards Compliance, Insecure / vulnerable configurations, Insecure architectures, Insecure processes / processes not being followed

Intrusion Management

• Using pattern recognition to detect and react to statistically unusual events

• IM tools are mature, however – virtualization and massive multi-tenancy is creating new

targets for intrusion– raises many questions about the implementation of the same

protection in cloud environments• Services

– Packet Inspection, Detection, Prevention• Threats addressed

– Intrusion, Malware

Security Information and Event Management (SIEM)

• Accept log and event information• Correlate and analyze to provide real-time reporting and

alerting on incidents / events• Services

– Log management, Event correlation, Security/Incident response, Scalability, Log and Event Storage, Interactive searching and parsing of log data, Logs immutable (for legal investigations)

• Threats addressed– Abuse, Insecure Interfaces and APIs, Malicious Insiders, Shared

Technology Issues, Data Loss and Leakage, Account or Service Hijacking, Unknown Risk Profile, Fraud

Encryption

• The process of obfuscating/encoding data using cryptographic algorithms – Algorithm(s) that are computationally difficult to break

• Services– VPN services, Encryption Key Management, Virtual Storage

Encryption, Communications Encryption, Application Encryption, Database Encryption, digital signatures, Integrity validation

• Threats addressed– Failure to meet Regulatory Compliance requirements, Mitigating

insider and external threats to data, Intercepted clear text network traffic, Clear text data on stolen / disposed of hardware, Reducing the risk or and potentially enabling cross-border business opportunities, Reducing perceived risks and thus enabling Cloud's Adoption by government

Business Continuity and Disaster Recovery

• Ensure operational resiliency in the event of any service interruptions

• Flexible and reliable failover • Utilize cloud’s flexibility to minimize cost and maximize

benefits• Services

– File recovery provider, File backup provider, Cold site, Warm site, Hot site, Insurance, Business partner agreements, Replication (e.g. Databases)Threats addressed

– Natural disaster, Fire, Power outage, Terrorism/sabotage, Data corruption, Data deletion, Pandemic/biohazard

Network Security• Services that allocate access, distribute, monitor, and protect the

underlying resource services– Address security controls at the network in aggregate, Or – Specifically address at the individual network of each underlying resource

• In Clouds, likely to be provided by virtual devices alongside traditional physical devices– Tight integration with the hypervisor to ensure full visibility of all traffic

on the virtual network layer is key• Services

– Firewall (perimeter and server tier), Web application firewall, DDOS protection/mitigation, DLP, IR management, IDS / IPS

• Threats addressed– Data Threats, Access Control Threats, Application Vulnerabilities, Cloud

Platform Threats, Regulatory, Compliance & Law Enforcement

60

Network Security (Research)• Policies about the configurations of the infrastructure are used for specifying security and

availability requirements

• A critical device should be placed within a security perimeter• Unprotected devices should not communicate with machines running critical services• Computation on confidential data must performed on hosts under the control of DoD

• Policy-driven approach has been taken by FISMA, PCI-DSS, NERC

Scalability Real-time detection of violations

Monitoring itself needs to be secure

Information needs to be shared across cloud providers

Requirements

61

Policy Distribution

Reaction Agent

Reaction Agent

Odessa Agent

Odessa Agent

NetOdessa Agent

DORA Subsystem

Trustworthiness of W

orkflows

Trust Calculation Module

External Event

Aggregator

External Event

Aggregator

Formal Design and analysis of Assured

Mission Critical Computations

Evaluation on a distributed networked

test-bed

Middleware for Assured Clouds

Risk Assessment Modules

Distance from Compliance Calculation

62

Reaction Agents are part of the Middleware

When a policy violation is detected• Security, availability, or timeliness requirements might not be

satisfied • We need to reconfigure the system

We implemented a cloud-based OpenFlow reaction agent

OpenFlow controller Flow information

reconfigurationsReactionAgent

violation

To Read Further• Roy H. Campbell, Mirko Montanari, Reza Farivar, Middleware for

Assured Clouds, Journal of Internet Services and Applications, 2011 [pdf]• Kroske, E. ; Farivar, R. ; Montanari, M. ; Larson, K. ; Campbell, R.H.,

NetODESSA: Dynamic Policy Enforcement in Cloud Networks, 30th IEEE Symposium on Reliable Distributed Systems - Workshops (SRDSW), 2011

• Mirko Montanari, Roy H. Campbell, Attack-resilient Compliance Monitoring for Large Distributed Infrastructure Systems, IEEE International Conference on Network and System Security (NSS), Sept 2011. [pdf]

• Mirko Montanari, Ellick Chan, Kevin Larson, Wucherl Yoo, Roy H. Campbell, "Distributed Security Policy Conformance," IFIP SEC 2011, Lucerne, Switzerland, June 2011. [pdf]