public cloud security: surviving in a hostile multitenant environment
DESCRIPTION
Public Cloud Security: Surviving in a Hostile Multitenant Environment. Mark Russinovich Technical Fellow, Azure. The Third Computing Era. Security Could Ruin Everything!. Source: 451 Research, Dec 2012. Goals of this Session. Identify threats Discuss risk Explore mitigations. - PowerPoint PPT PresentationTRANSCRIPT
Public Cloud Security: Surviving in a Hostile Multitenant EnvironmentMark RussinovichTechnical Fellow, Azure
The Third Computing Era
Security Could Ruin Everything!
Source: 451 Research, Dec 2012
Identify threats Discuss riskExplore mitigations
Goals of this Session
Cloud Architecture
Cloud Operations
Hypervisor Hypervisor Hypervisor
Cloud Service APIs
DevOps
Deployer
DC Ops
Private Network
Attacker EnterpriseConsumerEnterprise
Priv
ate
Netw
ork
Internet
DatacenterCloud Service Provider
CSA periodically surveys industry experts to identify top cloud computing threatsFirst report published in 2010
Seven top threats
Most recent report published in February 2013
Nine top threatsSo close to a top ten list…
The Cloud Security Alliance “Notorious Nine”
https://cloudsecurityalliance.org/research/top-threats/
Some shared code defines the surface area exposed to customers:
CPU firmware/microcodeHypervisorWeb serverAPI support libraries…
10. Shared Technology Issues: Exposed Software
Cloud Service APIs
Datacenter
Hypervisor Hypervisor Hypervisor Hypervisor
What if there’s a vulnerability? 10. Shared Technology Issues
Stability and security are balanced against each otherAssumes infrastructure is accessible only by trusted actorsCorporate and legal mechanisms for dealing with attackers
10. Shared Technology Vulnerabilities: The Enterprise Approach
Enterprise Multi-tenancy
A vulnerability in publically accessible software enables an attacker to puncture the cloud
Breach exposes data of other customersSingle incident can cause catastrophic loss of customer confidenceCustomers (potential attackers) are anonymous and in diverse jurisdictions
10. Shared Technology Vulnerabilities: The Cloud Risk
Hypervisor Hypervisor Hypervisor
AttackerCustomer BCustomer A
10. Shared Technology Vulnerabilities: The Cloud Risk
http://www.zdnet.com/hypervisors-the-clouds-potential-security-achilles-heel-7000027846/
A vulnerability in publically accessible software enables an attacker to puncture the cloud
Breach exposes data of other customersSingle incident can cause catastrophic loss of customer confidenceCustomers (potential attackers) are anonymous and in diverse jurisdictions
New bug classification: “Cloud Critical”
10. Shared Technology Vulnerabilities: The Cloud Risk
Hostile Multi-tenancy
Enterprises and clouds are exposed to this riskClouds are at higher risk of exploitation:
Data from many customers makes it a rich targetAPI surface is trivial to access
Clouds are generally better at response:
Their business depends on itAutomated software deployment and patching required for cloud scaleBreach detection/mitigation necessary for preserving trust
10. Shared Technology Vulnerabilities: Bottom Line
My assessment
CSA assessment
Many companies are moving to the cloud and side-stepping IT processes:
Shadow IT: when business units bypass IT to deploy applications and store data in the cloudIT management, auditing, forensics, and access control systems are designed for on-premises servers and applications
Bottom line: IT must determine how to enable business units while enforcing corporate governanceIT must lead responsible adoption – it’s happening with or without them
9. Insufficient Due Diligence
“Bring Your Own IT” (BYOIT)
The agility and scale of the cloud is attractive to attackers, too
Use of compute as malware platform (Botmaster, DDOS platform)
8. Abuse of Cloud Services
The agility and scale of the cloud is attractive to attackers, too
Use of compute as malware platform (Botmaster, DDOS platform)Use of storage to store and distribute illegal contentUse of compute to mine digital currency
8. Abuse of Cloud Services
Hypervisor Hypervisor
Attacker
EnterpriseAttackerFriend
AWS
Attackers can use cloud resources and remain anonymous
Free trial offersStolen credit cardsHijacked accounts
Bottom line: reputation and COGS risk for cloud service providers
8. Abuse of Cloud Services: It’s Happening
For Cloud Service Providers Only
7. Malicious Insiders
Many cloud service provider employees have access to cloud:
Developers that write and devops cloud service codeOperators that deploy codeDatacenter operations personnel
7. Malicious Insiders
Cloud Operations
Hypervisor Hypervisor Hypervisor
Cloud Service APIs
DevOps
Deployer
DC Ops
Private Network
DatacenterCloud Service Provider
Mitigations:Employee background checksLimited as-needed access to productionControlled/monitored access to production services
Bottom line: real risk that is better understood via third-party audit/certification
7. Malicious Insiders
Employee background checksJust-in-time controls, auditingCertifications:
SO/IEC 27001:2005 SOC 1 and SOC 2 SSAE 16/ISAE 3402 AttestationsCloud Security Alliance Cloud Controls MatrixFederal Risk and Authorization Management Program (FedRAMP)Payment Card Industry (PCI) Data Security Standards (DSS) Level 1United Kingdom G-Cloud Impact Level 2 AccreditationHIPAA Business Associate Agreement (BAA)Family Educational Rights and Privacy Act (FERPA)
7. Malicious Insiders: Azure
The public cloud is…6. Denial of Service
well, public
The public cloud is…well, public
Service endpoints are subject to DDOS attacksCustomer applications are subject to targeted DDOS
Cloud outages are a form of DOS
6. Denial of Service
Hypervisor Hypervisor Hypervisor
Cloud Service APIs
AttackerEnterprise
Internet
Datacenter
DOS is a significant threatMitigations:
Cloud providers invest heavily in DDOS preventionNon-public applications can be isolated from the InternetGeo-available cloud providers can provide resiliency against many cloud outage vectors
Azure: DDOS prevention systemsGeo-regions for failover
6. Denial of Service: Bottom Line
Cloud is new and rapidly evolving, so lots of new API surfaceExamples:
Weak TLS cryptoIncomplete verification of encrypted content
5. Insecure Interfaces and APIs
Source: CSA - Cloud Computing Vulnerability Incidents: A Statistical Overview
Bottom line: Cloud providers must follow SDLCustomers should validate API behavior
5. Insecure Interfaces and APIs
Account hijacking: unauthorized access to an accountPossible vectors:
Weak passwordsStolen passwordsPassword reuse
4. Account or Service Traffic Hijacking
Account hijacking is not specific to the Cloud, but:
Cloud use may result in unmanaged credentialsPublically accessible applications/services may allow for brute forcingApplies to cloud provider: cloud support infrastructure is a back door
4. Account or Service Traffic Hijacking: Cloud Infrastructure Threats
Cloud OperationsHypervisor Hypervisor Hypervisor
Attacker
Cloud Service APIs
Mitigations:Turn off unneeded endpointsStrong passwordsMultifactor authenticationBreach detection
Azure: VM and Cloud Service Microsoft Antimalware IP ACLs (with static IP address)Point-to-Site, Site-to-Site, ExpressRouteAzure Active Directory MFA
4. Account or Service Traffic Hijacking: Bottom Line
There are multiple ways to lose cloud data:
Customer accidentally deletes or modifies itAttacker deletes or modifies itCloud provider accidentally deletes or modifies itNatural disaster destroys datacenter
3. Data Loss
Mitigations:Customer: point-in-time backups matter, even in the cloudCustomer: geo-redundant storageCloud Provider: deleted resource tombstoning
Azure: Globally Replicated StorageVM CaptureStorage snapshotsAzure Site Replica
3. Data Loss: Bottom Line
US North (primary)US South (secondary)
Really represents a collection of threats:
Insider threat, vulnerability in shared technology, etc.Ultimately, a company’s main asset is its dataHow does a company ensure its data is protected even in the face of successful breach?
Need to look at the threats individually…
2. Data Breaches
Threat: attacker gains access to media removed from datacenterMitigation: cloud provider physical controlsEnhanced mitigations:
Third-party certifications (e.g. FedRamp)Encryption at rest
Azure: third-party encryption
2. Data Breaches: Physical Attacks on Media
DC Ops
Threat: attacker man-in-the-middle snooping on data linksMitigations:
Cloud provider encrypts inter-DC trafficCloud provider APIs use TLSCustomer uses TLSCustomer encrypts outside of cloud
Azure: Brad Smith public promise
2. Data Breaches: Physical Attacks on Data Transfer
Cloud Service APIs
Attacker
Enterprise
Threat: Collocated attacker can infer secrets from processor side-effects
2. Data Breaches: Side-Channel Attacks
Threat: Collocated attacker can infer secrets from processor side-effects
2. Data Breaches: Side-Channel Attacks
Hypervisor
https://www.cs.unc.edu/~reiter/papers/2012/CCS.pdf
Researcher assumptions:Attacker knows precise cryptographic code customer is using and key strengthAttacker can collocate on same serverAttacker VM shares same physical core as customer VMCustomer VM continuously executes cryptographic codeOther customers performing similar algorithms do not share physical core
Bottom line: not currently a risk in practice
2. Data Breaches: Side-Channel Attacks
Threat: attacker gains logical access to dataMitigations:
Defense-in-depth preventionMonitoring/auditing
Encryption-at-rest: not a significant mitigation
Assume attacker can use keys
2. Data Breaches: Logical Attack on Storage
Cloud Service APIs
Attacker
Media breach is not a significant riskEncryption-at-rest doesn’t buy much
Network breach is a riskEncryption-on-the-wire is recommended
Logical breach is a riskEncryption-at-rest doesn’t buy much
2. Data Breaches: Bottom Line
1. Self-Awareness
Cloud Operations
Hypervisor Hypervisor Hypervisor
Cloud Service APIs
DevOps
Deployer
DC Ops
Private Network
Attacker EnterpriseConsumerEnterprise
Priv
ate
Netw
ork
Internet
DatacenterCloud Service Provider
http://cser.org
1. Self-awareness 2. Data breaches 3. Data loss 4. Account or service traffic hijacking 5. Insecure interfaces and APIs 6. Denial of service 7. Malicious insiders 8. Abuse of cloud services 9. Insufficient due diligence10. Shared technology vulnerabilities
The Top-10
As with any new technology, there are new risksIt’s our responsibility to educate our businesses and customers We can also develop tools and processes to mitigate risk
Summary