Automating Security for the Cloud - Make it Easy, Make it Safe

Automating Security for the
Cloud
Make it easy, make it safe.

Rand Wacker
rand@cloudpassage.com
@randwacker We’re
Hiring!

© 2012 CloudPassage Inc.

whoami
Slides available soon on
Rand Wacker community.cloudpassage.com
@randwacker


Security Cloud
UC Berkeley ✘ ✘
Oracle ✘
Amazon ✘
IronPort/ScanSafe ✘ ✘
Cisco ✘
CloudPassage ✘ ✘


DevOps and Security

Big Data Analysts


Shared Responsibility Model

Responsibility
EC2 Shared Responsibility Model Data

Customer
“…the customer should assume
responsibility and management of, but not App Code
limited to, the guest operating system.. and
associated application software...” App Framework

“…it is possible for customers to enhance
Operating System
security and/or meet more stringent
compliance requirements with the addition of
Virtual Machine

Responsibility
host based firewalls, host based Hypervisor
intrusion detection/prevention,

Provider
encryption and key management.” Compute & Storage
Amazon Web Services: Overview of Security Shared Network
Processes
Physical Facilities


Survey: Cloud Security Practices
Question: How do you secure your cloud servers today?

Open source or
custom-developed
tools
Commercial Tool

We're not securing
our cloud servers

My provider does it
for me

Amazon Security
Group

Source: CloudPassage CloudSec Community Survey

Cloud Security Challenges

Metered Usage
www-7 www-8 www-9 www-10

www-4 www-5 www-6
Cloud Provider B

Temporary &
Dynamic Deployments
Cloud Provider A
www-1 www-2 www-3

Multiple Cloud
Environments
Private Datacenter


The Alfred E Newman
Guide to Easy Cloud
Security


Firewalling in the Cloud:
Beyond Simple Security
Groups


Traditional DC Protection
Auth DB DB DB
Server

core core
Firewal
l

Load App Load App
Balancer Server Balancer Server

dmz dmz
Firewal
l


Moving to the Cloud
Auth DB DB DB
Server

core core
Firewal
l

Load App Load App

dmz dmz
Firewal
l


Moving to the Cloud

Auth DB DB DB
Server

core core
Firewal
l

Load App Load App

dmz dmz
Firewal
l

public cloud


Cloud Servers at Risk

Load
Balancer

App App
Server Server

DB
Master

public cloud


Firewalling in the Cloud

Load
Balancer
FW

Halo

App App
Server Server
FW FW

Halo Halo

DB
Master
FW

Halo

public cloud



Load Load
Balancer Balancer
FW FW

Halo Halo

App App App
Server Server Server
FW FW FW

Halo Halo Halo

DB DB
Master Slave
FW FW

Halo Halo

public cloud



Load Load
Balancer Balancer
FW FW

Halo Halo

App App App
Server Server App
Server
FW FW Server FW

IP
Halo Halo Halo

DB DB
Master Slave
FW FW

Halo Halo

public cloud



Load Load
Balancer Balancer
FW FW

Halo Halo

App App
Server Server App
FW FW Server
IP
Halo Halo

DB DB
Master Slave
FW FW

Halo Halo

public cloud


Multi-Cloud Firewalling

App App DB DB App App
Server Server Server Server
FW FW FW FW FW FW

Halo Halo Halo Halo Halo Halo

US West Cloud US East Cloud

Firewall

DB DB

Halo Halo

Private Datacenter


Lessons to Learn

Whatever firewall options you have, use them

Make sure your firewall rules are updated
quickly

Plan for the future, because you will be multi-
cloud


Controlling Access to Your
Cloud Servers:
Solving the Contractor
Problem


Meet Jed the Web Designer

Jed is highly mobile
Jed still uses FTP
You hired Jed for design skills, not technical
acumen

How do you avoid Jed’s FTP access becoming a
gaping hole in your server?


WRONG WAY: Open Access

Web
ftp Server


WRONG WAY: Open Access


Manual Options - PITA

MANUALLY turn FTP server on and off when
Jed needs access?

MANUALLY activate and deactivate account
for Jed when he needs access?

MANUALLY change firewall rules when Jed
needs access?

MANUALLY make Jed’s transfer for him?


Halo Multi-Factor Cloud Auth

Prevent brute force attacks on
SSH and web applications
YubiKey-generated one-time
password
No batteries or moving parts


Using Multi-Factor Auth

Web
Server
FW

Halo



DB
Server
FW

Halo

CloudPassa
ge Halo
https

Halo Grid



DB
Server
FW

Halo


REMEMBER: Delete Jed!!!

DB
Server
FW

Halo

De-provision Jed
Remove GhostPorts Access,
User Local Server Accounts
Portal

CloudPassa
ge Halo
https

https
RESTful
Halo Grid
API Gateway


Lessons to Learn
You may behave securely, but does everyone
who works for you?

Security that complicates daily tasks
will be circumvented

Make sure to clean up after others


Automation will set you
free, America…
(Apologies to Alton Brown)


Automatable Security Tasks
• Scan for recent vulnerabilities of installed software packages.
• Verify firewall rules match policy.
• Alert administrators of missing server.
• Get a report of every server that a user *does not* have an account on.
• Get a report of every server that a user has an account on.
• Get alerted if a new cloud server gets created.
• Monitor for unauthorized/unexpected changes to application code files.
• Make sure that init.d startup scripts can't be tampered with by non-root users.
• Find server accounts that don’t have passwords (it happens).
• Get a report of every server that a user *does not* have an account on.

Many, many more at
community.cloudpassage.com

The Secure, Automated Cloud


Wrapping Up


Moral of the Story
• Security of your cloud servers is your
responsibility

• Security risks in the cloud are real
(just check your logs)

• Security automation isn’t just a best
practice, it makes your life easier


How To Secure Cloud Servers
Servers in hybrid and public clouds must be self-
defending with highly automated controls like…

Dynamic firewall & Server compromise &
access control intrusion alerting

Configuration and Server forensics and
package security security analytics

Server account Integration & automation
visibility & control capabilities


Try Halo FREE - 5 Minute Setup

Register for Halo at
cloudpassage.com/register

Install Halo daemons on
cloud servers

Configure security policies
in Halo web portal


In Closing
• CloudPassage Installfest March 28th!
– Helpful cloud security advice! Pizza! Beer!
– Free tickets: cloudpassage.eventbrite.com

• Ask Questions!
– Lots More Info: community.cloudpassage.com
– Small Bits of Info: @cloudpassage

• We’re hiring! We’re
Expert in Security and/or Cloud? Hiring!
DevOps, Rails, UX, Freemium Marketing
– Email: jobs@cloudpassage.com


Thank You!
Rand Wacker
@randwacker


What does CloudPassage do?
Security for virtual servers running in public and private clouds

Dynamic firewall Server & cloud event
management alerting

Configuration and Security & compliance
vulnerability scanning auditing

Server access and Server integrity &
privilege management intrusion alerting

 Cloud adoption without fear
 Faster and easier compliance
 Repel attacks on your servers
 Free Basic version, 5 minutes setup


CloudPassage Halo
Architecture


How It Works
Halo
• Halo Daemon Daemon
www-1
– Ultra light-weight software
– Installed on server image
Halo
– Automatically provisioned
www-1

• Halo Grid
– Elastic compute grid
– Hosted by CloudPassage
– Does the heavy lifting for the Halo
Daemons Halo Grid


www-1

Alerts, Reports
www-1 www-2
and Trending www-3
www-4

Halo Halo
Halo
Halo

User
Portal

CloudPassage
https

Halo
Policies,
https
Commands,
RESTful Reports Compute
API Gateway Grid


Automating Security for the Cloud - Make it Easy, Make it Safe

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (14)

Similar a Automating Security for the Cloud - Make it Easy, Make it Safe

Similar a Automating Security for the Cloud - Make it Easy, Make it Safe (20)

Más de CloudPassage

Más de CloudPassage (7)

Último

Último (20)

Automating Security for the Cloud - Make it Easy, Make it Safe

Notas del editor