A green data center is a “service facility which utilizes energy-efficient technologies. They do not contain obsolete systems (such as inactive or underused servers), and take advantage of newer, more efficient technologies.” All the components of a green data center including mechanical, lighting, electrical and computer systems are designed to maximize energy efficiency and minimize environmental impact.
Some technologies and strategies used in green data center include:
Low-power servers. They are more energy-efficient than conventional servers in data centers. They use the technology of smartphone computing, which tries to balance performance with energy consumption.
Modular data center. It is a portable data center which can be placed anywhere data capacity is needed. Compared with traditional data centers, they are designed for rapid deployment, energy efficiency and high density.
E-waste recycling. Re-use servers and components.
Free air cooling systems uses outdoor air instead of traditional data-center computer room air conditioner (CRAC) units.
Hot and cold aisle containment
Reusing waste heat.
Minimized building footprint
Low-emission building materials, carpets and paints
Alternative energy, such as photovoltaic technology, heat pumps, ultrasonic humidification, and evaporative cooling technology
With the exponential growth and usage of the Internet, power consumption in data centers has increased significantly resulting in huge environmental impact. The creation of green data centers has become essential to mitigate climate change.
AWS has 20+ security tools and services that you can use to secure your data and applications in AWS cloud. These tools and services cover your data protection needs, identity and access management, network and application protection, threat detection and monitoring, and compliance and data privacy.
The following ten security tools are the most useful services that you should start using to improve your security posture:
AWS Security Hub is a cloud security posture management service that performs security best practice checks, aggregates alerts, and enables automated remediation. It quickly assesses your high-priority security alerts and security posture across AWS accounts in one comprehensive view.
AWS Identity and Access Management (IAM) provides fine-grained access control across all of AWS. With IAM, you can specify who can access which services and resources, and under which conditions. With IAM policies, you manage permissions to your workforce and systems to ensure least-privilege permissions. AWS IAM also has multi-factor authentication and supports single sign-on (SSO) access to further secure and centralize user access.
AWS GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.
AWS Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS. Macie automatically provides an inventory of Amazon S3 buckets including a list of unencrypted buckets, publicly accessible buckets, and buckets shared with AWS accounts, then it applies machine learning and pattern matching techniques to the buckets you select to identify and alert you to sensitive data, such as personally identifiable information (PII).
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, change management, and operational troubleshooting.
AWS CloudTrail monitors and records account activity across your AWS infrastructure, giving you control over storage, analysis, and remediation actions. You can view and search these events to identify unexpected or unusual requests in your AWS environment.
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency.
Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. These assessments include network access, common vulnerabilities and exposures (CVEs), Center for Internet Security (CIS) benchmarks, and common best practices such as disabling root login for SSH and validating system directory permissions on your EC2 instances.
AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits and bots that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that control bot traffic and block common attack patterns, such as SQL injection or cross-site scripting. You can also customize rules that filter out specific traffic patterns.
AWS Audit Manager helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards. Audit Manager automates evidence collection to reduce the “all hands on deck” manual effort that often happens for audits and enable you to scale your audit capability in the cloud as your business grows.
A cybersecurity framework is a system of standards, guidelines, and best practices to manage cyber risks. The three most popular cybersecurity framework are:
The US National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (NIST CSF)
The Center for Internet Security Critical Security Controls (CIS)
The International Standards Organization (ISO) frameworks ISO/IEC 27001 and 27002.
NIST cybersecurity framework is intended to be used to protect any organization’s infrastructure from cyberattacks. The framework’s core is a list of cybersecurity functions that follow the basic pattern of cyber defense: identify, protect, detect, respond, and recover. The framework provides an organized mechanism for identifying risks and assets that require protection.
Identify
The Identify Function assists in developing an organizational understanding to managing cybersecurity risk to systems, people, assets, data, and capabilities. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs. Examples of outcome Categories within this Function include:
Identifying physical and software assets within the organization to establish the basis of an Asset Management program
Identifying the Business Environment the organization supports including the organization’s role in the supply chain, and the organizations place in the critical infrastructure sector
Identifying cybersecurity policies established within the organization to define the Governance program as well as identifying legal and regulatory requirements regarding the cybersecurity capabilities of the organization
Identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities as a basis for the organizations Risk Assessment
Identifying a Risk Management Strategy for the organization including establishing risk tolerances
Identifying a Supply Chain Risk Management strategy including priorities, constraints, risk tolerances, and assumptions used to support risk decisions associated with managing supply chain risks
Protect
The Protect Function outlines appropriate safeguards to ensure delivery of critical infrastructure services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include:
Protections for Identity Management and Access Control within the organization including physical and remote access
Empowering staff within the organization through Awareness and Training including role based and privileged user training
Establishing Data Security protection consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information
Implementing Information Protection Processes and Procedures to maintain and manage the protections of information systems and assets
Protecting organizational resources through Maintenance, including remote maintenance, activities
Managing Protective Technology to ensure the security and resilience of systems and assets are consistent with organizational policies, procedures, and agreements
Detect
The Detect Function defines the appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables timely discovery of cybersecurity events. Examples of outcome Categories within this Function include:
Ensuring Anomalies and Events are detected, and their potential impact is understood
Implementing Security Continuous Monitoring capabilities to monitor cybersecurity events and verify the effectiveness of protective measures including network and physical activities
Maintaining Detection Processes to provide awareness of anomalous events
Respond
The Respond Function includes appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident. Examples of outcome Categories within this Function include:
Ensuring Response Planning process are executed during and after an incident
Managing Communications during and after an event with stakeholders, law enforcement, external stakeholders as appropriate
Analysis is conducted to ensure effective response and support recovery activities including forensic analysis, and determining the impact of incidents
Mitigation activities are performed to prevent expansion of an event and to resolve the incident
The organization implements Improvements by incorporating lessons learned from current and previous detection / response activities
Recover
The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a cybersecurity incident. Examples of outcome Categories within this Function include:
Ensuring the organization implements Recovery Planning processes and procedures to restore systems and/or assets affected by cybersecurity incidents
Implementing Improvements based on lessons learned and reviews of existing strategies
Internal and external Communications are coordinated during and following the recovery from a cybersecurity incident
Due to the rampant cyber attacks on private and public companies as well as government institutions, the President of the United States issued an Executive Order 14028 on May 12, 2021 to improve the nation’s cybersecurity.
To comply, companies must implement the five best practices from the Executive Order of the President:
Back up data, system images, and configurations; regularly test them, and keep the backups offline.
CyberEdge Group has been conducting yearly surveys to IT security professionals all over the world. The latest one – 2021 Cyberthreat Defense Report – is a comprehensive review of the perceptions of 1,200 IT security professionals representing 17 countries and 19 industries.
The report has become a staple among security leaders and practitioners, helping them gauge their internal practices and security investments against those of their peers across different countries and industries.
Here are the key insights from the 2021 report:
A record 86% of organizations suffered from a successful cyberattack last year
A record 69% of organizations were compromised by ransomware
57% of ransomware victims paid ransoms last year, but one-quarter (28%) of them failed to recover their data
Low employee awareness and lack of skilled personnel inhibit IT security’s success
87% of organizations are experiencing a shortfall of skilled IT security personnel
The typical enterprise IT security budget increased 4% last year, but the rate of budget growth slowed for the first time in years
Four out of five respondents prefer security products that feature machine learning (ML) and artificial intelligence (AI) technology
The percentage of IT security applications and services are delivered from the cloud climbed from 36% to 41%
Software developers are the backbones of creating secure software. The recently found vulnerability in Apache Log4j underscores the importance of developing secure software. Securing critical software resources is more important than ever as the focus of attackers has steadily moved toward the application layer. It is much less expensive to build secure software than to correct security issues after the software package has been completed, not to mention the costs that may be associated with a security breach.
One of the most adopted security frameworks is the CIS Controls (formerly known as Critical Security Controls). It has been updated in May of 2021 to keep up with the ever changing cybersecurity landscape. CIS Controls are a prioritized set of safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are recommended set of actions for cyber defense that provide specific and actionable ways to stop today’s most pervasive and dangerous attacks. Compared to the other security frameworks such as the NIST CSF (Cybersecurity Framework), CIS Controls are more prescriptive.
CIS Controls v8 has been enhanced to keep up with modern systems and software. Movement to cloud-based computing, virtualization, mobility, outsourcing, work-from-home, and changing attacker tactics prompted the update and supports an enterprise’s security as they move to both fully cloud and hybrid environments.
Here are the updated 18 CIS Controls:
Inventory and Control of Enterprise Assets – Actively manage (inventory, track, and correct) all enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/Internet of Things (IoT) devices; and servers) connected to the infrastructure physically, virtually, remotely, and those within cloud environments, to accurately know the totality of assets that need to be monitored and protected within the enterprise. This will also support identifying unauthorized and unmanaged assets to remove or remediate.
Inventory and Control of Software Assets – Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.
Data Protection – Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.
Secure Configuration of Enterprise Assets and Software – Establish and maintain the secure configuration of enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/IoT devices; and servers) and software (operating systems and applications).
Account Management – Use processes and tools to assign and manage authorization to credentials for user accounts, including administrator accounts, as well as service accounts, to enterprise assets and software.
Access Control Management – Use processes and tools to create, assign, manage, and revoke access credentials and privileges for user, administrator, and service accounts for enterprise assets and software.
Continuous Vulnerability Management – Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise’s infrastructure, in order to remediate, and minimize, the window of opportunity for attackers. Monitor public and private industry sources for new threat and vulnerability information.
Audit Log Management – Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.
Email and Web Browser Protections – Improve protections and detections of threats from email and web vectors, as these are opportunities for attackers to manipulate human behavior through direct engagement.
Malware Defenses – Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on enterprise assets.
Data Recovery – Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.
Network Infrastructure Management – Establish, implement, and actively manage (track, report, correct) network devices, in order to prevent attackers from exploiting vulnerable network services and access points.
Network Monitoring and Defense – Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise’s network infrastructure and user base.
Security Awareness and Skills Training – Establish and maintain a security awareness program to influence behavior among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise.
Service Provider Management – Develop a process to evaluate service providers who hold sensitive data, or are responsible for an enterprise’s critical IT platforms or processes, to ensure these providers are protecting those platforms and data appropriately.
Application Software Security – Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.
Incident Response and Management – Establish a program to develop and maintain an incident response capability (e.g., policies, plans, procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an attack.
Penetration Testing – Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls (people, processes, and technology), and simulating the objectives and actions of an attacker.
The Open Web Application Security Project (OWASP) is a non-profit foundation dedicated to improving the security of software. The Open Web Application Security Project® (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. OWASP is a repository of all things web-application-security, backed by the extensive knowledge and experience of its open community contributors.
What is the OWASP Top 10?
OWASP Top 10 is an online document on OWASP’s website that provides ranking of and remediation guidance for the top 10 most critical web application security risks. The report is based on a consensus among security experts from around the world. The risks are ranked and based on the frequency of discovered security defects, the severity of the vulnerabilities, and the magnitude of their potential impacts. The purpose of the report is to offer developers and web application security professionals insight into the most prevalent security risks so that they may incorporate the report’s findings and recommendations into their security practices, thereby minimizing the presence of these known risks in their applications.
Here’s the updated 2021 Top 10 list:
A01:2021-Broken Access Control moves up from the fifth position to the category with the most serious web application security risk; the contributed data indicates that on average, 3.81% of applications tested had one or more Common Weakness Enumerations (CWEs) with more than 318k occurrences of CWEs in this risk category. The 34 CWEs mapped to Broken Access Control had more occurrences in applications than any other category.
A02:2021-Cryptographic Failures shifts up one position to #2, previously known as A3:2017-Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed name focuses on failures related to cryptography as it has been implicitly before. This category often leads to sensitive data exposure or system compromise.
A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection with a max incidence rate of 19%, an average incidence rate of 3.37%, and the 33 CWEs mapped into this category have the second most occurrences in applications with 274k occurrences. Cross-site Scripting is now part of this category in this edition.
A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, we need more threat modeling, secure design patterns and principles, and reference architectures. An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks.
A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration, with an average incidence rate of 4.5%, and over 208k occurrences of CWEs mapped to this risk category. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for A4:2017-XML External Entities (XXE) is now part of this risk category.
A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. A8:2017-Insecure Deserialization is now a part of this larger category.
A09:2021-Security Logging and Monitoring Failures was previously A10:2017-Insufficient Logging & Monitoring and is added from the Top 10 community survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.
The string of high profile ransomware attacks on major companies has led executives and boards to take security seriously. In the past, spending money on security is a hard sell and security folks often resort to using the FUD factor (fear, uncertainty and doubt) to implement security projects. Now, they are realizing the importance of security to avoid major disruptions and keep the business going.
For security folks, this is the best time to forge the partnership with the business. You should define strategic directions for both the business and security. Map out a high high-level path to get from current to future objectives as well as identify organizational roadblocks, standards/policy challenges, and business goals. This is not a one and done thing. Continue to collaborate and have an ongoing discussion to maintain the relationship and to determine if things have changed such as new strategies.
Security folks must understand the business value. Work closely with them to strike the appropriate balance for risk acceptance, and make sure the risk is stated in the context of business objectives.
While you have the attention of the business, do not squander this opportunity.
If you store critical and sensitive data on the cloud, particularly on AWS S3 object storage, it is important that you continually protect and monitor your data. Fortunately, AWS has a lot of tools to help you secure them. AWS built their services with security in mind. However, it is still your responsibility as a data owner to protect your data.
Here are the top ten best practices for securing your data on AWS S3:
Ensure that your S3 buckets are not publicly accessible by using Amazon S3 block public access.
Ensure that your S3 buckets have the correct policies. Use Amazon S3 bucket policy and IAM user policy, as well as the bucket access control list (ACL) to implement effective permissions on the buckets. Make sure to implement least privilege access, granting only minimal rights for users to get their jobs done.
Encrypt data at rest on the server side using Amazon S3 managed keys (SSE-S3), customer master keys stored in AWS Key Management Service (SSE-KMS), or customer-provided keys (SSE-C). You can also encrypt your data on the client side before uploading to AWS S3.
Encrypt data in transit using HTTPS (TLS). You can enforce this by setting it in the Amazon S3 bucket policies.
Enable and require VPC endpoints for AWS S3 access. A VPC endpoint can help prevent traffic from potentially traversing the open internet and being subject to the open internet environment.
Enable versioning to keep multiple versions of a file in the same bucket. With versioning, you can easily recover files from both unintended user actions and application failures.
Use cross-region replication (CRR) to replicate your data to a different AWS region, thereby increasing data resiliency.
Enable multi factor authentication (MFA) Delete and S3 Object Lock feature to prevent malicious or accidental bucket deletions.
Continually monitor and audit your S3 buckets by using AWS tools such as Cloudwatch, Cloudtrail, S3 access logging, and AWS Config.
Use AWS Access Analyzer for S3 to quickly analyze resource policies, continuously monitor and analyze permissions, and resolve findings by updating policies.
