Category Archives: Cloud

Zero Trust Security

Leave a reply

Zero Trust security is an IT security framework that requires all users and devices, whether in or outside the organization’s network perimeter, to be authenticated, authorized, and continuously validated before being granted or keeping access to applications and data. In a traditional IT network, it is hard to obtain access from outside the network, but once inside the network, everyone is trusted by default whereas a Zero Trust model trusts no one and nothing. The problem with traditional IT network is that once an attacker gains access to the network, they have free rein over everything inside.

The main principle of Zero Trust security are the following:

  1. Least privilege access. Give users only only the bare minimum level of access necessary to perform job-specific tasks. This will minimize each user’s exposure to sensitive parts of the network.
  2. Continuous monitoring and validation. Verify users and devices identity and privileges continuously and time out logins and connections periodically once established.
  3. Device access control. Ensure that every device in the network is authorized, and assess all devices to make sure they have not been compromised.
  4. Terminate every connection. Allow an inline proxy architecture to inspect all traffic, including encrypted traffic, in real time — before it reaches its destination — to prevent ransomware and malware.
  5. Microsegmentation. Break up security perimeters into small zones to maintain separate access for separate parts of the network.
  6. Multi factor authentication (MFA). Require users at least 2 sources of evidence to identify themselves. For example, in addition to entering a password, users must also enter a code sent to another device, such as a mobile phone, thus providing two pieces of evidence that they are who they claim to be.
  7. Prevent lateral movement. “Lateral movement” is when an attacker moves within a network after gaining access to that network. Zero Trust is designed to contain attackers so that they cannot move laterally. Once the attacker’s presence is detected, the compromised device or user account can be quarantined and cut off from further access.

These principles will reduce the organization’s security risk by minimizing or even eliminating the attack surface.

Sources:

https://www.cloudflare.com/learning/security/glossary/what-is-zero-.trust/

https://www.crowdstrike.com/cybersecurity-101/zero-trust-security/

https://www.zscaler.com/resources/security-terms-glossary/what-is-zero-trust

Green Data Center

Leave a reply

A green data center is a “service facility which utilizes energy-efficient technologies. They do not contain obsolete systems (such as inactive or underused servers), and take advantage of newer, more efficient technologies.” All the components of a green data center including mechanical, lighting, electrical and computer systems are designed to maximize energy efficiency and minimize environmental impact.

Some technologies and strategies used in green data center include:

  1. Low-power servers. They are more energy-efficient than conventional servers in data centers. They use the technology of smartphone computing, which tries to balance performance with energy consumption.
  2. Modular data center. It is a portable data center which can be placed anywhere data capacity is needed. Compared with traditional data centers, they are designed for rapid deployment, energy efficiency and high density.
  3. E-waste recycling. Re-use servers and components.
  4. Free air cooling systems uses outdoor air instead of traditional data-center computer room air conditioner (CRAC) units.
  5. Hot and cold aisle containment
  6. Reusing waste heat.
  7. Minimized building footprint
  8. Low-emission building materials, carpets and paints
  9. Alternative energy, such as photovoltaic technology, heat pumps, ultrasonic humidification, and evaporative cooling technology

With the exponential growth and usage of the Internet, power consumption in data centers has increased significantly resulting in huge environmental impact. The creation of green data centers has become essential to mitigate climate change.

Sources:

https://en.wikipedia.org/wiki/Green_data_center

https://www.techtarget.com/searchdatacenter/definition/green-data-center

Top 10 AWS Security Tools

Leave a reply

AWS has 20+ security tools and services that you can use to secure your data and applications in AWS cloud. These tools and services cover your data protection needs, identity and access management, network and application protection, threat detection and monitoring, and compliance and data privacy.

The following ten security tools are the most useful services that you should start using to improve your security posture:

  1. AWS Security Hub is a cloud security posture management service that performs security best practice checks, aggregates alerts, and enables automated remediation. It quickly assesses your high-priority security alerts and security posture across AWS accounts in one comprehensive view.
  2. AWS Identity and Access Management (IAM) provides fine-grained access control across all of AWS. With IAM, you can specify who can access which services and resources, and under which conditions. With IAM policies, you manage permissions to your workforce and systems to ensure least-privilege permissions. AWS IAM also has multi-factor authentication and supports single sign-on (SSO) access to further secure and centralize user access.
  3. AWS GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.
  4. AWS Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS. Macie automatically provides an inventory of Amazon S3 buckets including a list of unencrypted buckets, publicly accessible buckets, and buckets shared with AWS accounts, then it applies machine learning and pattern matching techniques to the buckets you select to identify and alert you to sensitive data, such as personally identifiable information (PII). 
  5. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, change management, and operational troubleshooting.
  6. AWS CloudTrail monitors and records account activity across your AWS infrastructure, giving you control over storage, analysis, and remediation actions. You can view and search these events to identify unexpected or unusual requests in your AWS environment.
  7. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency.
  8. Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. These assessments include network access, common vulnerabilities and exposures (CVEs), Center for Internet Security (CIS) benchmarks, and common best practices such as disabling root login for SSH and validating system directory permissions on your EC2 instances.
  9. AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits and bots that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that control bot traffic and block common attack patterns, such as SQL injection or cross-site scripting. You can also customize rules that filter out specific traffic patterns.
  10. AWS Audit Manager helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards. Audit Manager automates evidence collection to reduce the “all hands on deck” manual effort that often happens for audits and enable you to scale your audit capability in the cloud as your business grows.

Source:

https://aws.amazon.com/products/security/

NIST Cybersecurity Framework

Leave a reply

A cybersecurity framework is a system of standards, guidelines, and best practices to manage cyber risks.  The three most popular cybersecurity framework are:

  • The US National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (NIST CSF)
  • The Center for Internet Security Critical Security Controls (CIS)
  • The International Standards Organization (ISO) frameworks ISO/IEC 27001 and 27002.

NIST cybersecurity framework is intended to be used to protect any organization’s infrastructure from cyberattacks. The framework’s core is a list of cybersecurity functions that follow the basic pattern of cyber defense: identify, protect, detect, respond, and recover. The framework provides an organized mechanism for identifying risks and assets that require protection.

Identify

The Identify Function assists in developing an organizational understanding to managing cybersecurity risk to systems, people, assets, data, and capabilities. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs.
Examples of outcome Categories within this Function include:

  • Identifying physical and software assets within the organization to establish the basis of an Asset Management program
  • Identifying the Business Environment the organization supports including the organization’s role in the supply chain, and the organizations place in the critical infrastructure sector
  • Identifying cybersecurity policies established within the organization to define the Governance program as well as identifying legal and regulatory requirements regarding the cybersecurity capabilities of the organization
  • Identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities as a basis for the organizations Risk Assessment
  • Identifying a Risk Management Strategy for the organization including establishing risk tolerances
  • Identifying a Supply Chain Risk Management strategy including priorities, constraints, risk tolerances, and assumptions used to support risk decisions associated with managing supply chain risks

Protect

The Protect Function outlines appropriate safeguards to ensure delivery of critical infrastructure services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event.
Examples of outcome Categories within this Function include:

  • Protections for Identity Management and Access Control within the organization including physical and remote access
  • Empowering staff within the organization through Awareness and Training including role based and privileged user training
  • Establishing Data Security protection consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information
  • Implementing Information Protection Processes and Procedures to maintain and manage the protections of information systems and assets
  • Protecting organizational resources through Maintenance, including remote maintenance, activities
  • Managing Protective Technology to ensure the security and resilience of systems and assets are consistent with organizational policies, procedures, and agreements

Detect

The Detect Function defines the appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables timely discovery of cybersecurity events.
Examples of outcome Categories within this Function include:

  • Ensuring Anomalies and Events are detected, and their potential impact is understood
  • Implementing Security Continuous Monitoring capabilities to monitor cybersecurity events and verify the effectiveness of protective measures including network and physical activities
  • Maintaining Detection Processes to provide awareness of anomalous events

Respond

The Respond Function includes appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident.
Examples of outcome Categories within this Function include:

  • Ensuring Response Planning process are executed during and after an incident
  • Managing Communications during and after an event with stakeholders, law enforcement, external stakeholders as appropriate
  • Analysis is conducted to ensure effective response and support recovery activities including forensic analysis, and determining the impact of incidents
  • Mitigation activities are performed to prevent expansion of an event and to resolve the incident
  • The organization implements Improvements by incorporating lessons learned from current and previous detection / response activities

Recover

 The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a cybersecurity incident.
Examples of outcome Categories within this Function include:

  • Ensuring the organization implements Recovery Planning processes and procedures to restore systems and/or assets affected by cybersecurity incidents
  • Implementing Improvements based on lessons learned and reviews of existing strategies
  • Internal and external Communications are coordinated during and following the recovery from a cybersecurity incident

Source: https://www.nist.gov/cyberframework/online-learning/five-functions

Updated OWASP Top 10 for 2021

Leave a reply

OWASP has updated its Top 10 list for 2021.

What is OWASP?

The Open Web Application Security Project (OWASP) is a non-profit foundation dedicated to improving the security of software. The Open Web Application Security Project® (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. OWASP is a repository of all things web-application-security, backed by the extensive knowledge and experience of its open community contributors.

What is the OWASP Top 10?

OWASP Top 10 is an online document on OWASP’s website that provides ranking of and remediation guidance for the top 10 most critical web application security risks. The report is based on a consensus among security experts from around the world. The risks are ranked and based on the frequency of discovered security defects, the severity of the vulnerabilities, and the magnitude of their potential impacts. The purpose of the report is to offer developers and web application security professionals insight into the most prevalent security risks so that they may incorporate the report’s findings and recommendations into their security practices, thereby minimizing the presence of these known risks in their applications.

Here’s the updated 2021 Top 10 list:

  • A01:2021-Broken Access Control moves up from the fifth position to the category with the most serious web application security risk; the contributed data indicates that on average, 3.81% of applications tested had one or more Common Weakness Enumerations (CWEs) with more than 318k occurrences of CWEs in this risk category. The 34 CWEs mapped to Broken Access Control had more occurrences in applications than any other category.
  • A02:2021-Cryptographic Failures shifts up one position to #2, previously known as A3:2017-Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed name focuses on failures related to cryptography as it has been implicitly before. This category often leads to sensitive data exposure or system compromise.
  • A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection with a max incidence rate of 19%, an average incidence rate of 3.37%, and the 33 CWEs mapped into this category have the second most occurrences in applications with 274k occurrences. Cross-site Scripting is now part of this category in this edition.
  • A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, we need more threat modeling, secure design patterns and principles, and reference architectures. An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks.
  • A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration, with an average incidence rate of 4.5%, and over 208k occurrences of CWEs mapped to this risk category. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for A4:2017-XML External Entities (XXE) is now part of this risk category.
  • A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
  • A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
  • A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. A8:2017-Insecure Deserialization is now a part of this larger category.
  • A09:2021-Security Logging and Monitoring Failures was previously A10:2017-Insufficient Logging & Monitoring and is added from the Top 10 community survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
  • A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.

Sources:

https://owasp.org/Top10/

https://www.synopsys.com/glossary/what-is-owasp-top-10.html

Securing Your Data on AWS S3

Leave a reply

If you store critical and sensitive data on the cloud, particularly on AWS S3 object storage, it is important that you continually protect and monitor your data. Fortunately, AWS has a lot of tools to help you secure them. AWS built their services with security in mind. However, it is still your responsibility as a data owner to protect your data.

Here are the top ten best practices for securing your data on AWS S3:

  1. Ensure that your S3 buckets are not publicly accessible by using Amazon S3 block public access.
  2. Ensure that your S3 buckets have the correct policies. Use Amazon S3 bucket policy and IAM user policy, as well as the bucket access control list (ACL) to implement effective permissions on the buckets. Make sure to implement least privilege access, granting only minimal rights for users to get their jobs done.
  3. Encrypt data at rest on the server side using Amazon S3 managed keys (SSE-S3), customer master keys stored in AWS Key Management Service (SSE-KMS), or customer-provided keys (SSE-C). You can also encrypt your data on the client side before uploading to AWS S3.
  4. Encrypt data in transit using HTTPS (TLS). You can enforce this by setting it in the Amazon S3 bucket policies.
  5. Enable and require VPC endpoints for AWS S3 access. A VPC endpoint can help prevent traffic from potentially traversing the open internet and being subject to the open internet environment.
  6. Enable versioning to keep multiple versions of a file in the same bucket. With versioning, you can easily recover files from both unintended user actions and application failures.
  7. Use cross-region replication (CRR) to replicate your data to a different AWS region, thereby increasing data resiliency.
  8. Enable multi factor authentication (MFA) Delete and S3 Object Lock feature to prevent malicious or accidental bucket deletions.
  9. Continually monitor and audit your S3 buckets by using AWS tools such as Cloudwatch, Cloudtrail, S3 access logging, and AWS Config.
  10. Use AWS Access Analyzer for S3 to quickly analyze resource policies, continuously monitor and analyze permissions, and resolve findings by updating policies.

Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html

Building and Operating a Private Cloud

Leave a reply

The future of computing is both public and private cloud. It may seem that public cloud – dominated by AWS, Microsoft Azure and Google – is now the norm, but companies will continue to run workloads that are best suited to be on premises. There are three main reasons for this. First, with large volume of data generated on-prem, storage and compute power need to be close since latency and distance are major issues. Second, there are studies which prove that consumption-based services offered by public cloud can be quite expensive after a certain threshold. Thus we hear some companies pulling back their storage and compute on premises to save money. Third, compliance and data sovereignty requirement by organization and governments are better controlled on-prem.

The challenge for most companies is how to build and operate on premises private cloud. Most companies have traditional data centers which are not suited any longer for delivering and maintaining reliable compute, storage, and network services to the rapidly changing business requirements. They should build and operate a private cloud that have the same characteristics of a public cloud – including on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service (read my blog on the Characteristics of a True Private Cloud).

Fortunately, companies such as VMware now offer a single integrated solution that enable companies to build and operate private cloud. For instance, the VMware Cloud Foundation based on underlying hyperconverged hardware (e.g. DellEMC VxRail), provides software-defined services for compute, storage, networking, security and cloud management to run enterprise traditional or containerized applications. It extended its VMware vSphere server virtualization platform with integrated software-defined storage (vSAN), networking (NSX), cloud management (vRealize suite), and security capabilities that can be consumed flexibly on premises. In addition, VMware Cloud Foundation delivers IT automation based on blueprints (templates), which embeds both automation and policy, and when executed will automatically orchestrate the provisioning and lifecycle of all the components in the blueprint.

Although some features are still not at par with the public cloud (such as the ease of self-service provisioning) , private cloud will continue to improve as more technologies are integrated or built on top of this private cloud foundation.

Using AWS S3 Storage Service as On-premises NAS

Leave a reply

One of the fastest ways to start utilizing storage services in the cloud  such as AWS S3 storage is by using AWS File Storage Gateway. 

File Storage Gateway is a hybrid cloud storage service that provides on-premises access to virtually unlimited cloud storage in AWS S3.  It presents one or more AWS S3 buckets and their objects as a mountable NFS or SMB share to one or more clients on-premises.  In effect, you have an on-premises NAS, which keeps hot data locally, but the backend connects to AWS S3 where data ultimately resides.  The main advantages of using File Storage Gateway are:

  1. Data on AWS S3 can be tiered and life cycled into cost-effective storage  
  2. Data can be processed on both on-prem and in AWS, using on-prem legacy applications and Amazon EC2-based applications
  3. Data can be shared by users located in multiple geographic locations

One disadvantage of using File Storage Gateway is that it is not optimized for large number of users/connections.  It is designed for small number of users (about 100 connections per gateway), but high volume of data (in TB o PB scale). 

Using Artificial Intelligence in Cyber Security Applications

Leave a reply

Artificial Intelligence (AI) and Machine Learning (ML) play critical roles in cyber security.  More and more cyber security applications are utilizing AI and ML to enhance their effectiveness.  The following are some of the applications that are taking advantage of ML algorithms.

Phishing Prevention. Phishing is a fraudulent attempt to obtain sensitive data by disguising oneself as a trustworthy entity. Detection of phishing attack is a classification problem. Training data fed into the ML system must contain phishing and legitimate website classes. By using learning algorithm, the system can be able to detect the unseen or not classified URL.

Botnet Detection. Botnet means an organized automated army of zombies which can be used for DDoS attack, sending spam, or spreading viruses.  Machine learning is now being used in detection and recognition of botnets to prevent attacks.

User Authentication. Authentication verifies the identity of a user, process. or device to allow only legit users to use the resources and services. Machine learning is now being used for adaptive authentication by learning user’s behavior.

Incident Forecasting. Predicting an incident before it occurs can save a company’s face and money.  Machine learning algorithms fed with incident reports and external data can now predict hacking incidents before they occur.

Cyber Ratings. Cyber ratings is used to assess the effectiveness of a cyber security infrastructure. Machine learning calculates cyber security ratings by getting information from multitude of security data from the web.

Spam filtering. Unwanted emails clogging user’s inbox have to be eliminated by using more dependable and robust antispam features.  Machine learning methods are now the most effective way of successfully detecting and filtering spam emails.

Malware Detection. Malware is getting more complex and being distributed more quickly.  Detecting them using signatures is not sufficient anymore.  Machine learning techniques are now being used for malware detection due to its ability to keep pace with malware evolution.

Intrusion Detection.  Intrusion detection identifies unusual access or attacks to secure internal networks. Machine learning techniques such as pattern classification, self-organizing maps and fuzzy logic are being used to detect intrusion.

User Behavior Monitoring. User behavior monitoring is an approach to insider threat prevention and detection. Machine learning techniques can help in creating an employee behavioral profile and setting off an early warning when insider threat is observed.

AWS Cloud Native Security Services

Leave a reply

Unlike legacy and most on-prem IT infrastructure, AWS cloud was build with security in mind.  AWS is responsible for the security “of” the cloud including hardware, hypervisors, and networks.  Customers are still responsible for the security of their data and applications “in” the cloud.  

To help customers, AWS offers numerous cloud native security tools.  This diagram, which I derived from the latest AWS Online Summit on May 13, 2020, depicts AWS services that customers can use when implementing the five NIST cybersecurity framework – Identify, Protect, Detect, Respond,  and Recover – to secure their data and applications in the cloud.

Source: AWS Summit May 2020 Security Presentation