Cloud Security Alliance Security as a Service white paper press release

Can be found here;

https://cloudsecurityalliance.org/csa-news/csa-issues-first-secaas-white-paper/

 

I know I have mentioned this work already, but this is the official press release from the Cloud Security Alliance for the Security as a Service Categories of Service 2011 white paper.

Exciting for me as I actually wrote much of the release as well as my roles contributing to the paper and managing the groups work as one of the co-chairs.  Big thanks to Zenobia at Zag Communications for bringing the press release together.

K

 

Security as a Service – Defined Categories of Service 2011 white paper published!

The first officially published work from the recently formed Cloud Security Aliance – Security as a Service (SecaaS) working group has been published.  This is a great first step as we have identified the key categories of service that can / will make up security as a service.

This document can be found here;

https://cloudsecurityalliance.org/wp-content/uploads/2011/09/SecaaS_V1_0.pdf

I’m personally very proud of this work as I am the co-chair for the Security as a Service working group which has meant bringing together input from multiple streams of expersts working from many global locations and different time zones.  I have also had to arbitrate any disagreements around content and ensure all experts who wanted to participate were able to provide their input.

In addition to the coordinating the various inputs and running steering meetings I also provided input into various categories where extra detail was required and also wrote most of one category that wasn’t picked up by the various experts who volunteered to help.

Our next steps are to to be finalised but they are likely to include;

– Finalising the version of the document that will be put forward towards an ISO standard

– Working on getting SecaaS added as the 14th domain of the official Cloud Security Alliance guidance

– Creating implementation guidance and examples for those looking to implement various SecaaS solutions

Watch this space and / or check in on the Cloud Security Alliance web site for progress updates.

K

PCI-DSS Virtualisation Guidance

In what was obviously a response to my recent blog post stating
more detailed guidance would be helpful (yes I am that influential!) the ‘PCI
Security Standards Council Virtualisation Special Interest Group’ have just
released the ‘PCI DSS Virtualisation Guidelines’ Information Supplement.

This can be found here;

https://www.pcisecuritystandards.org/documents/Virtualization_InfoSupp_v2.pdf

This is a welcome addition to the PCI-DSS as it makes the
requirements for handling card data in a virtual environment much more clear.
The use of the recommendations in this document along with the reference
architecture linked to in my previous post will provide a solid basis for
designing PCI-DSS compliant virtual environment.

The document itself is in 3 main sections. These comprise;

– ‘Virtualisation Overview’ which outlines the various components
of a virtual environment such as hosts, hypervisor, guests etc. and under what
circumstances they become in scope of the PCI-DSS

– ‘Risks for Virtualised Environments’ outlines the key risks
associated with keeping data safe in a virtual environment including the
increased attack surface or having a hypervisor, multiple functions per system,
in memory data potentially being saved to disk, Guests of different trust
levels on the same host etc. along with procedural issues such as a potential
lack of separation of duties.

– ‘Recommendations’; This section is the meat of the document that
will be of main interest to most of the audience as it details the PCI’s recommended
actions and best practices to meet the DSS requirements. This is split into 4
sections;

– General –
Covering broad topics such as evaluating risk, understanding the standard,
restricting physical access, defence in depth, hardening etc.   There is also a recommendation to review other guidance such as that from NIST (National Institute of Standards Technology), SANS (SysAdmin Audit Network Security) etc. – this is generally
good advice for any situation where a solid understanding of how to secure a
system is required.

– Recommendations for Mixed Mode Environments –

This is a key section for most businesses as the reality for most of us is that being able to run a mixed mode environment, (where guests in scope of PCI-DSS and guests not hosting card data are able to reside on the same hosts and virtual environment via acceptable logical separation), are the best option in order to gain the maximum benefits from virtualisation.  This section is rather shorter than expected with little detail other than many warnings about how difficult true separation can be.  On a bright note it does clearly
say that as long as separation of PCI-DSS guests and none PCI-DSS guests can be configured and I would imagine audited then this mode of operating is permitted.  Thus by separating the Virtual networks and segregating the guests into separate resource pools, along with the use of virtual IPS appliances and likely some sort of auditing (e.g. a netflow monitoring tool) it should be very possible to meet the DSS requirements in a mixed mode virtual environment.

– Recommendations for Cloud Computing Environments –

This section outlines various cloud scenarios such as Public / Private / Hybrid along with the different service offerings such as IaaS (Infrastructure as a Service), PaaS (Platform as a Service), SaaS (Software as a Service).  Overall it is highlighted that in many cloud scenarios it may not be possible to meet PCI-DSS requirements due to the complexities around understanding where the data resides at all times and multi tenancy etc.

– Guidance for Assessing Risks in Virtual Environments –

This is a brief section outlining areas to consider when performing a risk assessment, these are fairly standard and include Defining the environment, Identifying threats and vulnerabilities.

Overall this is a useful step forward for the PCI-DSS as it clearly shows that the PCI are moving with the times and understanding that the use of virtual environments can indeed be secure providing it is well managed, correctly configured and audited.

If you want to make use of virtualisation for the benefits of consolidation, resilience and management etc. and your environment handles card data this along with the aforementioned reference architecture should be high on your reading list.

K

 

Security as a Service – Category and Threat Definitions

We are currently in phase one of producing the Security as a Service guidance documentation;

–          Agreeing and documenting categories of service and their definitions

–          Agreeing and documenting categories of threats and their definitions

So far the top five categories of service are;

    1. IAM
    2. DLP
    3. Secure Web Gateway
    4. Vulnerability Assessments
    5. Pen Testing
    6. Intrusion Detection
    7. Encryption
    8. Log Management

With several further categories in the mix.  We will be looking to consolidate the above categories and the others identified into sensible easy to understand groupings.   For example it is likely that ‘vulnerability assessment’ and ‘pen testing’ will be a single category.

The top categories of threat identified are currently;

    1. Data Loss Leakage
    2. Traffic Hijacking
    3. Unauthorized Access
    4. Denial of Service
    5. Application Vulnerabilities

With about forty further ideas being assessed in the same way as for categories of service.

Should you have any ideas please do let me know either by posting a comment on this blog or by mailing me on LinkedIn, any assistance is greatly welcomed!

K

 

Cloud Security as a Service RSA conference presentation

An overview of the Cloud Security as a Service (SecaaS) working group goals, outputs and proposed timeline was presented at the RSA conference on the 14th of February.  His has been recorded for prosperity and uploaded to YouTube.  The presentation can be found here;

http://www.youtube.com/watch?v=fzejQuSR_xU

This gives a great update on one of the things I’ll be working on during the next few months.  Check the video out, fell free to ask me any questions you have, and of course if interested get involved and provide feedback via the surveys mentioned in the presentation.

K

Cloud Security Alliance – Security as a Service

For those interested in cloud security options, I am currently on the steering committee for the Security as a Service (SecaaS) working group.  In this instance I mean how cloud computing can be used to secure everything, including cloud and non cloud based IT, rather than how to secure cloud computing (paraphrased from Jim Reavis).

If you are not familiar with the Cloud Security Alliance I suggest you check out their site, it is a great resource for all things cloud security related and can be found here;

http://www.cloudsecurityalliance.org/

The purpose of the specific SecaaS working group is to;

 – Identify consensus definitions of what security as a Service means

 – Categorise the different types of Security as a Service

 – Provide guidance to organisations on reasonable implementation practices

The site specific to the SecaaS work can be found here;

http://www.cloudsecurityalliance.org/secaas.html

Proposed timelines for the work we produce are for;

 – Categories of service to be defined by late April.

 – Draft SecaaS Guidance, mid-May.

 – SME Guide, mid-July.

 – Final Draft SecaaS Guidance, mid-September.

This should be a great piece of work so I will keep you updated with our progress.

K

Cloud; Barriers to adoption

My second post relating to cloud computing will focus at a high level on what seems to be the current major barrier(s) to the wider adoption of cloud use by businesses.

Future posts will likely go into more detail around technical threats such as side channel attacks (e.g. trying to connect to the target guest server from another guest known to be on the same host) and cartography (“mapping” the target environment by methods such as traffic sniffing and analysis), but this one will focus on providing a high level overview of the risks and fears around moving to the ‘cloud’.

It is already clear that in many instances the elasticity (ability to scale up and down on demand), resilience and cost vs. hosting services internally can offer clear benefits to businesses.  So why then are many businesses reticent to move completely or even partially into the cloud?

Outside of any general resistance to change the main concern is with security and regulatory requirements.

When infrastructure and applications are hosted internally you intrinsically feel that your data, and that of your customers, is safer.  Outside of potential ‘insider’ threats, data on your servers in your server room is inside your companies perimeter, no matter how porous this may be, protected by your firewall(s), AV(Anti Virus), DLP (Data Leakage Protection) tools, trusted staff and company policies.  Even when the data leaves site it is likely on managed, and hopefully encrypted, tapes or via a managed, and hopefully encrypted, network link to a DR / BCP site.

Now when you move to using the cloud in some way your systems and data are hosted elsewhere, potentially moving across multiple physical servers or even datacentres outside of your control.  This movement along with the environment being shared by other companies (e.g. multiple businesses may have guests on the same physical host) are the primary drivers of fear around the security of systems in the cloud.  Using the cloud also obviously shares various concerns with other forms of hosting / co-location around third party access to data etc.

Hand in hand with security are regulatory / compliance concerns that also stem from the above features of using the cloud;

–          Who can audit the systems and overall cloud?

–          Does the data move across state boundaries (e.g. does it leave the UK or the EU?)

–          Who could potentially access the data?

–          What happens in a disaster recovery scenario?

–          How can you move to another provider? (Vendor lock in concerns)

–          How is the data deleted from the cloud (data retention / incomplete deletion concerns).

Various measures exist to mitigate the risks, these include –

–          Procedural; Ensuring due diligence is carried out prior to engaging the vendor and contracts are in place to ensure adherence to legal / regulatory requirements.

–          Security checks; Regular penetration tests and other security checks of the vendors systems and facilities should be carried out, and any issues identified remediated within agreed time frames

–          Encryption; ensure all sensitive data (ideally all data if possible) is encrypted in transit and at rest – this prevents prying and mitigates risk of data not being deleted

–          Authentication; ensure all systems in the cloud utilise strong authentication methods to prevent unauthorised access.

The ENISA (European Network and Information Security Agency) report titled ‘Cloud Computing Security Risk Assessment’ neatly sums up the benefits of cloud and the security concerns;

The key conclusion of this paper is that the cloud’s economies of scale and flexibility are both a friend and a foe from a security point of view. The massive concentrations of resources and data present a more attractive target to attackers, but cloud-based defences can be more robust, scalable and cost-effective.

K

Is the Cloud something new?

This will likely be the first post of several relating to ‘cloud’ computing / the cloud.  This is one of the buzz words of the moment with many vendors pushing a variety of cloud services.

Cloud is currently a very nebulous term that encompasses various services such as IAAS (Infrastructure As A Service), SAAS (Software As A Service), PAAS (Platform As A Service).  All of these have been available for some time.

The combination of readily available, resilient and fast connectivity to the internet, along with big players such as Amazon, Google and Microsoft offering various ‘cloud’ services have made it into a the current / next IT buzz of the last few years.

Make no mistake, the concept of outsourcing IT services and infrastructure is not new, but its use is definitely growing and the umbrella term cloud is both as it has caused much great discussion around the benefits and issues of using these services (as well as some confusion around exactly what cloud stands for!).

Cloud offers great benefits to businesses allowing access to flexible and resilient IT infrastructure at a lower cost than purchasing the infrastructure directly.  Larger enterprises can implement internal clouds to allow multiple parts of the enterprise the ability to leverage flexible infrastructure and application performance without their data leaving the control of the enterprise.

Businesses do not have to be ‘all in’ with the cloud, they can utilise a hybrid strategy with certain services such as test and development or specific applications outsourced to the cloud while critical applications and data remain in the control of the business itself.

For anyone reading who thinks they do not yet use cloud services, think about your web usage – do you use web mail of any sort? Online office tools such as Google Docs or Microsoft office online? Blogging applications such as WordPress or Blogger? – these are all cloud services, your data is stored in the cloud somewhere, you can access it from anywhere without ever actually knowing where the applications are running from or where the data is stored!

Upcoming posts will focus on areas such as;

–          Cloud security – where is your data? Who can access it? How is it stored? Is your access guaranteed? Are there regulatory issues?

–          Cloud benefits and issues – variable performance, ease of scaling, reliance on network access.

–          Types of offerings – public vs. private clouds, hybrid solutions, dedicated vs. multi tenancy.

K