By Michael Haines
Sr.
vCloud Architect (Security)
I am sure you are not surprised to hear that
'Security' in the Cloud is one of the hottest issues for organizations wanting
to architect and deploy a Cloud solution and service offering. So, where do you
begin? In this blog I will highlight some of the potential security concerns
you should understand when architecting and offering a Cloud solution or
service:
- Physical Security
Physical security, often overlooked, is elemental to
the foundation of an organization’s security, and is therefore a great place to
start. After all, if attackers can walk off with a hard disk and server, they
have (at the least) denied you availability. If a co-worker throws away a DVD
containing proprietary information that a criminal could recover, then
confidentiality has been lost. If a disgruntled employee can access a key
database and change amounts, values, or data, integrity has been lost.
- Access Control
Access control is a key component of security because
it helps to keep unauthorized users out. It is part of what is known as the
triple A process of authentication, authorization and accountability.
Authentication systems based on passwords have been used for many years. Today,
many organizations even enforce two-factor authentication. Security
administrators in the Cloud have more to worry about than just authentication.
Most employees now have multiple accounts. However, there is a way to consolidate
these accounts using SSO, single sign-on. I will explain more later in this
blog, but it is key.
- Security Models
The security architecture and model mainly deal with
hardware, software, security controls, and documentation. When hardware is
designed, it needs to be built to specific standards that should provide
mechanisms to protect the confidentiality, integrity, and availability of the
data. The operating systems that will run on the hardware must also be designed
in such a way as to ensure security. Building secure hardware and operating
systems is just the start! Both vendors and customers need to have a way to
verify that hardware and software perform as stated and that both the vender
and client can rate these systems and have some level of assurance that such
systems will function in a known manner. This is the purpose of evaluation
criteria, which allows the parties involved to have a level of assurance.
Although a robust security model is a good place to start, providing real
security architecture requires that you also have the ability to control
processes and applications.
- Network Security
In the telecommunications and network security area,
we need to understand both network communications and network security. This
area covers many, many aspects, including TCP/IP, LAN, WAN, wireless
networking, and related security controls to name but a few. Also understanding
the data communication process and how it relates to network security is very
important Knowledge of remote access, firewalls, network switches, and network
protocols is a must. Understanding network security plays a key role in
preventing network-based attacks. Security should be implemented in layers to
erect several barriers against attackers. A good example of network access
control is a firewall. The firewall can act as a choke point to control traffic
as it ingresses and egresses the network. Another network access control is the
DMZ (demilitarized zone), which establishes a safe zone for internal and
external users to work. Typically, the DMZ contains devices accessible to
Internet traffic, such as Web (HTTP) servers, FTP servers, SMTP (e-mail)
servers and DNS servers.
- Application and Systems Security
Software plays a key role in the productivity of most
organizations, yet our acceptance of it is different from everything else we
tend to deal with. For example, if you were to buy an item from a manufacturer
that had a defective component, you would expect the manufacturer to recall the
item in question. However, if a user purchases a software product, the
purchaser has little or no recourse. The purchaser could potentially wait for a
patch to be released, or wait for an upgrade, or more drastically just purchase
an alternative vendor’s product! It is imperative that applications are written
well as they are an essential element in providing good security.
- Regulatory Compliance
Providing an organization’s information assets is key
to providing information security and risk management. This step will also
identity critical pieces of security information as well as policies,
procedures and guidelines. To an organization this is very important, as it
lays out how an organization manages its security policies and practices. In
turn these are used as roadmap, which demonstrates the level and amount of
governance an organization possesses.
- Information Security: Confidentiality, Integrity
and Availability
Confidentiality, integrity, and availability define
the basic building blocks of any good security initiative. Circumventing
security threats, attacks and vulnerabilities on your organization is a very
serious issue. These attacks are generally aimed at confidentiality and
integrity. They potentially give an attacker access to your data and
availability and can result in denial of service attacks (DoS). These attackers
in principle follow an attack methodology and pose a real threat. Websites
including Yahoo and eBay have been shut down due to persistent DDoS attacks,
which is similar to a DoS attack, except the attack is executed from multiple,
distributed agent IP devices.
We also need to take a brief look at what the
information security objectives are. This is a process that organizations rely
on, and is designed to identify, measure, control, and manage the risks to
information and information systems. The five phases of this process are continuous.
The goal of the risk assessment phase is to provide recommendations to develop
a reliable, and cost effective security strategy. Within an organization, some
data will always be at risk.
Risk assessors must prioritize risks to determine the
confidentiality level of the data as well as the likelihood and consequences of
the data ending up in the wrong hands. The effectiveness of current controls must
also beevaluated during this phase. These risk ratings are then used to
recommend appropriate, cost-effect security controls.
The next phase of the process is strategy
development. During this phase, security managers use the information provided
from the risk assessment report to develop a plan to mitigate risks and comply
with internal and external policies and requirements. The security strategy
includes methods for preventing, detecting, and responding to security events.
Following are the basic steps involved to develop a
security strategy:
1. Assess the Security Risks
2. Develop a Security Strategy
3. Implement your Security Controls
4. Monitor your Security Environment
5. Analyse and further Update your Security Strategy
These are the basic security principles you need to
be aware of when looking at security in the Cloud. The following also gives you
an insight into a few of the most common vulnerabilities in the Cloud:
- Unsecured Network Interfaces and Networks
- Excess Privileges
- Mis-configuration or Poor Management
- Un-patched Vulnerabilities
As I mentioned earlier, one of the areas that is
seeing continued interest and exposure is the ability to provide single sign-on
(SSO) functionality. In this context, what if your organization has an
application that allows access to only authorized users? All users must enter
their credentials to get access to the application in question. While they are
using the application, they find links to other applications. Well, this
presents a potential issue as when they try to access these other links, they
discover they must enter their credentials again to access another application.
Of course, users get very annoyed by this behavior and having to enter their
credentials multiple times. By using sign-on (SSO), users get the ability to
log on to the parent application one time and automatically gain access to the
other applications.
Summary
VMware is very serious about the Cloud and security,
and we provide resources that are available on-line in the areas of security
and compliance. For more information on how to stay up-to-date on securing your
virtual infrastructure, please take a look at the following:
- Hardening best practices
- Implementation guidelines
Security: http://vmware.com/go/security
- Security blog and white papers
- Advisories
- Alerts
- Certifications and validations
VMware Security Center:
http://www.vmware.com/security/
- Partner solutions
- Advice and recommendations
Compliance: http://vmware.com/go/compliance
- Peer-contributed content
Operations: http://viops.vmware.com
