Module: Cloud Computing Security Professor Trent Jaeger Penn State - PowerPoint PPT Presentation

�������฀฀���฀฀�������� ��������������฀�������� � � �������฀���฀��������฀��������฀������ ����������฀��฀��������฀�������฀���฀����������� ������������฀�����฀�����������฀����������฀����฀฀�� Module: Cloud Computing Security Professor Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) Page 1 1

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-1

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-2

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-3

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-4

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-5

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-6

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-7

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-8

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-9

Cloud Computing Is Here Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-10

Cloud Computing Is Here Why not use it? Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2 2-11

What’s Happening in There? Systems and Internet Infrastructure Security (SIIS) Laboratory Page 3 3

From Data Center to Cloud Systems and Internet Infrastructure Security (SIIS) Laboratory Page 4 4-1

From Data Center to Cloud Systems and Internet Infrastructure Security (SIIS) Laboratory Page 4 4-2

From Data Center to Cloud Systems and Internet Infrastructure Security (SIIS) Laboratory Page 4 4-3

Reasons to Doubt • History has shown they are vulnerable to attack ‣ SLAs, audits, and armed guards offer few guarantees ‣ Insiders can subvert even hardened systems Incident Attack Vector Data Loss Incidents 986 903 Accidental 770 23% 695 678 641 External Insider 54% 16% Unknown 7% ‘06 ‘07 ‘08 ‘09 ‘10 ‘11 Credit: The Open Security Foundation datalossdb.org Systems and Internet Infrastructure Security Laboratory (SIIS) Page 5 5

Cloudy Future • New problem or new solution? ‣ New challenges brought on by the cloud (plus old ones) ‣ Utility could provide a foundation for solving such challenges Systems and Internet Infrastructure Security (SIIS) Laboratory Page 6 6

What is Cloud Computing? • Cloud vendor provides managed computing resources for rent by customers • What do you want to rent? ‣ (Virtualized) Hosts (Infrastructure as a Service) • Rent cycles: Amazon EC2, Rackspace Cloud Servers, OpenStack ‣ Environment (Platform as a Service) • Rent instances: Microsoft Azure, Google App Engine ‣ Programs (Software as a Service) • Rent services: Salesforce, Google Docs • Other variations can be rented Systems and Internet Infrastructure Security Laboratory (SIIS) Page 7 7

What is Cloud Computing? Systems and Internet Infrastructure Security Laboratory (SIIS) Page 8 8

IaaS Platform: OpenStack Cloud Client Customer Cloud API Cloud Instances Database Cloud Message Queue Node Cloud Vendor Image Volume Network Scheduler Store Store Controller Systems and Internet Infrastructure Security (SIIS) Laboratory Page 9 9

How to Build an IaaS Cloud? • Vendors obtain hardware resources for ‣ Various cloud services: API, Messages, Storage, Network, ... ‣ Compute nodes for running customer workloads • Install your hardware ‣ Need to choose software configurations specific for services and compute nodes • Start your hosts ‣ Join the cloud - services and available compute nodes • Now your cloud is running ‣ Have fun! Customers are ready to use your services and nodes Systems and Internet Infrastructure Security Laboratory (SIIS) Page 10 10

How to Use an IaaS Cloud? • Customers choose an OS distribution ‣ These are published by the cloud vendor and others ‣ Obtain cloud storage necessary to store these and your data • Configure your instance (VM) ‣ Prior to starting - enable you to login and others to access the instance’s services • Start your instance ‣ Boots the chosen OS distribution with the configurations • Now your instance is running ‣ Have fun! Login via SSH or ready for your clients Systems and Internet Infrastructure Security Laboratory (SIIS) Page 11 11

Cloud Complexity • Cloud environment challenges ‣ Opaque, Complex, Dynamic ‣ Insiders, Instances, Co-hosting Client Service Systems and Internet Infrastructure Security Laboratory (SIIS) Page 12 12-1

Cloud Complexity • Cloud environment challenges ‣ Opaque, Complex, Dynamic ‣ Insiders, Instances, Co-hosting Cloud Cloud Cloud Client Node Node Platform Cloud Cloud Node Node Systems and Internet Infrastructure Security Laboratory (SIIS) Page 12 12-2

Cloud Complexity • Cloud environment challenges ‣ Opaque, Complex, Dynamic ‣ Insiders, Instances, Co-hosting Cloud Cloud Client Node Node Cloud Cloud Node Node Systems and Internet Infrastructure Security Laboratory (SIIS) Page 12 12-3

Cloud Complexity • Cloud environment challenges ‣ Opaque, Complex, Dynamic ‣ Insiders, Instances, Co-hosting VM Cloud Cloud Client Node Node Cloud Cloud Node Node Systems and Internet Infrastructure Security Laboratory (SIIS) Page 12 12-4

Cloud Complexity • Cloud environment challenges ‣ Opaque, Complex, Dynamic ‣ Insiders, Instances, Co-hosting VM Cloud Cloud Client Node Node Cloud Cloud Node Node Systems and Internet Infrastructure Security Laboratory (SIIS) Page 12 12-5

Cloud Complexity • Cloud environment challenges ‣ Opaque, Complex, Dynamic ‣ Insiders, Instances, Co-hosting VM VM Cloud Cloud Client Node Node Cloud Cloud Node Node Systems and Internet Infrastructure Security Laboratory (SIIS) Page 12 12-6

Cloud Complexity • Cloud environment challenges ‣ Opaque, Complex, Dynamic ‣ Insiders, Instances, Co-hosting VM VM Cloud Cloud Client Node Node Cloud Cloud Node Node Systems and Internet Infrastructure Security Laboratory (SIIS) Page 12 12-7

Cloud Complexity • Cloud environment challenges ‣ Opaque, Complex, Dynamic ‣ Insiders, Instances, Co-hosting VM VM VM Cloud Cloud Client Node Node VM Cloud Cloud Node Node Systems and Internet Infrastructure Security Laboratory (SIIS) Page 12 12-8

Cloud Complexity • Cloud environment challenges ‣ Opaque, Complex, Dynamic ‣ Insiders, Instances, Co-hosting VM VM Cloud Cloud Client Node Node VM VM Cloud Cloud Node Node Systems and Internet Infrastructure Security Laboratory (SIIS) Page 12 12-9

What Could Go Wrong? • What do customers depend on from the cloud? ‣ Trust Model ‣ Are those parties worthy of our trust? • Who are potential adversaries in the cloud? ‣ Threat Model ‣ Are customers protected from their threats? • What would be ideal from a security standpoint? ‣ Ideal Security Model ‣ How many trusted parties and how many threats? Systems and Internet Infrastructure Security Laboratory (SIIS) Page 13 13

Published Instances Consumers use published instances !),/%0()* !"#$%&'((& -.&/#012$+,& 3.&405*6076*,& =05*60/,>3 '?=>3& )*#+,& !"#$%&'()* '?=>3 & 9.&($:"45;& 8.&$5,& =05*60/,>- '?=>-& '?=>- & <.&405*6076*,& +,-&".()* Who do you trust? What are threats? Systems and Internet Infrastructure Security (SIIS) Laboratory Page 14 14

SSH Study [AmazonIA] • Publisher left an SSH user authentication key in their AMI • Fortunately, Amazon agreed that this is a violation ‣ Unfortunately, it was not an isolated problem • 30% of 1100 AMIs checked contained such a key ‣ Also, pre-configured AMIs had SSH host keys • Thus, all instances use the same host key pair • Implications? Systems and Internet Infrastructure Security Laboratory (SIIS) Page 15 15

Security Configuration ‣ Zillions of security-relevant configurations for instances • Do you have the right code and data installed? • Are you running the expected code? • Discretionary access control • Firewalls • Mandatory access control SELinux, AppArmor, TrustedBSD, Trusted Solaris, MIC ‣ • Application policies (e.g., Database, Apache) • Pluggable Authentication Modules (PAM) • Application configuration files ‣ Plus new configuration tasks for the cloud - e.g., storage Systems and Internet Infrastructure Security (SIIS) Laboratory Page 16 16