Practical Cloud Security

Practical Cloud Security

Jason [email protected]

Tuesday, October 11, 2011

mailto:[email protected]


Agenda

• Background and Disclaimers

• Netflix in the Cloud

• Model-Driven Deployment Architecture

• APIs, Automation, and the Security Monkey

• Cloud Firewall and Connectivity Analysis

• Practical Cloud Security Gaps


Background and Disclaimers





• No cloud definitions, but . . .




• Focus on IaaS




• Focus on IaaS

• Netflix uses Amazon Web Services




• Focus on IaaS


• Guidance should be generally applicable




• Focus on IaaS


• Guidance should be generally applicable

• Works in progress, still many problems to solve . . .


Netflix in the Cloud


Why is Netflix Using Cloud?


!"#"$%&'#&($


!"#"$%&'#&($

Netflix could not build data centers fast enough


!"#"$%&'#&($

Netflix could not build data centers fast enoughCapacity requirements accelerating, unpredictable


!"#"$%&'#&($

Netflix could not build data centers fast enoughCapacity requirements accelerating, unpredictableProduct launch spikes - iPhone, Wii, PS2, XBox


Outgrowing Data Centerhttp://techblog.netflix.com/2011/02/redesigning-netflix-api.html

Netflix API: Growth in Requests


37x Growth 1/10 - 1/11




37x Growth 1/10 - 1/11




!"#"$%&#%'()"*"$+#,(

37x Growth 1/10 - 1/11




netflix.com is now ~100% Cloud


netflix.com is now ~100% Cloud

Remaining components being migrated


Netflix Model-Driven Architecture


Data Center Patterns



• Long-lived, non-elastic systems




• Push code and config to running systems





• Difficult to enforce deployment patterns






• ‘Snowflake phenomenon’






• ‘Snowflake phenomenon’

• Difficult to sync or reproduce environments (e.g. test and prod)


Cloud Patterns


Cloud Patterns

• Ephemeral nodes


Cloud Patterns

• Ephemeral nodes

• Dynamic scaling


Cloud Patterns

• Ephemeral nodes

• Dynamic scaling

• Hardware is abstracted


Cloud Patterns

• Ephemeral nodes

• Dynamic scaling


• Orchestration vs. manual steps


Cloud Patterns

• Ephemeral nodes

• Dynamic scaling


• Orchestration vs. manual steps

• Trivial to clone environments


When Moving to the Cloud, Leave Old Ways Behind . . .



Generic forklift is generally a mistake



Generic forklift is generally a mistakeAdapt development, deployment, and management

models appropriately



Generic forklift is generally a mistakeAdapt development, deployment, and management

models appropriately


Netflix Build and Deployhttp://techblog.netflix.com/2011/08/building-with-legos.html


http://techblog.netflix.com/2011/08/building-with-legos.html


Perforce

SCM





Perforce

SCM

Jenkins

ContinuousIntegration





Perforce

SCM

Jenkins


Artifactory

BinaryRepository





Perforce

SCM

Jenkins


Yum

App-SpecificPackages and Configuration

Artifactory

BinaryRepository





Perforce

SCM

Jenkins


Yum


Artifactory

BinaryRepository

Bakery

Combine Base and App-Specific Configuration





Perforce

SCM

Jenkins


Yum


AMI

Customized, Cloud-Ready

Image

Artifactory

BinaryRepository

Bakery






Perforce

SCM

Jenkins


Yum


AMI


Image

Artifactory

BinaryRepository

Bakery


ASG

DynamicScaling





Perforce

SCM

Jenkins


Yum


AMI


Image

Instance

Live System!

Artifactory

BinaryRepository

Bakery


ASG

DynamicScaling





Perforce

SCM

Jenkins


Yum


AMI


Image

Instance

Live System!

Artifactory

BinaryRepository

Bakery


ASG

DynamicScaling


Every change is a new pushTuesday, October 11, 2011



Results


Results

• No changes to running systems


Results


• No CMDB


Results


• No CMDB

• No systems management infrastructure


Results


• No CMDB

• No systems management infrastructure

• Fewer logins to prod systems


Impact on Security


Impact on Security

• File integrity monitoring


Impact on Security


• User activity monitoring


Impact on Security



• Vulnerability management


Impact on Security



• Vulnerability management

• Patch management


APIs, Automation, and the Security Monkey


Common Challenges forSecurity Engineers



• Lots of data from different sources, in different formats




• Too many administrative interfaces and disconnected systems




• Too many administrative interfaces and disconnected systems

• Too few options for scalable automation


Enter the Cloud . . .


How do you . . .


How do you . . .• Add a user account?



• Inventory systems?




• Change a firewall config?





• Snapshot a drive for forensic analysis?






• Disable a multi-factor authentication token?







• CreateUser()







• CreateUser()

• DescribeInstances()







• CreateUser()


• AuthorizeSecurityGroupIngress()







• CreateUser()



• CreateSnapshot()







• CreateUser()



• CreateSnapshot()

• DeactivateMFADevice()


Security Monkeyhttp://techblog.netflix.com/2011/07/netflix-simian-army.html


http://techblog.netflix.com/2011/07/netflix-simian-army.html



• Leverages cloud APIs






• Centralized framework for cloud security monitoring and analysis







• Certificate and cipher monitoring








• Firewall configuration checks








• Firewall configuration checks

• User/group/policy monitoring




Cloud Firewall and Connectivity Analysis


Analyzing Traditional Firewalls



• Positioned at network chokepoints, providing optimal internetwork visibility




• Use tools like tcpdump, NetFlow, centralized logging to gather data




• Use tools like tcpdump, NetFlow, centralized logging to gather data

• Review traffic patterns and optimize


AWS Firewalls (Briefly)



• “Security Group” is unit of measure for firewalling




• Policy-driven and network-agnostic, configuration follows an instance





• Network diagram irrelevant






• Chokepoints and sniffing are not possible






• Chokepoints and sniffing are not possible

• Outbound connections not filterable (!)


Security Group Analysis



• Use config and inventory to map reachability




• Leverage APIs to evaluate reachability and detect violations:





• Security groups with no members






• “Insecure” services (e.g. Telnet, FTP)







• Rules that use “any” keyword







• Rules that use “any” keyword

• Visualize config into data flow diagram


Reachability & Violation Analysis


Connectivity Analysis



• Reachability shows what “can” communicate




• What about what is communicating?





• Take same approach, leverage APIs for firewall and inventory and combine with host data





• Take same approach, leverage APIs for firewall and inventory and combine with host data

• Visualize data into connectivity diagram




‘Practical’ Cloud Security Gaps


Common Security Product Model



• Examples - AV, FIM, etc.




• “Management” station with client “nodes”





• Limited tagging or abstraction






• Strong “manager” and “managed” model







• Push and pull approaches







• Push and pull approaches

• Per node licensing


“Thundering Herd”



• Mass deployments




• “Red/Black” push - concurrent clusters of 500+ nodes





• Elasticity related to traffic spikes





• Elasticity related to traffic spikes

• Licensing constraints


Node Ephemerality and Service Abstraction



• Data related to individual nodes becomes less important




• Dealing with short-lived systems, IP and ID reuse




• Dealing with short-lived systems, IP and ID reuse

• Event and log archives and data relationships


Resource Usage Logging and Auditing



• Public-facing APIs make access controls more difficult and more important




• Programmable infrastructure needs robust logging and auditing capabilities




• Programmable infrastructure needs robust logging and auditing capabilities

• Can metering data be repurposed?


Identity Integration



• Federation use cases



• Federation use cases

• On-instance credentials


“Trusted Cloud”


“Trusted Cloud”

• Various components related to providing higher assurance/trust levels in the cloud


“Trusted Cloud”


• Virtual TPM / hardware root of trust


“Trusted Cloud”



• Controlled execution


“Trusted Cloud”



• Controlled execution

• HSM in the cloud


Thanks!Questions?

[email protected](I’m hiring!)




References

• http://www.slideshare.net/adrianco

• http://aws.amazon.com

• http://techblog.netflix.com

• http://nordsecmob.tkk.fi/Thesisworks/Soren%20Bleikertz.pdf

• https://cloudsecurityalliance.org/

• http://www.nist.gov/itl/cloud/index.cfm


http://www.slideshare.net/adrianco

http://www.slideshare.net/adrianco

http://nordsecmob.tkk.fi/Thesisworks/Soren%20Bleikertz.pdf




https://cloudsecurityalliance.org

https://cloudsecurityalliance.org

http://www.nist.gov/itl/cloud/index.cfm

http://www.nist.gov/itl/cloud/index.cfm

Art & Photos

Practical Cloud Security