Security architecture best practices

Security Architecture

Best Practices

for

SaaS Applications

24-March-2014

EII Customers & Project EngagementsAgendaInstructions

US | UK | BENELUX | ME | IND©1996-2015 Aspire Systems, Inc.

If you have any questions, please type them in the question tab located at the top

We will provide answers during the Q&A session towards the end of the webinar

Thanks for your participation and enjoy the session

Request all to take part in the survey that pops up

In case if you do not receive answers to your question today, you will certainly receive answers via email shortly

EII Customers & Project EngagementsAgendaSpeakers


Janaki Jayachandran Jothi Rengarajan

Cloud Solutions Architect,

Aspire Systems

Principal Architect – SaaS Solutions,

Aspire Systems

Global technology services firm with core DNA of software engineering

Specific areas of expertise around Software Engineering, Enterprise

Solutions, Testing and Infrastructure & Application Support

Vertical focus among Independent Software Vendors and Retail, Distribution

& Consumer Products

1400+ employees; 100+ active customers

ISO 9001:2008 and ISO 27001 : 2005 certified

Presence across US, UK, Benelux, Middle East and India

Recognized five consecutive times as “Best Place to Work for” by

GPW Institute

About Aspire

EII Customers & Project Engagements

Shared Responsibility Model

Infrastructure and network related security risks and solutions

Security considerations in each of the architecture layers

Data isolation risks and mitigation plans

Overview of OWASP Security threats

AgendaAgenda


“…sometimes risk is compensated with opportunity…”

Why Digitize?EII Customers & Project EngagementsAgendaThe Ever-growing Security Threat


Unsafe websites detected per week

Jan 2007 – Mar 2015

Why Digitize?EII Customers & Project EngagementsAgendaThe Ever-growing Security Threat


Sites hosting malware detected per week

Jan 2007 – Mar 2015

Why Digitize?EII Customers & Project EngagementsAgendaNotorious Nine Cloud Threats


Source: CSA Notorious Nine Top Threats

Data Breaches Data lossAccount/Service traffic hijacking

Insecure APIs Denial of ServiceMalicious Insiders

Abuse of cloud services

Insufficient Due Diligence

Shared Technology

http://www.informationweek.com/cloud/infrastructure-as-a-service/9-worst-cloud-security-threats/d/d-id/1114085?page_number=2

Why Digitize?EII Customers & Project EngagementsAgendaMajor Data Breach Incidents on Cloud


2015• In February 2015, Anthem suffered a data breach of nearly 80 million records.

2014• In August 2014, nearly 200 photographs of celebrities were posted to the image

board website 4chan.• In September 2014, Home Depot suffered a data breach of 56 million credit card

numbers.• In October 2014, Staples suffered a data breach of 1.16 million customer payment

cards.

2013• In October 2013, Adobe Systems revealed that their corporate data base was hacked

and some 130 million user records were stolen.• In late November to early December 2013, Target Corporation announced that data

from around 40 million credit and debit cards was stolen.

http://en.wikipedia.org/wiki/Anthem_Inc.

http://en.wikipedia.org/wiki/August_2014_celebrity_photo_leaks

http://en.wikipedia.org/wiki/4chan

http://en.wikipedia.org/wiki/Home_Depot

http://en.wikipedia.org/wiki/Staples_Inc.

http://en.wikipedia.org/wiki/Adobe_Systems

http://en.wikipedia.org/wiki/Target_Corporation

http://en.wikipedia.org/wiki/Credit_card

http://en.wikipedia.org/wiki/Debit_card

Why Digitize?EII Customers & Project EngagementsAgendaShared Responsibility Model


SaaS ISVs most commonly use IaaS services to deliver

their solution.

Why Digitize?EII Customers & Project EngagementsAgendaShared Responsibility Model


• Compliance with customer privacy and data protection laws

• Management of passwords/private keys

• IDM Management and access control

• Application authentication mechanism

• Management of OS, Security patches, etc.

SaaS Provider - ISV

• Physical support of infrastructure

• Physical infrastructure security and availability

• OS Patch management and hardening procedures

• Security platform configuration, maintenance and monitoring

• Increased ownership on managed services

Cloud/Infra Provider

Why Digitize?EII Customers & Project EngagementsAgendaHow Safe Is Your Data?


Why Digitize?EII Customers & Project EngagementsAgendaHow safe is your data?


United States

United Kingdom

Canada

Australia

Germany

Source: Hogan Lovells White Paper on Governmental Access

http://www.hldataprotection.com/2012/05/articles/international-eu-privacy/hogan-lovells-white-paper-on-governmental-access-to-data-in-the-cloud-debunks-faulty-assumption-that-us-access-is-unique/

Why Digitize?EII Customers & Project EngagementsAgendaHardware Level Risks


Virtualization software used

Implement encryption best practices at all layers/services

Logically group environments and restrict

access within them

Leverage Dedicated Tenancy level groupings to minimize

risks

Define the protocol for accessing keys

Why Digitize?EII Customers & Project EngagementsAgendaOS Security and Access


Patch management

Operating System

Anti-Virus and Anti-malware

OS Monitoring

Penetration testing and vulnerability scanning

Data Redundancy

Why Digitize?EII Customers & Project EngagementsAgendaNetwork Security and Access


Compliance standards –PCI, HIPPA, etc.

Network firewall Virtual Private Network

Single Sign On Inter region and intra region transfer of data

Backup data storage location and access

control

Why Digitize?EII Customers & Project EngagementsAgendaInternational Security Standards


COBIT 5 – Controls and Assurance in the Cloud

CSA Guides

AICPA Service Organization Control (SOC) 1 Report

AICPA/CICA Trust Services (SysTrust and WebTrust)

ISO 2700x— Information security management system (ISMS)

Cloud Security Matrix—By Cloud Security Alliance

NIST SP 800-53—The NIST IT security controls standards, Health Information Trust Alliance (HITRUST)

BITS—The BITS Shared Assessment Program

contains the Standardized Information Gathering (SIG) questionnaire and Agreed Upon Procedures (AUP).

European Network and Information Security Agency (ENISA)

Cloud Computing—Benefits, Risks and Recommendations for Information Security.

Poll

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaSaaS Security Architecture Goals


Protection of information. It deals with the prevention and detection of unauthorized actions and ensuring confidentiality, integrity of data.

SaaS Application Security Areas

• Database access control

• SaaS application access control

• Access control for third party applications/ Mobile layer which are integrated to your SaaS application

• Data at transit security

• Data at rest security

• Audits

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaTenant Data Isolation


Design for a Hybrid Approach

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaTenant Data Isolation


DB Interceptor

Service Security Scanner

Tenant Based View Filter

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaACL Architecture


EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaRole Based Access Control (RBAC) - Authentication


Custom Username

Password

Authentication

AD Integrated

SSO

Open ID

Authentication

Multi factor

authentication

Hybrid

Authentication

Support

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaRole Based Access Control (RBAC)


ACL For

Resources

Web

Endpoints

Rest

Endpoints

Actions

Data

Fields

Identity Management

ACL Metadata/ Definition

service

Decision Service

Enforcement Service

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaREST API Access Control


Identity

• Common

identity for an

application

• Granular User

Identity

Sources

• External

Applications

• Mobile

Applications

Mechanisms

• Access Keys

• OAUTH 2.0

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaOWASP – Top Threats


A1

Injection

A2

Broken Authentication and Session Management (was

formerly A3)

A3

Cross-Site Scripting (XSS) (was formerly A2)

A4

Insecure Direct Object References

A5

Security Misconfiguration (was formerly A6)

A6

Sensitive Data Exposure (merged from former A7 Insecure Cryptographic Storage and former A9

Insufficient Transport Layer Protection)

A7

Missing Function Level Access Control

(renamed/broadened from former A8 Failure to Restrict URL Access)

A8

Cross-Site Request Forgery (CSRF) (was formerly A5)

A9

Using Known Vulnerable Components (new but was

part of former A6 –Security Misconfiguration)

A10

Unvalidated Redirects and Forwards

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaSecurity Testing


Dynamic

Testing

Static

Testing

Security

Verification

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaData at Transit and Rest


Data at Rest

• Adopt Symmetric Key encryption

• Use Strong Keys

• Encrypt Your Encryption key

• Use Strong Key Stores

• Keep the Key Away From Data

Data at Transit

• Browser to web. This can be secured via https.

• Between web and services. This can also be secured using https in case of

rest services

• Direct access to application services - secured via https or you could use

message encoding. If it is soap based services use ws* security protocol

• Application to database – Servers such as oracle and MSSQL server

support

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaSecurity Audit


User Action Audit

• Audit all user actions

• Capture the entry URL, time, location details, browser details,

response status, any exceptions

• Provide analysis on the user actions

• Can be customized at application layer or can use the webserver

logs





Event Audit

• Audit positive events, more importantly

audit negative events

• Should cover,

• Who does the action?

• What action is performed?

• What is the context in which the

operation is performed?

• What time is the action performed?

• Audit details stored in a separate datastore

for better performance

• Real-time audit details – audit cache server



Transaction and Change Audit

• Transaction Audit

• Snapshot: Exact copy of the row stored in history tables

• More suitable if requests to access past data are more

• More data growth

• Change Audit

• Only the delta of the state change captured as part of change tables

• More suitable when changes need to be reported and past data are not required

much

• Used more for Security tracking purposes

• Easier to implement by using methods available out of the box in RDBMS such as CDC

for SQL server

• Asynchronous Mode : For better performance and if we wish that audit should not roll

back the transactions it is advisable to audit in a asynchronous thread.

EII Customers & Project EngagementsEssential Elements of an Ideal Digital strategyWhy Digitize?EII Customers & Project EngagementsAgendaAnti-Patterns


Let me summarize some of the anti-patterns in security of a SaaS

application. Unfortunately we also find it a lot in practice.

• Opening the DB access to tenants directly

• Depending on the developers to handle tenant isolation

• Storing Keys for encryption loosely

• Storing connection strings without encryption

• Encrypting unnecessary data

• Loose physical access policy for the production database

• Rigid access control tied to roles instead of privileges

• Depending on developers to handle authorization checks

• Loose authentication mechanism for rest service calls or other gateways

• Lack of access control enforcement at the service layer

• Lack of Audits

Q & A

Thank You