Experts in IT-Security and Software Engineering

Transkript

1 V1.3b 2012 by keyon ( About Keyon Experts in IT-Security and Software Engineering 1

2 Threats, risks and how to classify them Cloud Security The Notorious Nine Cloud Computing Top Threats in Cloud Computing Top Threats in 2013 Survey Results

3 1.0 Top Threat: Data Breaches (Confidentiality) 1.0 Top Threat: Data Breaches (Confidentiality) The organization s sensitive data falls into the hands of their competitors or any foreign party. Measures: Accept the risk and trust to the cloud service provider Data encryption, especially IRM Information Rights Management (IRM) 3

4 1.0 Top Threat: Data Breaches (Confidentiality) Information Rights Management (IRM) Mit Information Rights Management können vertrauliche Daten und E- Mails vor unberechtigtem Zugriff effizient geschützt werden. Im Unterschied zu anderen Technologien ist der Schutz untrennbar mit den jeweiligen Daten verbunden und bietet somit einen fortwährenden und für den Benutzer transparenten Schutz, unabhängig vom Speicherort oder flankierenden Sicherheitsmechanismen. Trennen der Businessdaten von IT-Administratoren Dynamisch und flexibel Stellvertretungsregelungen Gewähren einer zeitlich beschränkten Einsicht Einschränken der Weiterleitung von s Einschränken von Ausdruck / copy-paste 1.0 Top Threat: Data Breaches (Confidentiality) The ultimate goal of IRM is to prevent leakage of confidential information Protection applies solely on the client side. Protect information, no matter where is stored, no matter where it goes Organization Cloud AD-RMS MS Exchange Client Storage Application / Storage Any Application 4

5 1.0 Top Threat: Data Breaches (Confidentiality) Fully integrated Fully integrated in Microsoft Office Suite and many third party products (even on mobile devices) Supports Office Files and any other files types File- and Folder encryption Server-side and client-side data protection Bulk encryption / decryption services Compliance accelerators (e.g. archival of plain messages if required) Template driven HR Template Management Template Finance Template Organization (except IT) Template 1.0 Top Threat: Data Breaches (Confidentiality) IRM im Unternehmen, unterwegs und in der Cloud Office Integration 5

6 1.0 Top Threat: Data Breaches (Confidentiality) IRM im Unternehmen, unterwegs und in der Cloud Do not forward feature 1.0 Top Threat: Data Breaches (Confidentiality) IRM im Unternehmen, unterwegs und in der Cloud PDF support 6

7 1.0 Top Threat: Data Breaches (Confidentiality) IRM im Unternehmen, unterwegs und in der Cloud Office Integration 1.0 Top Threat: Data Breaches (Confidentiality) IRM im Unternehmen, unterwegs und in der Cloud 7

8 1.0 Top Threat: Data Breaches (Confidentiality) Corporate and non corporate access Provide access to non corporate users using Windows Live ID Provide access to trusted partners with AD-RMS trust relationship Organization A Organization B Active Directory Domain Controller Domain Controller Active Directory RMS Database ADRMS Server TRUST ADRMS Server RMS Database (2) GetRAC RAC{Pub,Priv}, CLC UseLicense (3) GetUseLicense(RACPub) PC Client (Domain User) 2.0 Top Threat: Data Loss (Availability) 2.0 Top Threat: Data Loss (Availability) For both consumers and businesses, the prospect of permanently losing one s data is terrifying. Data stored in the cloud can be lost due to several reasons: Accidental deletion by the cloud service provider; Physical catastrophe such as a fire or earthquake; In case of encrypted data: loss of encryption key Measures: Accept the risk and trust to the cloud service provider Local and / or distributed backup 8

9 3.0 Top Threat: Account or Service Traffic Hijacking 3.0 Top Threat: Account or Service Traffic Hijacking Attack methods such as phishing still achieve results. Credentials and passwords are often reused, which amplifies the impact of such attacks. With stolen credentials, attackers can often access critical areas of deployed cloud computing services, allowing them to compromise the confidentiality, integrity and availability of those services. Measures: Accept the risk and trust to the cloud service provider Prohibit the sharing of account credentials between users and services Leverage strong two-factor authentication techniques where possible Monitoring Identity and Access Management 9

10 IAM - General Identity and Access Management Identities are managed locally inside the organization Access right are managed locally and provisioned to the cloud service provider in the environment of the cloud service provider Organization Cloud Any Auth Protocol Auth Own Application n AD / LDAP IDP IAAS, PAAS Management WES / Auth Client SAML Cloud Service 1 Cloud Service Cloud Application n Identity and Access Management Level 2 Authentication according ETSI 10

11 IAM Level 2 Authentication according ETSI Zentraler Signaturserver Am 1. August 2011 traten die überarbeitete Verordnung zum Signaturgesetz (VZertES) sowie die technischen und administrativen Vorschriften (TAV ZertES) in Kraft, welche neben Smartcards neu auch zentrale Signaturdienste für die Erstellung von qualifizierten elektronischen Signaturen ermöglichen. In der EU werden aktuell analoge, sogenannte vertrauenswürdige Services standardisiert und auf Verordnungsstufe geregelt. IAM Level 2 Authentication according ETSI Zentraler Signaturserver - Architektur CSP true-sign Remote HSM Customer Service Provider Workflow / Applikation true-sign Signaturserver 11

12 Erstellen von elektronischen Signaturen Zentraler Signaturserver Registrierung Persönliches Vorsprechen, analoge Prozesse wie bei der konventionellen SuisseID Anstelle der Smartcard bekommt der Benutzer nur den PIN Brief (und das Mittel zur 2-Faktor Authentisierung) true-sign Remote HSM CSP Workflow / Applikation true-sign Signaturserver IAM Level 2 Authentication according ETSI Zentraler Signaturserver Sicherheit 2-Faktor Authentisierung Mapping zum Signaturschlüssel (SuisseID) CSP true-sign Remote HSM Customer Service Provider Workflow / Applikation true-sign Signaturserver 12

13 IAM Level 2 Authentication according ETSI Zentraler Signaturserver Sicherheit CSP 2-Faktor Authentisierung Mapping zum Signaturschlüssel (SuisseID) End-to-End PIN Sicherheit true-sign Remote HSM Workflow / Applikation true-sign Signaturserver IAM Level 2 Authentication according ETSI Signaturvorgang aus Sicht des Benutzers Mobile Anwendung In dedizierten Applikationen über Webservices Auf mobilen Geräten ohne Smartcard / USB Anschluss 13

14 4.0 Top Threat: Insecure Interfaces and APIs 4.0 Top Threat: Insecure Interfaces and APIs Cloud computing providers expose a set of software interfaces or APIs that customers use to manage and interact with cloud services. Provisioning, management, orchestration, and monitoring are all performed using these interfaces (cloud service provider s responsibility). Measures: Accept the risk and trust to the cloud service provider User Access Restriction/Authorization (cloud service provider s responsibility) Application Security (customer s responsibility) Top Threat: Denial of Service (Availability) 5.0 Top Threat: Denial of Service (Availability) By forcing the victim cloud service to consume inordinate amounts of finite system resources such as processor power, memory, disk space or network bandwidth, the attacker(s) causes an intolerable system slowdown and leaves all of the legitimate service users confused and angry as to why the service isn t responding. Measures: Accept the risk and trust to the cloud service provider Application Security / Entry Services (cloud service provider s responsibility) 14

15 6.0 Top Threat: Malicious Insiders (Information disclosure) 6.0 Top Threat: Malicious Insiders (Information disclosure) A malicious insider (or public agency) can have access to potentially sensitive information. From IaaS to PaaS and SaaS, the malicious insider has increasing levels of access to more critical systems, and eventually to data. Systems that depend solely on the cloud service provider (CSP) for security are at great risk here. Even if encryption is implemented, if the keys are not kept with the customer and are only available at data-usage time, the system is still vulnerable to malicious insider attack. Measures: Accept the risk and trust to the cloud service provider Data encryption, especially IRM Monitoring Third Party Audits Top Threat: Malicious Insiders (Information disclosure) Interpellation Wie können Personendaten von Schweizer Bürgerinnen und Bürgern in den Händen amerikanischer Unternehmen geschützt werden?

16 7.0 Top Threat: Abuse of Cloud Services 7.0 Top Threat: Abuse of Cloud Services Almost any customer can rent tens of thousands of servers from a cloud computing provider. However, not everyone wants to use this power for good. He might use that array of cloud servers to stage a DDoS attack, serve malware or crack encryption keys. Measures: This threat is more of an issue for cloud service providers than cloud consumers Top Threat: Insufficient Due Diligence 8.0 Top Threat: Insufficient Due Diligence Cloud computing has brought with it a gold rush of sorts, with many organizations rushing into the promise of cost reductions, operational efficiencies and improved security. While these can be realistic goals for organizations that have the resources to adopt cloud technologies properly, too many enterprises jump into the cloud without understanding the full scope of the undertaking. Organizations moving to the cloud must have capable resources, and perform extensive internal and CSP due-diligence to understand the risks. Measures: Accept the risk and trust to the cloud service provider Rating of cloud service providers Comprehensive process model to rate the security of systems and processes (Sicherheitsäquivalenz) 16

17 Cloud Strategy Rating of cloud service providers 8.0 Top Threat: Insufficient Due Diligence Cloud Startegie - Offensichtlich Senkung der Betriebs- und Beschaffungskosten Konsolidierung und Harmonisierung der IT-Infrastruktur Kürzere Einführungszeiten von Applikationen Optimierung der IT-Prozesse durch Auslagerung von Routinetätigkeiten im System- und Anwendungsmanagement und Konzentration auf Kernkompetenzen in der IT Erhöhen der Sicherheit und Zuverlässigkeit durch Einsatz von standardisierten Lösungen und Spezialisten Mobiles Arbeiten 17

18 8.0 Top Threat: Insufficient Due Diligence Cloud Startegie Fachausschuss zur Bewertung und Koordination der Cloud Aktivitäten Rechtliche und regulatorische Vorgaben Ausstiegs und Migrationsszenario SLA und Haftung Kein Einsatz von Cloud für schutzwürdige Systeme und Daten Kein Auslagern von exklusivem Wissen und Kompetenzen in die Cloud Periodische Überprüfung des Cloud Service Anbieters Beachtung der Sicherheitsempfehlungen für Cloud Computing Anbieter des BSI apier-sicherheitsempfehlungen-cloudcomputing-anbieter.pdf? blob=publicationfile 9.0 Top Threat: Shared Technology Vulnerabilities 9.0 Top Threat: Shared Technology Vulnerabilities Cloud service providers deliver their services in a scalable way by sharing infrastructure, platforms, and applications. A defensive in-depth strategy is recommended and should include compute, storage, network, application and user security enforcement, and monitoring. The key is that a single vulnerability or misconfiguration can lead to a compromise across an entire provider s cloud. Measures: Accept the risk and trust to the cloud service provider Data encryption, especially IRM Monitoring Third Party Audits 18

19 Zusammenfassung Es existieren eine Vielzahl von organisatorischen, technischen und Rechtlichen Massnahmen, und Cloud-Services sicher nutzen zu können. Ich freue mich auf die Podiumsdiskussion. 19