Cloud Security and Cloud Compliance

Cloud Security services and mechanisms:
How can modern clouds provide secure and trusted
environment for data and business applications?

Yuri Demchenko
Systems and Networking Lab, University of Amsterdam
Amsterdam Security Workshop
9 Oct 2019, UvA
AmSec2019

Cloud Security & Compliance1Outline••••

Introduction: Cloud adoption is growing
Shared Responsibility Security Model in CloudCase Study: AWS Security
Cloud Compliance and Cloud Security Alliance (CSA)– CSA GRC Stack: Governance, Risk Management and Compliance– Consensus Assessment Initiative Questionnaire (CAIQ)• DevSecOps = DevOps + SSDL (Security Services Development
Lifecycle)• Case Study: Trusted Data Market infrastructure and IDS Connector• Discussion: Research topics in Cloud Security and Trust

AmSec2019

Cloud Security & Compliance2Cloud Facts: Cloud adoption is growing• Cloud adoption is growing: Enterprise Cloud Strategy 2019http://googliers.net/static/media/uploads/download_files/2019_state_of_the_cloud_report.pdf
AmSec2019

Cloud Security & Compliance3

Cloud Facts and Observations: AWS vs Azure••

Microsoft Azure is fasted growing cloud: now 85% of AWS (compare 70% in2018)
Quite popular in Netherlands

AmSec2019

Cloud Security & Compliance4Cloud Observations• Cloud is an ultimate platform for Big Data
– Data gravity vs Investments gravity• Migration choice: 10 yrs of legacy data vs expected explosive data growth– Working with data and data analytics in cloud is much easier• Hybrid cloud and data analytics solution is growing• Data Lakes: heterogeneous data formats, namespaces, filesystems• Migration to cloud takes 1-2 years, requires competenceplanning– Demand for cloud migration/integration services/companies– Growing adoption of the DevOps culture in services development andoperation• Most of new projects are in cloud

AmSec2019

Cloud Security & Compliance5Part 1: Cloud Security and AWS Example• Shared responsibility model• AWS Security

AmSec2019

Cloud Security & Compliance6Mang by User

Cloud PaaSManaged by Provider

Managed by Provider

Managed by User

Managed by User

Cloud IaaS

Managed by Provider

Packaged
Application

Mng UserSplit of Responsibilities in Cloud IaaS, PaaS, SaaS
Cloud SaaS

Data is always
responsibility ofCustomerCloud Provider
provides tools forassisting customers
in secure
deployment,
operation andtesting

Security management responsibilities split between Customer and Provider for IaaS, PaaS, SaaS service models•
Updating firmware and software for platform and for customer managed components•
Firewall is intrusion prevention and a responsibility of the cloud provider•
Certification and compliance of the cloud platform doesn’t imply security and compliance of the customer controlled
components
AmSec2019

Cloud Security & Compliance7

Cloud Computing Security – Challenges• Fundamental security challenges and main user concerns inclouds– Data security: Where are my data? Are they protected? What control
has cloud provider over data security and location?
– Identity management and access control: Who has access to mypersonal/ID data?

• Two main tasks in making cloud secure and trustworthy– Secure operation of the cloud (provider) infrastructure– User controlled access control (security) infrastructure• Provide sufficient amount of security controls for competent user

• Security services are provisioned on-demand (as part ofvirtualised infrastructure) and require bootstrapping(federation) with the customer services and trust domain
AmSec2019

Cloud Security & Compliance8Cloud, OS, Network and Applications Trust Layers
OS+HV – Container/VM – Application
security

Network – Sec. commschannel (IPSec, SCP, VPN)
App securesessionOS
ContainerOS
Container
Appl

Appl

#

#
Security
Context

Cloud: Hypervisor, VM/Host, HW

Root of Trust(Bound to HW)

OS – Container – Application
security#Server/Client/OS Cert/Creds

User: App/Client, computer

App/container
credentials, secrets•

Consistent security must provide security at all layers correspondingly relying on trust credentials at each layer•

Two security models: Trusted Computing Base (TCB) for cloud platform and OSI/Internet security cloud based applications•

Root of trust is based on the security credentials bound to hardware mediated through OS to runtime environment–––

AmSec2019

Application – Container - Operating systems (security kernel) + Cloud platform
Network/communication – Runtime - Storage

Client/server and Service Oriented Architecture vs OS and hypervisor run-time

Cloud Security & Compliance

Slide_9

Multi-tenant Application: Example Implementation
Microsoft Azure Cloud

Tenant A

Tenant B

Storage Partition
Client A
Single tenant

Web UI
Client A
Single tenant

Web UI
Client B
Single tenant

App Services
Multi-tenant

Storage Partition
Client B
Single tenant

Storage Partition
Client B
Single tenant

Web UI
Client C
Single tenant

Tenant C
Data transformation in multi-tier multi-tenant applications
Data
DataSource
SourceandandConsumer
Consumer

Generally reflects
Office 365 multitenancy model
AmSec2019

Data
Data
input/output
input/output

Data
Data
processing
processing

Access control

Processing
threads isolated

Cloud Security & Compliance

Data
Datastorage
storage

Data separation

10

Designing for Multi-tenancy in Cloud - Overview• Data security and privacy is a primary concern and design target in
multi-tenant applications– Cloud datacenter security – ensured by cloud provider– Application security – ensured by the application developer and service
operator• Multi-layer and multi-tier multi-tenancy mechanism– Presentation, business logic, data structures• Data isolation and segregation– Store client data with isolated URI or schema -> Data Lakes– Blob or Table storage: isolated URI– Azure SQL database: partitioning, separate schema• Access control and Identity management––––

Microsoft Azure Active Directory and Windows Identity Foundation
AppFabric Access Control
Identity federation with the tenants’ home organisations
Custom Identity Solution• Scalability up and down, horizontal scalability• Services metering, accounting and billing
AmSec2019

Cloud Security & Compliance11

Case Study: AWS Security Mechanisms•

VPC – Virtual Private Cloud– VPN – Virtual Private Network– VPG – VPN Private Gateway– IGW – Internet Gateway•••

HTTPS and TLS/SSL, SSH, KPI
AIM – Access and Identity
Management
Other security services– AWS SSO
– Cognito – Identity Federation– Macie - Data visibility security
service– CloudHSM - Managed hardware
security module (HSM)

AmSec2019

Cloud Security & Compliance

12

AWS VPC Structure

AmSec2019

Cloud Security & Compliance13

Example: Security responsibility sharing in AWS
IaaS infrastructure services
AWS Identity and Access
Management (IAM) overAmazon EC2 and S3
infrastructure services•

For other cloud service models PaaS and SaaS the responsibility of AWS goes up to OS, network andfirewall for PaaS, and also includes the application platform and container for SaaS.
– However, the responsibility for data remains with the customer.

[ref] Todorov, D. & Ozkan, Y. (November 2013) ‘AWS security best practices’, Amazon Web Services [Online]. Available from:http://media.amazonwebservices.com/AWS_Security_Best_Practices.pdf

AmSec2019

Cloud Security & Compliance14

Amazon Web Services Security Model
Application Security

Cloud Services Security

Customer applications security
Customer responsibility

Available cloud platformsecurity service andconfiguration
Enforce IAM policies
Use MFA, VPC, use S3 bucket
policies, EC2 security
Federated Access Control and
Identity Management

Encrypt Data in transit
Encrypt data in rest
Protect your AWS credentials
Rotate your key
Secure your applicatios, VM,

Cloud Infrastructure Security
Cloud Service Provider
Platform design and certification

ISO 27001/2 Certification
PCI DSS 2.0 Level 1-5
SAS 70 Type II Audit
HIPAA/SOK Compliance
FISMA A&A Moderate

Security is declared as one of critical importance to AWS cloud that is targeted to protect customer
information and data from integrity compromise, leakage, accidental or deliberate theft, and deletion.
•
The AWS infrastructure is designed with the high availability and sufficient redundancy to ensure reliable
services operation.
AmSec2019

Cloud Security & Compliance15Microsoft Azure Active Directory (AAD)

Microsoft Azure Active Directory is a modern cloudservice providing Identity Management and AccessControl capabilities to cloud applications.
•
Provides Identity and access managementin the cloud•
Can be integrated with on-premises AD•
Supports Integration with cloud applications
AmSec2019

Microsoft Azure Active Directory provides 4 basic services•
Microsoft Azure AD Access Control (ACS)•
Microsoft Azure AD Directory• Microsoft Azure AD Graph• Microsoft Azure Authentication Library (AAL)

Cloud Security & Compliance16Microsoft Azure AD Access Control• A cloud federation service for your cloud applications andservices– Federates on-premises and cloud identity services• Prerequisites– Demands federated authentication– AD on-premises and AAD on cloud synchronisation• Supports multiple identity providers– Facebook, Google, Microsoft, Windows Server AD FS, Yahoo!

• Supports multiple protocols– WS-Federation, WS-Trust, OAuth 2.0 (draft 13)• Supports multiple tokens– JWT, SAML 1.1/2.0, SWT
AmSec2019

Cloud Security & Compliance17

Part 2. Cloud Compliance• Compliance standards, Security Controls• CSA GRC Stack: Governance, Risk Management andCompliance• Compliance Assessment Initiative Questionnaire (CAIQ)

AmSec2019

Cloud Security & Compliance18Security and Compliance•

Security and compliance are related and in some cases interchangeable•

Security is commonly defined as a set of technical, physical, and administrative controls inorder to ensure normal operation of a system or application––•

Compliance is a certification or confirmation that the system or an organization meets therequirements of specified standards, established legislation, regulatory guidelines orindustry best practices that can be jointly defined as compliance framework––•

A compliance framework can includes business processes and internal controls the organization
has in place to adhere to these standards and requirements
The framework should also map different requirements to internal controls and processes toeliminate redundancies

Why it is important for cloud?
–•Security is often associated with the CIA triad Confidentiality, Integrity, Availability
Appropriate level of security requires organizations to take measures and comply to the numerous
security controls

When moving to cloud, the organization moves from internal security and operational environment/context(that may not be formally defined) to external operational security that will become a part of SLA (orbusiness requirement) with CSP

Problem with achieving compliance for cloud based applications/solutions–––

AmSec2019

Audit requirements are not designed for virtualised distributed environment
Lack of visibility in cloud: large CSP such as Amazon and Google are “walled/curtained gardens”
Requirements to allow CSP audit may involve Non-Disclosure Agreement (NDA) and risk of provider lock-in

Cloud Security & Compliance19Regulatory requirements to be considered forcloud compliance – Example General Standards
General standards and recommendations•

ISO/IEC 27001:2005 Certification on security infrastructure– Industry standard: the risk-based information security management program that
follows a plan-do-check-act process••

NIST SP 800-53 Security Controls and ISO/IEC 15408 Evaluation Cirteria
HIPAA/HITECH - The U.S. Health Insurance Portability and Accountability Act(HIPAA) and Health Information Technology for Economic and Clinical Health(HITECH)– Act created by the US federal government include provisions to protect patients' private
information.

•
•
•
•

NIST SP 800-144 Guidelines for Security and Privacy in Cloud Computing
Cloud Security Alliance (CSA) Security Guidance for Critical Area of focus in
Cloud Computing
ENISA Cloud Computing Security Risk Assessment
GDPR (General Data Protection Regulation)

AmSec2019

Cloud Security & Compliance20

Case study: Certification/Compliance by Amazon
AWS CloudThe AWS cloud infrastructure has been designed and managed in alignment
with regulations, standards, and best-practices including:• ISO/IEC 27001:2005• SOC 1, SOC2, SOC3
• FIPS 140-2• CSA• PCI DSS Level 1• HIPAA• ITAR• DIACAP and FISMA• FedRAMP (SM)• MPAA
Amazon Cloud is certified for hosting US Governmental services
http://aws.amazon.com/compliance/
AmSec2019

Cloud Security & Compliance21

Case study: Compliance by Microsoft Azure

Microsoft services/infrastructure meets the following key certifications, attestations
and compliance capabilities• Current compliance offerings• Office 365 compliance documentation• Service Trust Portal• Microsoft Services Risk Assessment• Audit Reports

https://www.microsoft.com/en-US/TrustCenter/Compliance/complianceofferings
AmSec2019

Cloud Security & Compliance22

Cloud Security Alliance (CSA) GRC Stack:Governance, Risk Management and Compliance
The GRC Stack provides a toolkit for enterprises, cloud providers, security solution providers,
IT auditors and other stakeholders to assess both private and public clouds against industry
established best practices, standards and critical compliance requirements.
https://cloudsecurityalliance.org/research/grc-stack/• Cloud Controls Matrix (CCM) is designed to provide fundamental security principles toguide cloud vendors and to assist prospective cloud customers in assessing the overall
security risk of a cloud provider (https://cloudsecurityalliance.org/research/ccm/ )––•The CCM gives detailed understanding of security concepts and principles that are aligned to the
Cloud Security Alliance guidance in 13 domains
Defined in accordance to industry-accepted security standards, regulations, and controls
frameworks such as the HITRUST CSF, ISO 27001/27002, ISACA COBIT, PCI, HIPAA and NIST.

Consensus Assessments Initiative Questionnaire (CAIQ) provides an industry-accepted
way to document what security controls exist in IaaS, PaaS, and SaaS offerings, providing
security control transparency (https://cloudsecurityalliance.org/research/cai/)–––

Provided in a form of questionnaire in the spreadsheet format, a set of questions a cloud consumer
and cloud auditor may wish to ask of a cloud provider.
~ 200 yes/no questions that map directly to the CCM, and thus, in turn, to many industry standards.
CAIQ answers by companies and certification are posted on the STAR website•

AmSec2019

From self-assessment to certification and monitoring
Cloud Security & Compliance23

CSA3.0 Security Guidance for Critical Area of
Focus in Cloud Computing
The CSA3.0 defines 13 domains of the security
concerns (controls) for Cloud Computing that are
divided into two broad categories that definecorresponding security controls.
Governance domains

CSA3.0 Cloud Services Model

1. Governance and Enterprise Risk Management
2. Legal Issues: Contracts and Electronic Discovery
3. Compliance and Audit
4. Information Management and Data Security
5. Portability and Interoperability

Operational Domains
6. Traditional Security, Business Continuity and Disaster
Recovery
7. Data Center Operations
8. Incident Response, Notification and Remediation
9. Application Security
10. Encryption and Key Management
11. Identity and Access Management
12. Virtualization
13. Security as a Service

AmSec2019

Cloud Security & Compliance24

CSA3.0: Mapping the Cloud Model to the Security
Control & Compliance

SP500-292 (CCRA), CSA3.0

ISO/IEC 27002:2013 InfoSec Controls(Historically originated from Common Criteria)

PCI DSS V3.0 (2013)[ref] Security Guidance for Critical Areas of Focus in Cloud Computing V3.0 (2013)https://cloudsecurityalliance.org/download/security-guidance-for-critical-areas-of-focus-in-cloud-computing-v3/
Cloud Security & Compliance
AmSec201925

Recent CSA Publications• Top Threats to Cloud Computing: The Egregious 11 (2019)– Contains stories about recent cloud breaches: all due to customer lame design andcompromised credentials• Top Threats to Cloud Computing: Deep Dive (2019)– A case study analysis for The Treacherous 12 Top Threats to Cloud Computing andrelative industry breach analysis• The Six Pillars of Security (2019)– Achieving Reflexive Security through integration of security < development andOperations• Cloud Octagon Model (2019)– Model for Improving Accuracy and Completeness of cloud Computing risk assessment•

AmSec2019

Cloud Security & Compliance26

DevSecOps and SSDL
• SSDL – Security Services Development Lifecycle– Developed by Microsoft in 2000s and widely accepted by industry
SSDL = Security and Privacy by Design• Security design principles by big software vendors Amazon, Apple,
Google• DevOps meets Security -> DevSecOps• DevSecOps as alternative to Waterfall model where security is treated as
non-functional requirement and is addressed at later stages ofdevelopment

AmSec2019

Cloud Security & Compliance27

DevSecOps: Building a Secure Continuous
Delivery Pipeline• DevSecOps is extension of DevOps with inclusion of
Security• Traditional InfoSec crisis: Lost identity– 100 developers:10 operations:1 security -- problem• Continuous delivery pipeline and DevSecOps toolchain:
5 stages– Develop: version, sprint, unit test
– Inherit: libraries and dependencies– Build: acceptance testing, audit– Deploy (moving artefact from built machine to production)– Operate: user and attacker faced

AmSec2019

Cloud Security & Compliance28Security Testing: Misconfiguration and secrets• Creds leakage, e.g.
– Creds in source code on github– AWS access key in a version control history• Use git-secrets
https://github.com/awslabs/git-secrets– Prevents from committing passwords and other sensitive information to a git
repository– git-secrets scans commits, commit messages, and --no-ff merges to prevent
adding secrets into your git repositories.
– If a commit, commit message, or any commit in a --no-ff merge history
matches one of your configured prohibited regular expression patterns, thenthe commit is rejected.
– Installation for Linux, Mac, Windows• Use: git secrets –scan[-history]

AmSec2019

Cloud Security & Compliance29Security Development Practices and OSS•

Security of Open Source Software (OSS) is slightly agitated– Security problems require security expertise and not all developers are security experts.
• More advanced topics like cryptography, for example, further narrow the field for those
who can review code for such security flaws.
– There's also no standard way of documenting security on open source projects. In the top
400,000 public repositories on GitHub, only 2.4% had security documentation in place.
– Dependencies in open source projects allow some vulnerabilities to fly under the radar..

•According to the latest Veracode report, only 28% of organizations do any kind of
regular analysis to find out what components are built into their applications.
– 94% commercial software have dependencies on OSS libraries– As the use of open source code grows, this risk surface expands.

•

According to the Snyk survey (https://snyk.io/):– 88 % of open source code maintainers add security-related announcements to the releasenotes– 34 % say that they deprecate the older, insecure version.
– 25% that they make no effort at all to notify users of vulnerabilities– only 10% file a CVE reports

AmSec2019

Cloud Security & Compliance30

Cloud Security Config Monitoring• AWS Tools– AWS Config – Monitor configuration changes– AWS CloudTrail - Create a trail to retain a record of events– Amazon Inspector - analyzes the behavior of AWS resources andhelps identify potential security issues– Amazon GuardDuty – Activity monitoring & Intelligent threat detection• Third party tools– https://www.threatstack.com– https://www.alienvault.com– https://evident.io – multicloud solution• InSpec is compliance as code service https://www.inspec.io– Turns compliance, security, and other policy requirements into
automated tests– Includes compliance requirements into code
AmSec2019

Cloud Security & Compliance31

Case Study: Trusted Data Market Infrastructure andcomposable components
Trials(Usecases)

KPI
$$$
Data
Exchange###
Transactions

Trials(Usecases)

DMIH/Incubator

KPI## Data
Providers## Data
Users

IDS

IDS

Operational Trusted DM Platform
Component/services
Open Telekom Cloud (OTC)

Data

Catalog/Directory (Federated)IDS

DM Portal
Mgnt
ConsoleIDS

Template/Image
Virtual TDM od
PrivateVDM

Deployment
EngineTemplate VPC

Template/Image
SecDataCont

IDS

Data Lake Store

TrustedBroker(3rd Party)

VPC

VI TBP(TPM)
FedAAI

SLAM

SealedRoomData Intel Hub
ComputePrivateBlockchain

SmartContract/Policy
Biz Model
Compliance

Legal/Rules
Open Data Markets

SCVPE4TDM (EVM)
Data Market Architecture and Technologies

32

TDM Infrastructure Templates and DevOps tools• DM infrastructure is provisioned on demand for eachcooperating groups of partners– Digitally Enforceable Policy/Contract is embedded into infrastructure• DM infrastructure template is composed of basic
infrastructure patterns described– For platform dependent patterns in the formats of cloud platform• AWS: CloudFormation• Azure: Azure Resource Manager (ARM)– For general infrastructure descriptions/templates• Ansible – YAML based, combines computational and network resources• Others: Chef (directly supported by AWS), Puppet, Terraform (directly
supported by Azure)– Blockchain enabled Virtual Private execution Engine (SCVPE)

Open Data Markets

Data Market Architecture and Technologies

33

Leveraging IDS Architecture and Connector with Cloud••IDS Connector is the main functional component
No specifically defined infrastructure

Open Data Markets

Data Market Architecture and Technologies

34Reference Architecture Data Connector• Execution and configuration• Application container
Open Data Markets• Undergoing DIN Standardisation
Data Market Architecture and Technologies

35

LUCON: Trusted Connector Implementation
https://industrial-data-space.github.io/trusted-connector-documentation/•••

The Trusted Connector features the secure container management layer trust|me as analternative to Docker.
trust|me basic mechanisms are similar to Docker (namespaces, cgroups and chroot)
trust|me was developed as a security architecture including secure boot, platform integrity
measurements, and a hardened kernel.

AmSec2019

Cloud Security & Compliance36

Research topics in Cloud Security•

Federated Identity Management and Access Control in hybrid enterprise-CSP
infrastructure + Identity provisioning••

Cloud Access and Security Brokers: Security with Trusted Third Party
VPC infrastructure security model and analysis•

Bootstrapping cloud based VPC and enterprise or applications trust domains– Leveraging Zero Trust model in networking security– Leveraging TPM and Trusted Computing Platform Architecture•

Data protection in clouds at all stages of data processing (Data Lifecycle)––––

Data Sovereignty and Data Ownership attribute/property
Computationally Enforceable Policies and data provenance
Data Management Infrastructure for AI and Digital Twins
Blockchain enabled data provenance in multi-platform multi-cloud environment•

Personal information protection in cloud based multitenant multi-tier applications•

Cloud infrastructure to enable GDPR + FAIR data principles

AmSec2019

Cloud Security & Compliance37

Summary and take away••••

Cloud Security impose new security challenges
Cloud Security is based on the core security principles and models
Shared responsibility is the basic model cloud security
Cloud compliance provides a basis for wider cloud services adoption andinter-cloud integration.
• Compliance is supported by numerous standards, legislation, regulatory
guidelines and industry best practices that jointly define a complianceframework• Knowing major cloud compliance standards is necessary for correct
cloud services design, deployment and operation• IDSA architecture and Trusted Data Market as example of criticallytrusted environment in cloud

AmSec2019

Cloud Security & Compliance38Discussion and Questions

AmSec2019

Cloud Security & Compliance39