Security Measures for Critical Soware

Submier: Eric Brewer, on behalf of Google, LLC

Topic: (3) Guidelines outlining security measures for critical soware

Speakers: Jon McCune, Principal Soware Engineer, jonmccune@google.com

Even soware with a sound provenance record can lead to an insecure system if that system is not

designed and congured appropriately. Because security is never peect, mechanisms must be in place

to mitigate and recover from vulnerabilities or aacks. This paper oers guidance for mitigation:

managing conguration, reducing privilege, and network segmentation, that have withstood the test of

time at Google.

Proper Conguration

Patching and Updates. Patches and updates should be suppoed as pa of day-to-day operations

with frequently-used procedures. This practice ensures that vulnerabilities are addressed as soon as

possible, and reduces availability risk because the procedures are pa of normal operations.

Conguration Management. Soware systems should use revision control systems to store

conguration data, similar to those used to manage source code and release aifacts, and should

separate conguration data from executable code such as scripts. These techniques reduce the

complexity of the deployed soware system and make it easier to reason about during an incident.

Rollback Suppo. Ensure that tooling suppos return to a known-good state. This allows rapid and

condent response to a recent problematic change, such as a feature that is discovered to contain a

security vulnerability. This is an area where conguration management is useful, since revision control

systems have rich suppo for tracking and managing multiple releases.

Know Your Hardware. Do not forget to manage hardware-specic aifacts, such as rmware for

motherboards, peripherals, and management controllers. These highly privileged components may

otherwise be le with outdated and vulnerable rmware. These management requirements should be

pa of the hardware selection criteria, as vendors' security practices vary widely.

Least Privilege

Compromise Containment. Identify the boundaries between system components of varying levels of

trust, and take action to contain the less trusted components. For example, use sandboxing, system call

ltering, separate viual machines, or distinct identities to introduce barriers to moving laterally from

one compromised component into another. Good soware conguration and system design anticipates

that arbitrary system components may become compromised, and seeks to contain the damage.

Disable Unused Features. Enable only those features that are necessary and have an explicit use case.

This limits the aack suace, since many soware packages enable large numbers of features by

default. Other features can always be enabled in the future, as needs or use cases change.
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Credentials. Avoid use of bearer tokens, avoid transmiing cleaext credentials, and enable

multi-factor authentication. This protects against adversaries who harvest credentials commied to

revision control repositories, cookies or tokens via compromised client devices, and credentials

accidentally captured in debug logs.

Multi-pay controls. Use multi-pay controls so that a single person cannot unilaterally destroy or leak

data, or maliciously modify the state of critical systems. Pay paicular aention to highly privileged

operations, accidental and malicious actions, and compromised or stolen devices.

Audit and Notication. Privileged operations should generate an audit record and notication to other

administrators. This can ale responders when a compromised account takes an unexpected action, or

when a risky action may be unavoidable, such as responding to an unanticipated incident. Ensure that

logs are write-once to the systems generating the log data, so that a compromise cannot lead to

destruction or tampering with the log data. The audit trail can aid in post-moem forensics.

Encrypt. Encrypt data at-rest and in-transit. This both protects condentiality and ensures that

adversaries cannot inject malicious trac such as administrative commands. Condential Computing is

a new technology that also oers a layer of protection for data in use.

Root of Trust. Incorporate root-of-trust hardware into operating systems and management soware to

protect sensitive keys and represent ground-truth for system identity. This is the strongest available

signal that "this machine is one of ours". Aestation of soware and conguration can conrm that

systems are in the intended state while only having to trust a small fraction of the system as a whole.

Network Segmentation

Availability-only. Trust the network only for availability, and avoid systems that grant access to

resources simply by being connected to the network. In practice, there may be factors that still lead to

some network trust, such as legacy devices, third-pay soware or hardware that cannot be modied,

but the overall aack suace is still reduced.

Limit reachability. Paition networks so that the only permied connectivity corresponds to an

explicitly named need. Do not allow internet access for systems that do not require it, and build explicit

processes around internet reachability to inhibit malicious data exltration.

Proxy. Use a proxy between network segments whenever peormance permits. This enables logging

and auditing, and can serve as a rst line of defense for preventing trac matching known malicious

paerns when a new aack is discovered. The proxy can also enforce best practices, such as ensuring

that clients use hps even if some legacy servers internally might serve both hp and hps.

Log and Monitor. Inspect trac to ensure that all in-use protocols are known, and that all encrypted

protocol types are actually encrypted. At high bandwidth, it will only be possible to do statistical

sampling, but it is still wohwhile. Where deep packet inspection is necessary, consider proxy designs

that do not have the keys necessary to violate packet integrity (as compared to condentiality).