CSNW3204 Cloud Computing Fundamentals PDF

CSNW3204 Cloud Computing Fundamentals Chapter 4. Cloud Computing Software Security Fundamentals CSNW3204 Cloud Computing Fundamentals 1 Content 4.1 Cloud Information Security Objectives 4.2 Cloud Security Ser...

CSNW3204 Cloud Computing Fundamentals Chapter 4. Cloud Computing Software Security Fundamentals CSNW3204 Cloud Computing Fundamentals 1 Content 4.1 Cloud Information Security Objectives 4.2 Cloud Security Services 4.3 Threat identification in Cloud 4.4 Cloud Security Design Principles CSNW3204 Cloud Computing Fundamentals 2  4.1 Cloud Information Security Objectives With cloud computing providing SaaS, secure software is a critical issue. From the cloud consumer’s point of view, using SaaS in the cloud reduces the need for secure software development by the customer. The requirement for secure software development is transferred to the cloud provider. Developing secure software is based on applying the secure software design principles that form the fundamental basis for software assurance. The U.S. Department of Defense (DoD) Software Assurance Initiative3 defines software assurance as “the level of confidence that software functions as intended and is free of vulnerabilities, either intentionally or unintentionally designed or inserted as part of the software.” The Data and Analysis Center for Software (DACS)4 requires that software must exhibit the following three properties to be considered secure. Dependability execute predictably operates correctly under a variety of conditions (when under attack or running on a malicious host) Trustworthiness contains a minimum number of vulnerabilities / no vulnerabilities or weaknesses that could sabotage the software’s dependability must also be resistant to malicious logic. Survivability (Resilience) resistant to or tolerant of attacks ability to recover as quickly as possible with as little Cloud CSNW3204 harm Computing as possibleFundamentals 3  4.1 Cloud Information Security Objectives Confidentiality, integrity, and availability are sometimes known as the CIA triad of information system security and are important pillars of cloud software assurance. CIA triad Confidentiality Integrity Availability Cloud Security Services Additional factors that directly affect cloud software assurance include: Authentication Authorization Auditing CSNW3204 Cloud Computing Fundamentals 4 Accountability  4.1 Cloud Information Security Objectives Confidentiality (page no.63 of Computer Security Book) Refers to the prevention of intentional or unintentional unauthorized disclosure of information. Confidentiality in cloud systems is related to the areas of: Intellectual property rights: Intellectual property (IP) covers creations like inventions, designs, art, music, and writing. Copyrights protect creative works, while patents protect new inventions, giving creators rights over their work. Example: A software developer's code is copyrighted to prevent unauthorized distribution. Covert channels: A covert channel is an unauthorized and unintended communication path that enables the exchange of information. Covert channels can be accomplished through the timing of messages or inappropriate use of storage mechanisms. Example: Sending hidden messages by controlling the timing of network packets. Traffic analysis: Traffic analysis is a type of confidentiality breach where attackers analyze patterns like message volume, speed, source, and destination to gather information, even if the messages are encrypted. To counter this, maintaining a steady message flow and hiding the source and destination can help protect against traffic analysis. Example: Increased message activity might reveal that a high-stakes meeting is happening, even without knowing the details. Encryption: Encryption scrambles messages so unauthorized entities can’t read them, even if intercepted. The effort to decrypt depends on the strength of the encryption key and the quality of the algorithm. Example: Bank transactions are encrypted to prevent theft if intercepted online. Inference: Inference in database security is when someone uses lower-level information to deduce or uncover higher-level, protected information. Example: if a user knows employees' CSNW3204salaries Cloudand job titles Computing but doesn't have access to specific job performance5data, they Fundamentals might infer performance levels based on salary changes or promotions.  4.1 Cloud Information Security Objectives Integrity The concept of cloud information integrity requires that the following three principles are met: Modifications are not made to data by unauthorized personnel or processes. Unauthorized modifications are not made to data by authorized personnel or processes. The data is internally and externally consistent. Example: A bank's internal records show that an account has $1,000, and this matches the customer's bank statement (internal consistency). The actual money in the account matches this recorded balance (external consistency). Availability Availability ensures the reliable and timely access to cloud data or cloud computing resources by the appropriate personnel. Availability guarantees that: The systems are functioning properly when needed. The security services of the cloud system are in working order. A denial-of-service attack is an example of a threat against availability. The reverse of confidentiality, integrity, and availability CSNW3204 is disclosure, Cloud Computing alteration, and destruction (DAD).6 Fundamentals  4.2 Cloud Security Services Cloud Security Services Authentication testing or reconciliation of evidence of a user’s identity establishes the user’s identity and ensures that users are who they claim to be. Authorization refers to rights and privileges granted to an individual or process that enable access to resources and information assets. once a user’s identity and authentication are established, authorization levels determine the extent of system rights a user can hold. Auditing Accountability CSNW3204 Cloud Computing Fundamentals 7  4.2 Cloud Security Services Cloud Security Services Auditing System audit and monitoring are the two methods used to maintain operational assurance. These methods can be employed by the cloud customer, the cloud provider, or both, depending on asset architecture and deployment. system audit - one-time or periodic event to evaluate security Monitoring - ongoing activity that examines either the system or the users, such as intrusion detection Information technology (IT) auditors are often divided into two types: Internal auditors - work for a given organization External auditors - certified public accountants (CPAs) or other audit professionals who are hired to perform an independent audit of an organization’s fiancial statements IT auditors typically audit the following functions: System and transaction controls Systems development standards Backup controls Data library procedures Data center security CSNW3204 Cloud Computing Fundamentals 8 Contingency plans  4.2 Cloud Security Services Auditing audit trail or log : set of records that collectively provide documentary evidence of processing used to aid in tracing from original transactions: forward to related records and reports and/or backward from records and reports to their component source transactions may be limited to specific events or they may encompass all of the activities on a system Audit logs should record the following: The transaction’s date and time Who processed the transaction At which terminal the transaction was processed Various security events relating to the transaction Accountability CSNW3204 Cloud Computing Fundamentals 9  4.2 Cloud Security Services Cloud Security Services Accountability the ability to determine the actions and behaviors of a single individual within a cloud system and to identify that particular individual related to the concept of nonrepudiation, wherein an individual cannot successfully deny the performance of an action Audit trails and logs support accountability can be used to conduct postmortem studies in order to analyze historical events and the individuals or processes associated with those events CSNW3204 Cloud Computing Fundamentals 10  4.3 Threat identification in cloud Cloud Security Cloud security is using the latest technologies and security techniques to protect data, applications and infrastructure associated with cloud computing. Cloud service providers use a shared responsibility model. This model is divided into 2 sections:  Security of the cloud To provide a secure cloud, the cloud vendor manages and controls the: host Operating System (OS) virtualization layer physical security of its facilities.  Security in the cloud To ensure security within a given cloud environment, the customer configures and manages the security controls for the guest OS and other apps (including updates and security patches) the security group firewall. The customer is also responsible for encrypting data in transit and at rest. CSNW3204 Cloud Computing Fundamentals 11  4.3 Threat identification in cloud Threats to Confidentiality: Examples: Revealing student healthcare information on a public website Revealing results of an academic research before the researcher has officially published his research Password theft for accessing data stored in the cloud Mitigation: Encrypting sensitive data in transit and at rest Strong password policies Multi-factor authentication Audit unauthorized access attempts CSNW3204 Cloud Computing Fundamentals 12  4.3 Threat identification in cloud Threats to Data Integrity Example: Manipulating genomics records within a database and manipulating research results. Mitigation: Setting file permissions Access control lists Cryptographic checksums CSNW3204 Cloud Computing Fundamentals 13  4.3 Threat identification in cloud Threats to Data Availability Example: Denial of service attacks and power outages. Mitigation: RAID disk arrays Network load balancers Redundant network communication lines Backup CSNW3204 Cloud Computing Fundamentals 14  4.3 Threat identification in cloud Threat identification in cloud is done in 3 stages: 1. Monitoring data Any deviation from the normal system behavior creates an alarm and then it will be monitored by cloud security experts. You can set the monitoring application to flag an event by using machine learning algorithms. If there is a threat identified then, proceeds to the next level. Example: AWS ‘Cloudwatch’ is a monitoring tool used to: Monitor EC2 and other AWS services Monitor custom metrics Monitor and store logs Set alarms View graphs and statistics CSNW3204 Cloud Computing Fundamentals 15 Monitor and react to resource changes  4.3 Threat identification in cloud Threat identification in cloud is done 3 stages: 2. Gaining Visibility The cloud security expert will pin point the event using tools and once they identify the problem then, proceed to the next stage Example: AWS CloudTrail A logging service which can be used to log the history of API calls Can be used to identify which user from AWS management console requested the particular service. This is the stage where you will identify the hacker CSNW3204 Cloud Computing Fundamentals 16  4.3 Threat identification in cloud Threat identification in cloud is done 3 stages: 3. Managing Access Check the users who are having access to the resources and pin point the user (hacker) who triggered the problem (threat) and wipe out the user from the system. Wipe the spam from the system. Wipe out the user from accessing the resources. Example: AWS IAM: used to Avail granular permissions Secure access to applications running on EC2 environment CSNW3204 Cloud Computing Fundamentals 17  4.4 Cloud Security Design Principles The NCSC (National Cyber Security Centre) published some cloud security principles. These principles are designed to give guidance to cloud service providers in order to protect their customers. Principle 1: Protection of Data in Transit Your data must be effectively safeguarded from tampering and eavesdropping as it travels across networks both within and outside the cloud. This can be accomplished through a combination of encryption, service authentication, and network-level security measures. Principle 2: Asset Protection and Resilience Your data, along with the assets that store or process it, must be safeguarded against physical tampering, loss, damage, or seizure. Protective measures should encompass compliance with relevant legislation, as well as strategies like encryption, data center security, secure data erasure, and service resilience. Principle 3: Separation Between Customers A malicious or compromised user of the service should not be able to access or impact another user's data or services. Effective security boundaries must be implemented in how code is executed, data is stored, and network management is handled. Principle 4: Governance Framework The service provider should establish a security governance framework that coordinates and directs the management of the service and its information. This framework will instill confidence CSNW3204 that other Cloud Computing security controls will remain effective throughout Fundamentals 18 the service's lifecycle.  4.4 Cloud Security Design Principles Principle 5: Operational Security The service must be operated and managed securely to hinder, detect, or prevent attacks. This will be achieved through a combination of effective vulnerability management, protective monitoring, configuration and change management, and incident management. Principle 6: Personnel Security When service provider personnel have access to your data and systems, you should have a high level of confidence in their trustworthiness, along with robust technical measures in place to audit and restrict their actions. Principle 7: Secure Development Cloud services should be designed, developed, and deployed to minimize and mitigate security threats. This includes a strong software development lifecycle that utilizes an automated and audited integration and deployment pipeline. Principle 8: Supply Chain Security The service provider should ensure that its supply chain adheres to the same security standards that the organization applies to itself. This includes any third parties that have access to customer data or services, as well as those involved in procuring hardware and software. Principle 9: Secure User Management Your provider should offer tools that enable you to manage your use of their service securely, preventing unauthorized access and modifications to your resources, applications, and data. This typically involves an access model that supports role-based access controls across the service and its data. CSNW3204 Cloud Computing Fundamentals 19  4.4 Cloud Security Design Principles Principle 10: Identity and Authentication Access to service interfaces should be restricted to securely authenticated and authorized identities, whether they belong to human users or machines. Principle 11: External Interface Protection All external or less-trusted interfaces of the service should be identified and appropriately secured. This includes external APIs, web consoles, and command line interfaces. Principle 12: Secure Service Administration The design, implementation, and management of the cloud service provider's administrative systems should adhere to industry best practices, acknowledging their high value to potential attackers. Principle 13: Audit Information and Alerting for Customers You should be able to identify security incidents and have access to information that details how and when they occurred. The service must provide audit logs and issue alerts when attempted attacks are detected. Principle 14: Secure Use of the Service Your cloud provider should facilitate your ability to fulfill your data protection obligations. Services should be designed and configured to be secure by default. When this is not the case, the provider should assist you in meeting your security responsibilities. CSNW3204 Cloud Computing Fundamentals 20 References: Chapter 2 Cloud Computing Fundamentals, ​Book- Cloud Security, A comprehensive guide to secure cloud computing.​ https://www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles CSNW3204 Cloud Computing Fundamentals 21