cloud infrastructure security trends€¦ · in public cloud computing environments such as amazon...
Post on 06-Jun-2020
2 Views
Preview:
TRANSCRIPT
Cloud Infrastructure Security Trends+ 14 Tips to Fortify Your Public Cloud Environment
Published by the RedLock CSI TeamMay 2017 Edition
Introduction
Key Takeaways
01 Sensitive Data Left Exposed
02 Weak Network Controls Invite Trouble
03 Poor Governance Creates Risk
04 Developers Unknowingly Jeopardize Security
05 Achieving Compliance Just Got Harder
Ready to Take Action?
1
3
4
5
6
7
8
9
© 2017 RedLock Inc. All rights reserved.
Table of Contents
If you are a fan of Ocean’s Eleven, you will remember the brilliance with
which George Clooney and his ten accomplices executed the most sophisti-
cated casino heist in history. Initially, they carried out reconnaissance to learn
about the Bellagio building, the security systems, and the routines of the
casino staff. Based on their learnings, the team put together a calculated and
well-rehearsed plan based on which they infiltrated the casino and walked
away with the money.
Cyberattacks are the modern day heists where the goal is to exfiltrate
sensitive corporate data. They tend to be fairly sophisticated and involve
reconnaissance, planning, infiltration, and exfiltration. Over the last few de-
cades, organizations have established fairly comprehensive security
architectures to combat these attacks. However, the move to public cloud
computing is changing the rules of the game - sensitive corporate data is
now stored on servers managed by cloud service providers such as Amazon,
Microsoft, and Google. While the providers secure the physical infrastructure
and provide capabilities for organizations to securely migrate resources to
the cloud, organizations are still responsible for securing their content,
applications, systems, networks, and users that leverage the infrastructure.
© 2017 RedLock Inc. All rights reserved.
INTRODUCTION
1
INTRODUCTION
4.8M
$758M
SENSITIVE RECORDS DISCOVERED
IN BREACH COSTS AVOIDED
© 2017 RedLock Inc. All rights reserved.
Cloud Infrastructure Security is Challenging
Securing public cloud infrastructure is not as simple as retrofitting
on-premise security solutions to protect dynamic cloud environments.
The high velocity of change in cloud computing environments makes security
very challenging. To put things in perspective, our research indicates that
the average lifespan of a cloud resource is 127 minutes. The problem is
further amplified in large cloud computing environments with thousands of
resources.
The end result is weak security and compliance postures across public cloud
computing environments. We commissioned the RedLock Cloud Security
Intelligence (CSI) team to produce this report to illustrate the severity of
the issue and educate organizations on cloud infrastructure security best
practices.
RedLock CSI Team and Methodology
The RedLock CSI team consists of elite security analysts, data scientists,
and data engineers with deep security expertise from companies such as
Microsoft, Credit Suisse, and Honeywell. The team’s mission is to enable
organizations to confidently adopt public cloud infrastructure by researching
cloud threats, advising organizations on cloud security best practices, and
frequently publishing out-of-the-box policies in the RedLock Cloud 360™
platform.
So far in 2017, the CSI team has discovered 4.8 million exposed records
that contain sensitive data belonging to dozens of organizations ranging from
small businesses to Fortune 50 companies. The team notified the affected
organizations and has helped them avoid over $758 million in breach costs
this year. The CSI team also publishes security advisories to raise awareness
about the issues.
The data in this report is based on the RedLock CSI team’s analysis across
our customers’ environments which comprises of over one million
resources that are processing 12 petabytes of network traffic. In addition,
the team also actively probed the internet for vulnerabilities in public cloud
infrastructure.
2
Sensitive Data Left Exposed
Sensitive data such as PII and PHI is left exposed because basic data
security best practices such as encryption and access control are not
being enforced in public cloud computing environments.
Weak Network Controls Invite Trouble
Network security is being overlooked by allowing unfettered access
to public cloud computing environments.
Poor Governance Creates Risk
Lack of controls for user access to public cloud infrastructure is
leading to poor security hygiene amongst users.
Developers Unknowingly Jeopardize Security
Developers are inadvertently introducing risks to public cloud
computing environments due to lack security expertise, especially
when it comes to new technologies.
Achieving Compliance Just Got Harder
Continuous compliance is hard to achieve in a constantly changing
public cloud computing environment.
KEY TAKEAWAYS
© 2017 RedLock Inc. All rights reserved.
01
02
03
04
05
3
The Bellagio vault was so well secured that the Ocean’s Eleven team had to
create a replica to practice maneuvering it. In the world of technology,
databases and storage resources merit the same level of security as they often
contain an organization’s crown jewels - sensitive data. In fact, industry best
practices for securing these resources have been well established. The RedLock
CSI team assessed database and storage resources in public cloud environ-
ments for compliance with these best practices.
Key Findings
As a best practice, databases containing sensitive data should always be
encrypted. Failure to do so may result in violations to compliance mandates
such as PCI and HIPAA. Shockingly, the team determined that 82% of databases
in public cloud computing environments such as Amazon Relational Database
Service and Amazon RedShift are not encrypted.
To make matters worse, 31% of those databases were accepting inbound
connection requests from the internet, which is a very poor security practice.
Most notably, MongoDB instances saw significant inbound traffic with port
27017 being amongst the top five ports for inbound internet connections.
On a similar note, RedLock CSI researchers also discovered that 40% of
organizations using cloud storage services such as Amazon Simple Storage
Service (Amazon S3) had inadvertently exposed one or more such services to
the public. In March 2017, at least 20,000 customer records containing sensitive
data were exposed at Scottrade due to such a misconfiguration.
Tips
• Automatically discover database and storage resources as they are created
in a public cloud computing environments.
• Implement continuous configuration monitoring to ensure that encryption
is enabled for these resources, and public access is disabled.
• Monitor network traffic to ensure these resources are not communicating
directly with services on the internet.
82%
31%
40%
DATABASES ARE NOT ENCRYPTED
DATABASES ARE ACCEPTING INBOUND CONNECTIONS
FROM THE INTERNET
ORGANIZATIONS PUBLICLY EXPOSED AT LEAST ONE
CLOUD STORAGE SERVICE
© 2017 RedLock Inc. All rights reserved.
4
01 SENSITIVE DATA LEFT EXPOSED
During the planning phase, the Ocean’s Eleven team carried out reconnaissance
at the Bellagio to learn as much as possible about the security, the routines and
behaviors of the casino staff, and the building itself. They ultimately succeeded
in smuggling explosives into the Bellagio vault by having a team member pose as
a wealthy international arms dealer who needed especially secure safekeeping
for his valuables.
This analogy is all too familiar in the cybersecurity world where malicious actors
are continually attempting to exploit network vulnerabilities and breach
computing environments. Over the years, on-premises networks have been
hardened with access controls and encryption. Public cloud computing networks
are not immune to these issues and require similar security controls. The
RedLock CSI team studied public cloud computing environments to assess their
network security hygiene.
Key Findings
It is a common belief that data in transit should generally be encrypted.
However, the research revealed that 51% of the network traffic in public cloud
infrastructure environments is still occurring on port 80, the default web port
that receives clear (unencrypted) traffic. This makes the network vulnerable to
man-in-the-middle attacks.
Ideally, only load balancers and bastion hosts should be exposed to the internet.
However, the team found that 9% of workloads that were neither load balancers
nor bastion hosts were accepting traffic from any IP address on any port.
Best practices dictate that outbound access should be restricted to prevent
accidental data loss or data exfiltration in the event of a breach. Analysis showed
that an alarming 93% of resources in public cloud environments do not restrict
outbound traffic at all.
Tips
• Monitor and redirect unencrypted web traffic from port 80 to port 443
using HSTS.
• Ensure services are configured to accept traffic from the internet on an
as-needed basis.
• Implement a “deny all” default outbound firewall policy.
51%
9%
93%
NETWORK TRAFFIC IN THE CLOUD IS NOT ENCRYPTED
WORKLOADS ACCEPT TRAFFIC FROM ANY PUBLIC IP ADDRESS ON ANY PORT
RESOURCES DO NOT RESTRICT OUTBOUND
TRAFFIC AT ALL
© 2017 RedLock Inc. All rights reserved.
5
02 WEAK NETWORK CONTROLS INVITE TROUBLE
The Ocean’s Eleven crew posed as a SWAT team and entered the hotel without
raising any red flags. Subsequently, they walked out of the front doors of the
Bellagio with all of the money from the vault. We see this exact scenario play out
over and over again in cybersecurity: once malicious actors breach a network,
they are often able to exfiltrate data completely undetected. Preventing
unauthorized access in the first place is really critical. This is particularly
important in public cloud computing environments where potentially hundreds
and thousands of developers have access to critical infrastructure. The RedLock
CSI team analyzed user security hygiene in public cloud computing
environments.
Key Findings
The research revealed that 58% of root accounts do not have multi-factor
authentication (MFA) enabled. If any root user account is compromised, the
hackers will have keys to the kingdom. This is disturbing given the number of
recent high-profile breaches involving weak authentication.
On a similar note, 63% of access keys have not been rotated in the last 90 days.
This makes it easy for malicious actors to leverage compromised keys to
infiltrate cloud environments as privileged users.
The team also discovered that 14% of user accounts are dormant where
credentials are active but no logins have occurred in the last 90 days. This
introduces unnecessary risk to the public cloud computing environment.
Tips
• Enforce MFA on all user accounts, especially root accounts.
• Create a policy to force periodic rotation of access keys.
• Ensure that dormant accounts are disabled in a timely manner.
• Establish user behavior baselines and monitor for deviations to detect
anomalous user behavior.
58%
63%
14%
ROOT ACCOUNTS DO NOT HAVE MFA ENABLED
ACCESS KEYS HAVE NOT BEEN ROTATED IN 90 DAYS
USER ACCOUNTS ARE DORMANT
© 2017 RedLock Inc. All rights reserved.
6
03 POOR GOVERNANCE CREATES RISK
The average developer typically does not have any formal security training
which could result in accidentally exposing sensitive data and infrastructure to
malicious actors. The problem is further exacerbated in public cloud computing
environments where developers can rapidly adopt new technologies without
understanding the security implications.
Kubernetes is one such emerging technology that is rapidly gaining momentum.
It is an open-source system for automating deployment, scaling, and
management of containerized applications that was developed by Google in
2014. Kubernetes is being used in production by global brands including Box,
eBay, and the The New York Times. The RedLock CSI team studied Kubernetes
systems to understand common usage risks.
Key Findings
The researchers discovered 285 Kubernetes dashboards (web-based
administration interface) deployed on Amazon Web Services (AWS), Microsoft
Azure, and Google Cloud Platform that were not password protected. Upon
further investigation, the team found plaintext credentials to other critical
infrastructure within the Kubernetes systems. In many instances, the team
found plaintext credentials to an organization’s AWS accounts which creates
a domino effect of exposures.
Tips
• Enforce strong authentication mechanisms for Kubernetes systems.
• Train developers on security best practices for public cloud infrastructure
to maintain a strong security posture.
285
KUBERNETES DASHBOARDS WERE NOT PASSWORD
PROTECTED
© 2017 RedLock Inc. All rights reserved.
7
04 DEVELOPERS UNKNOWINGLY JEOPARDIZE SECURITY
05 ACHIEVING COMPLIANCE JUST GOT HARDER
Entities regularly undergo a variety of audits to ensure that the requirements of
particular laws and regulations are being met. With the move to cloud
computing, achieving compliance just got a lot harder. A whole new set of
cloud-specific best practices for configurations and access to resources has
been established against which organizations will have to achieve compliance.
This is extremely challenging in dynamic cloud computing environments since
resources are constantly changing. As a result, compliance auditing requires
automation. The RedLock CSI team assessed the compliance posture of public
cloud computing environments.
Key Findings
The research indicates that on average, organizations fail 55% of compliance
checks established by the Center for Internet Security (CIS). More than half the
violations (54%) are high severity issues such as having security groups that
allow inbound SSH connections. Medium severity violations such as not enabling
multi-factor authentication for all IAM users represent 37% of the issues. Lastly,
9% of the violations are low severity issues such as not logging Amazon Simple
Storage Service (S3) bucket access.
Tips
• Implement policies to observe the CIS Benchmarks.
• Continuously monitor cloud environment for compliance violations and
immediately remediate issues.
55%
OF CIS COMPLIANCE CHECKS FAIL
© 2017 RedLock Inc. All rights reserved.
COMPLIANCE VIOLATIONS BY SEVERITY
8
READY TO TAKE ACTION?
About RedLock
RedLock enables an organization to manage security and compliance risks
across its public cloud infrastructure such as Amazon Web Services, Microsoft
Azure, and Google Cloud Platform. The RedLock Cloud 360™ platform
continuously ingests massive volumes of raw, siloed data from the environment,
enriches it with external threat data, and applies machine learning to produce
a comprehensive risk map - no other solution provides this today. This holistic
visibility enables policy-based monitoring, anomaly detection, cloud forensics,
incident response, and compliance reporting.
Global brands across a variety of verticals trust RedLock to secure their public
cloud infrastructure including several Fortune 500 corporations. In addition,
RedLock was a finalist amongst hundreds of startups for the coveted title of
Most Innovative Startup at RSA 2017 in San Francisco.
Get a Free Risk Assessment
Get started in minutes and obtain a free risk assessment across your public
cloud infrastructure without hindering DevOps. The report will provide the
following insights:
• What infrastructure is running in your public cloud environment?
• Are you secure and in compliance with established cloud security best
practices?
• Is there anomalous user or network behavior in your environment?
More information: https://info.redlock.io/cloud-risk-assessment
“To protect our customers’ data,
we make it a priority to secure the
underlying public cloud
infrastructure. We need to
continuously monitor the
infrastructure as well as ensure
real-time visibility into risks, and
RedLock enables us to do just this
without impeding our agile
development processes.”
-
Bala Sathiamurthy
Head of Security, NerdWallet
© 2017 RedLock Inc. All rights reserved.
RedLock, RedLock logo, and RedLock Cloud 360 are trademarks of RedLock Inc.
All other registered trademarks are the properties of their respective owners.
To learn more:
Call: +1.650.665.9480
Visit: www.redlock.io
9
GET A FREE ASSESSMENT
top related