Certification infrastructure for MUlti-Layer cloud Services

Transcription

1 Certificatin infrastructure fr MUlti-Layer clud Services Bartlme Sapi CUMULUS Prject Crdinatr Fndazine Ug Brdni Rma (Italy) Trust and Security Clustering Open Cmmunicatins event Brussels, 7 February 2013

2 Outline Clud a critical infrastructure Clud Security & Dependability Still a prblem? The CUMULUS apprach Overview and aims Objectives Wrk Packages Milestnes Scenaris References

3 Clud a critical infrastructure

4 Clud a critical infrastructure Fast increasing number f services ffered thrugh cluds, e.g. Eurpe: frm 4.6bn public clud services in 2011 ( 3.5bn sftware 1.1bn hardware) t 11bn services in 2014 [10] Wrldwide: public clud service market t increase frm $17.98bn in 2011 t $66.27bn by 2016 [11] The Clud becmes a critical infrastructure any system which is essential fr the maintenance f vital scietal functins the disruptin r destructin f which wuld have a significant impact in a Member State Cuncil Directive 2008/114/EC f 8 December 2008 n the identificatin and designatin f Eurpean critical infrastructures and the assessment f the need t imprve their prtectin;

5 Clud Security & Dependability (S & D)

6 Clud S & D the arguments Still a prblem? The prvider s argument: Increased S&D due t Cncentratin and availability f expertise Use f cutting edge security slutins Increased cntrls Regular audits Cunter arguments: Breach f data integrity, cnfidentiality [1,2,3] and privacy [4] Spamming, crss-site scripting attacks [5] Denial-r-service (DS) attacks [6,7] Reduced applicatin and data availability [2] Authenticatin, authrizatin and accunting (AAA) vulnerabilities [2,1] VM vulnerabilities (e.g., heap verflw, abnrmal terminatin f VM prcesses) fllwing stress testing and inspectin [12]

7 Clud S & D the evidence Sme incidents Amazn 24/12/2012: utage f Elastic Lad Balancing Service (lad balancing f virtual servers) fr 10Hrs (affected Netflix) 04/2011: EC2 clud suffered multiday utages causing lss f availability and data (affected Reddit/36Hrs, Fursquares, Htsuite and Qura/48Hrs) Micrsft Azure 28/2/2012: unavailability (24Hrs) due t leap year affecting, plus up t 24 mre Hrs t restre (affected UK G-Clud CludStre) Megauplad 01/2012: clud strage service suspensin due t cpyright infringement (effect: 180m users / 25 petabyte); c-tenants permanent data lss & reputatin damage Other 06/2009: 0-day vulnerability in HyperVM (LxLabs) server virtualisatin; explited t delete100,000 websites using it fr hsting purpses

8 Clud S & D surce f the prblem (1) Reduced cntrl ver sftware and data Wrse in the case f federated cluds as yu d nt knw wh is actually the clud prvider in the federatin that has yur sftware and data Multi-tenancy can lead t breaches f data integrity, cnfidentiality and privacy Interference between cmplex security mechanisms that might exist at different layers in a clud (infrastructure, platfrm and sftware) vulnerabilities Interference between security and clud virtualisatin/ptimisatin mechanisms, e.g., failure f access cntrl due t resurce exhaustin service unavailability due t unbalanced r heavy resurce utilisatin [2] spreading f DS attacks t ther servers in clud federatins due t lad balancing [7]

9 Clud S & D surce f the prblem (2) Vulnerability f the clud infrastructure itself E.g., subverting administrative functins f the clud infrastructure and attacking virtual machine mnitrs [8] Fate-sharing effects, fllwing a successful attack a clud infrastructure may, fr example, becme the hst f subverts executing illegitimate peratins frm it (e.g., spamming attacks), r peratinally disrupted fr sme ther reasn [9] reputatin damage fr c-tenant service prviders unavailability f service attributin f blame Cmplex service supply chains

10 Hw des CUMULUS fit in all this?

11 CUMULUS - verview EU funded STREP (medium size targeted) research prject (Prj. n ) Ttal budget: 4.3m EU cntributin: ~ 3m funding CONSORTIUM Clud Security Alliance (UK) Infinen Technlgies AG (D) City University Lndn (UK) ATOS SPAIN SA (S) Wellness Telecm SL (S) University f Malaga (S) University f Milan (I) Fndazine Ug Brdni (I)

12 CUMULUS Overall aim Develpment f an integrated framewrk f mdels, prcesses, and tls supprting the certificatin f security prperties f infrastructure (IaaS), platfrm (PaaS) and sftware applicatin layer services (SaaS) in cluds. Use f multiple types f evidence fr security assessment including testing data mnitring data trusted cmputing prfs Use f different mdels fr security assessment: hybrid, incremental, and multi-layer security certificatin.

13 CUMULUS Objectives Objective 1: Develpment f advanced clud service certificatin mdels based n service testing data, service mnitring data, and trusted cmputing platfrms prfs and supprting hybrid, incremental and multi-layer certificatin. Objective 2: Develpment f an interperable certificatin infrastructure fr generating, maintaining and using certificates accrding t the different types f the certificatin mdels develped in CUMULUS. Objective 3: Develpment f a service engineering prcess supprting the develpment f clud services that can make use f the CUMULUS framewrk. Objective 4: Evaluatin f the technical sundness and industrial applicability f the CUMULUS certificatin framewrk. Objective 5: Delivery f an interperable certificatin slutin and cntributin t standards.

14 CUMULUS Objective 1 Objective 1: Develpment f advanced clud service certificatin mdels based n service testing data, service mnitring data, and trusted cmputing platfrms prfs and supprting hybrid, incremental and multi-layer certificatin. Objective 2: Develpment f an interperable certificatin infrastructure fr generating, maintaining and using certificates accrding t the different types f the certificatin mdels develped in CUMULUS. Objective 3: Develpment f a service engineering prcess supprting the develpment f clud services that can make use f the CUMULUS framewrk. Objective 4: Evaluatin f the technical sundness and industrial applicability f the CUMULUS certificatin framewrk. Objective 5: Delivery f an interperable certificatin slutin and cntributin t standards.

15 Hybrid certificatin What? Certificatin based n cmbinatin f different types f evidence: testing data mnitring data trusted cmputing prfs fr the hardware elements f clud infrastructures Why? Sme prperties might be certifiable using a cmbinatin f evidence types

16 Hybrid certificatin examples The availability f a SaaS layer service S may be certified by a certificate based n: test data fr the service and a TC prf fr the cnfiguratin f the hsting clud infrastructure (t ensure that the infrastructure where the service is deplyed is the same as that fr which test data were btained) Hybrid certificate fr a SaaS service integrity based n test data and cntinuus mnitring in real perating cnditins Cert Test Data TC Prf Cert Test Data Mnitr Data

17 Multi-layer certificatin What? Certificatin based n a cmbinatin f certificates f interdependent services (as ppsed t simply evidence ) at different layers f the clud stack Nte: dependencies can be bttm-up, tp-dwn r side-level Why? Security prperties are affected by such dependencies Liability r reasning restrictins (e.g., inability t btain the direct evidence required fr prperty assessment) require making assessments n the basis f certificates rather than direct evidence

18 Multi-layer certificatin examples The integrity f data-at-rest f a sftware service S 1 using a clud strage service S 2 culd be certified n the basis f a certificate regarding the crrect implementatin f a prff-strage prtcl by S 2 SaaS PaaS The availability f a messaging service in a clud federatin may be certified n the basis f certificates regarding DSresilience f the hsting nde(s) in the federatin A data-in-prcess integrity certificate f a SaaS layer service requires TCP based certificate fr hypervisr t ensure crrect mnitring f security cnditins f infrastructure services that are necessary fr data-inprcess integrity, and avidance f data leaks f relevant mnitring data PaaS IaaS SaaS IaaS

19 Incremental certificatin What? Ability t cver changes that may affect certified prperties f clud services withut having t re-certify prperties frm scratch Why? Operatinal cnditins within a clud infrastructure may change Clud services and data may migrate t different clud infrastructures within a clud federatin Cnstituent services f cmpsite services may be substituted (whether c-tenant r nt)

20 Incremental certificatin examples Re-validatin f certificate due t changing peratinal cnditins, e.g.: the certificate C fr data integrity f a sftware service requires a certificate C fr the data islatin scheme perated by the clud strage service; the sftware service migrates t a different nde in a clud federatin C needs t be revalidated by cnsidering whether the new hsting clud has a certificate equivalent t (r apprpriate substitute fr) C Use cntinuus mnitring t create new certificates r strengthen existing certificates with increased peratinal evidence, e.g., The certificate f data-islatin fr sftware service in a given infrastructure requires islatin f c-tenant services in the infrastructure; the certificate is cntinually validated thrugh cntinuus mnitring f the infrastructure

22 CUMULUS Infrastructure Certificati n Mdels Test Based Certificatin CUMULUS Aware Service Engineering Tls CUMULUS Certificatin Infrastructure Multi-layer, hybrid & incremental Certificatin Mnitring Based Certificatin Security Mdels Trusted Cmputing Based Certificatin Clud Service Prvider Clud Service CertificatinCustmer Authrity Clud Trust Prtcl Clud 1 Clud Mnit r TestService TCP Clud 2 Clud Mnit r Mnitring Service Clud N TCP Mnitring Service Clud Clud Mnitr Mnitr External Certificate Registries (e.g., STAR)

24 CUMULUS-aware service engineering Prcesses and mechanisms fr develping CUMULUS-aware SaaS clud services re-engineering existing applicatins t make use f CUMULUS infrastructure Identificatin and representatin f security requirements in sftware cmpnents Retrieve, assess, exchange and negtiate certificates generated by the CUMULUS infrastructure.

26 CUMULUS Evaluatin & industrial applicability Clud applicatin scenaris in specific dmains SmartCities ehealth Evaluatin framewrk Technical (e.g., prperties f algrithms in certificatin mdels, efficiency f certificatin mdels, infrastructure etc.) Operatinal (e.g., effects f changing clud peratinal cnditins) Business: Legal: acceptability f certificate fit with audit practice cst effectiveness/business incentives/regulated markets des it address regulatins? can it cpe with change in regulatins?

28 Interperability & standards Interperability with emerging standards (e.g., GRC stack, STAR Registry) fr clud audit reference clud architectures (e.g., Nebula, CSA s reference architecture) Cntributin t standards, e.g.: OCF (CSA; nging) cntributes underpin underpin ISO (Clud cntrls; nging) ISO (Privacy in public cluds; nging) Key challenge/pprtunity Mst f these standards are under develpment (e.g., OCF, ISO27017)

29 Wrk Packages

30 Milestnes Milestne name WP(s) invlved Expected date ML1 Certificatin scenaris & requirements WP6 M6 ML2 Architecture f CUMULUS framewrk WP5 M9 ML3 Clud Security and Certificatin Mdels WP2 M12 ML4 Integrated CUMULUS framewrk WP3, WP4, WP5 M24 ML5 Initial Evaluatin f Certificatin Framewrk WP6 M28 ML6 Final CUMULUS framewrk WP2, WP3, WP4, WP5 M34 ML7 Final Evaluatin f Certificatin Framewrk & Explitatin Plan WP6, WP7 M36

31 Smart City scenari Internet VPN Mbile Operatr APN Public IP 3G Mdem GPRS VPN Public IP Electrical Panel FW FW LCU Public Lighting 50x FE Servers Strage

32 E-health scenari Dctrs, Specialist Hspital DB caregivers, patient 32

33 Thank yu!

34 References (1) [1] J. Heiser and M. Niclett, Assessing the Security Risks f Clud Cmputing, Gartner Reprt G , June 2008 [2] D. Catteddu and G. Hgben, Clud Cmputing: Benefits, Risks and Recmmendatins fr Infrmatin Security., Eurpean Netwrk and Infrmatin Security Agency (ENISA), 2009 [3] L. Kaufman. Data Security in the Wrld f Clud Cmputing. IEEE Security and Privacy 7, 4: 61-64, July [4] R. Austin, et al., Dmain 5: Infrmatin Lifecycle Management., In Security Guidance fr Critical Areas f Fcus in Clud Cmputing V2.1, CSA Clud Security Alliance, December [5] T. Frsheit, et al., Dmain 3: Legal and Electrnic Discvery., In Security Guidance fr Critical Areas f Fcus in Clud Cmputing V2.1, CSA Clud Security Alliance, December [6] A. Haeberlen. A case fr the accuntable clud., SIGOPS Oper. Syst. Rev. 44(2): 52-57, April [7] M. Jensen, et al., On Technical Security Issues in Clud Cmputing. In Prceedings f the 2009 IEEE Internatinal Cnference n Clud Cmputing (CLOUD '09). IEEE Cmputer Sciety, Washingtn, DC, USA, , 2009 [8] T. Ristenpart, et al., Hey, yu, get ff f my clud: explring infrmatin leakage in third-party cmpute cluds. In Prceedings f the 16th ACM cnference n Cmputer and cmmunicatins security. ACM, USA, [9] Y. Chen, V. Paxsn, R. Katz, What s new abut clud security?, Technical Reprt N. UCB/EECS , University f Califrnia at Berkeley, 2010 [10] IDC. Quantitative Estimates f the Demand fr Clud Cmputing in Eurpe and the Likely Barriers t Take-up - SMART 2011/0045 D2 Interim Reprt, 24 February, [11] (accessed n 4/1/2012) [12] Ormandy T. "An empirical study int the security expsure t hsts f hstile virtualized envirnments." In Prceedings f CanSecWest Applied Security Cnference