Security and Privacy in Cloud Computing

Transcription

1 Security and Privacy in Cloud Computing Ragib Hasan Johns Hopkins University en Spring 2010 Lecture 2 02/01/2010

2 Threats, vulnerabilities, and enemies Goal Learn the cloud computing threat model by examining the assets, vulnerabilities, entry points, and actors in a cloud Technique Apply different threat modeling schemes 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 2

3 Assignment for next class Review: Thomas Ristenpart et al., Hey, You, Get Off of My Cloud! Exploring Information Leakage in Third-Party Compute Clouds, proc. ACM CCS Format: Summary: A brief overview of the paper, 1 paragraph (5 / 6 sentences) Pros: 3 or more issues Cons: 3 or more issues Possible improvements: Any possible suggestions to improve the work Due: 2.59 pm 2/8/2010 Submission: By to [email protected] (text only, no attachments please) 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 3

4 Threat Model A threat model helps in analyzing a security problem, design mitigation strategies, and evaluate solutions Steps: Identify attackers, assets, threats and other components Rank the threats Choose mitigation strategies Build solutions based on the strategies 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 4

5 Threat Model Basic components Attacker modeling Choose what attacker to consider Attacker motivation and capabilities Assets / Attacker Goals Vulnerabilities / threats 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 5

6 Recall: Cloud Computing Stack 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 6

7 Recall: Cloud Architecture Client SaaS / PaaS Provider Cloud Provider (IaaS) 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 7

8 Attackers 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 8

9 Who is the attacker? Insider? Malicious employees at client Malicious employees at Cloud provider Cloud provider itself Outsider? Intruders Network attackers? 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 9

10 Attacker Capability: Malicious Insiders At client Learn passwords/authentication information Gain control of the VMs At cloud provider Log client communication 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 10

11 Attacker Capability: Cloud Provider What? Can read unencrypted data Can possibly peek into VMs, or make copies of VMs Can monitor network communication, application patterns 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 11

12 Attacker motivation: Cloud Provider Why? Gain information about client data Gain information on client behavior Sell the information or use itself Why not? Cheaper to be honest? Why? (again) Third party clouds? 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 12

13 Attacker Capability: Outside attacker What? Listen to network traffic (passive) Insert malicious traffic (active) Probe cloud structure (active) Launch DoS 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 13

14 Attacker goals: Outside attackers Intrusion Network analysis Man in the middle Cartography 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 14

15 Assets 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 15

16 Assets (Attacker goals) Confidentiality: Data stored in the cloud Configuration of VMs running on the cloud Identity of the cloud users Location of the VMs running client code 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 16

17 Assets (Attacker goals) Integrity Data stored in the cloud Computations performed on the cloud 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 17

18 Assets (Attacker goals) Availability Cloud infrastructure SaaS / PaaS 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 18

19 Threats 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 19

20 Organizing the threats using STRIDE Spoofing identity Tampering with data Repudiation Information disclosure Denial of service Elevation of privilege 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 20

21 Typical threats Threat type Spoofing identity Tampering with data Repudiation Mitigation technique Authentication Protect secrets Do not store secrets Authorization Hashes Message authentication codes Digital signatures Tamper-resistant protocols Digital signatures Timestamps Audit trails [STRIDE] 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 21

22 Typical threats (contd.) Threat type Information disclosure Denial of service Elevation of privilege Mitigation technique Authorization Privacy-enhanced protocols Encryption Protect secrets Do not store secrets Authentication Authorization Filtering Throttling Quality of service Run with least privilege [STRIDE] 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 22

23 Summary A threat model helps in designing appropriate defenses against particular attackers Your solution and security countermeasures will depend on the particular threat model you want to address 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 23

24 Further Reading Frank Swiderski and Window Snyder, Threat Modeling, Microsoft Press, 2004 The STRIDE Threat Model 2/1/2010 en Spring 2010 Lecture 2 JHU Ragib Hasan 24