Cloud Security : What are the vulnerabilities ?

One of the biggest reasons why cloud euphoria has not lived up to its name is security. Are the concerns about security real? Have we separated cloud specific security issues from generic security issues? Today we try to discuss the various vulnerabilities of cloud. However before we get started I need to formally define unambiguously certain commonly (mis) used terms in security literature. Many articles on cloud security tend to use terms like vulnerability, risk and threat interchangeably. However each of these terms means very different things.
Risk in general is defined as a product of likelihood of an undesirable event and the severity of such an event.
Risk = Likelihood of Occurrence × Severity of Occurrence
For example if a denial of service attack which is nominally likely to occur every month but can be rectified in two minutes with no loss in data or customer , is termed as low risk as compared to an attack that occurs once a year but mutilates or steals the sensitive customer data. The likelihood or frequency of attack in general is dependent on two factors. Firstly it is dependent on attack agents’ motivation which is in turn dependent on value of attack, Effort needed and risk for the attackers. Secondly it is dependent on access the agents have to the attack targets.

Vulnerability is the probability that an asset will be unable to resist the actions of a threat agent. (Bernd Grobauer). Vulnerability is a attribute of a given system. For example cloud architecture is especially vulnerable to virtual machine escape (i.e - A virtual machine can be used to bypass the security protection in a host machine) .
"A Threat is a harmful act such as the deployment of a virus or illegal network penetration." (http://www.answers.com)
Now that we have got definitions out of the way , let us look at classifying cloud. This classification is useful to understand, isolate and neutralize specific security issues. Infrastructure as a service (IaaS), Platform as a service (PaaS) and Software as a service (SaaS) are three cloud computing paradigms. Each of these paradigms have different Threats, Vulnerabilities and Risks.

In IaaS the users rent out space to place their data. They also rent out computing power to run their analytics. In this scenario one needs to ask two questions.
1. Is the data secure?
2. Is the code secure?
Data in IaaS particularly is prone to injection vulnerability. An SQL injection might rewrite or input wrong data. Also because a number of users share network infrastructure components, there is high risk of cross tenant attacks. Vulnerabilities related to Dynamic Host Con¬figuration Protocol, and IP protocol also become predominant. In IaaS model the physical security of infrastructure and disaster management to the infrastructure is also of importance. "Infrastructure not only pertains to the hardware where data is processed and stored but also the path where it is getting transmitted. "(Subashini S)
One example of PaaS is an enterprise application sitting on top of Googe App engine. In PaaS models the platform provider gives control to third parties to build applications on top of his platform. In order to enable multiple players to participate effectively, PaaS vendors generally have less built in protection capabilities. Moreover they are likely to provide access to parts of code to promote effective interface and API development.
In SaaS applications are remotely hosted by the application or service provider and made available to customers when it is demanded in a automated fashion. Here the cloud user is completely at the mercy of the cloud provider for security. There could be vulnerabilities related to data security, network security , data segregation web application security etc. Malicious users can exploit security in the cloud vendors systems by multiple means like cross site request forgery, SQL injection, cookie manipulation etc.
The next blogs will look at few of the vulnerabilities discussed above through few cases of cyber-attacks on cloud computing systems.

Bibliography
Bernd Grobauer, T. W. (n.d.). Understanding Cloud Computing Vulnerabilities.
http://www.answers.com. (n.d.). Retrieved from topic/risk-assessment.
Subashini S, K. V. (n.d.). A survey on security issues in service delivery models of cloud computing. JNetwork Comput Appl(2010),doi:10.1016/j.jnca.2010.07.006.

NIST Recommendation of Cloud Security

NIST defines cloud computing as a  "model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or cloud provider interaction."
NIST contends that small organizations that have limited IT resources have a potential security upside in migrating to public clouds. The advantages of moving to cloud are :
1. Large cloud providers like amazon  hire specialized security experts to protect the cloud from attacks and data corruption. This degree of staff specialization is generally better for normal customers.
2. Platform strength: Cloud computing architecture is massive and uniform . This allows cloud providers to automate security management activities security audits, and security patching . Such activities in general provide better security.
3. Resource Availability: Due to infrastructure on demand, the organizations can protect against the data corruption by building in redundancy on the cloud.
4. Backup and Recovery: The backup and recovery provided by cloud providers are better than what a small organization can afford on its own.
5. Data Concentration: What would happen if your work laptop was stolen and it contained all the company secrets ? Cloud allows for data concentration , hence preventing data compromise in events like theft.

However the disadvantages of cloud computing paradigm to security and privacy issues are as follows:

1.  Cloud computing  are more complex.They have many more  components like resource metering and  quota management software. This increases the attack surface and hence the risk of a attack.
2. Shared Multi-tenant Environment : An attacker posing as a consumer can use the shared resources and network components to launch an attck .
3. Internet-facing Services: By definition the cloud serveries are delivered over the internet. Hence it is more difficult to maintain security as compared to computers that had access only to intranet.
4. Loss of Control :Is your money safer in your bank or in your safety locker ? While keeping money in bank you are trusting the bank to protect your resources better.You are relinquishing your control over your money. It is similar in terms of data for an organization that migrates to cloud.

Broadly NIST recommends the following approach to analyzing the system security of a cloud deployment.
1. Determine Security objectives of Organization
2. Perform an analysis of the risk for client's data , application and infrastructure.
3. Make an inventory of  policies, procedures, and technical controls used by a cloud provider. These are generally captured in Service Level Agreement (SLA) and terms of use .
4. Establish a new SLA with the cloud providers if a gap exists between organizations security requirements and the cloud provider’s standard security.
5. Ensure that the client-side  environment meets your  privacy requirements .
6. Choose the appropriate deployment model (Public cloud, community cloud, private cloud or community cloud).
7. Determine who is  accountable for  the privacy and security of data and applications that you have put in cloud.
8. Governance: Put in place auditing procedures to check for the software isolations and data protection.
9. Develop an appropriate incident reporting mechanism so that the intrusions are detected and reported to the client in a timely manner.

Though this is the initial framework from NIST , we expect it to evolve as the technology matures and the more vulnerabilities are uncovered.

- Abhijith and Benoy

Open Stack and Cloud Security

Open stack is a Infrastructure as a Service initiative launched in July 2010 by Rackspace in collaboration with NASA. As of today there are more than 100 companies, including Cisco Systems Inc., HP, IBM, Citrix Systems Inc., Dell Inc., Intel Corp. and Microsoft that are contributing to its development. Open stack software is released under the terms of Apache license.
There are 3 components in open stack architecture . They are  Compute (Nova) , Object Storage (Swift) and Image Service (Glance) .

It is fairly obvious that Openstack mitigates the vendor technology lock in issues. But from security perspective Openstack like other Apache and Linux platforms ensures that security flaws are found and fixed quickly. In Openstack world, vulnerability management is performed by vulnerability management team, which is a group of independent security professionals who need not seek the consent of their employer to reveal the vulnerability of platform to downstream players in an organized and fair manner. A detailed explanation of Vulnerability management in Openstack is provided below.
Vulnerability management in Open stack:
It is a process by which information about a security flaw discovered is communicated to all the stakeholders without compromising the system security. VMT at open stack follows the rule of lesser disclosure.
Map of vulnerability disclosure in openstack:
1. Co-coordinator of VMT receives encrypted email from original reporter about the vulnerability.
2. Vulnerability management team along with reporter creates security-restricted Launchpad bug entry.
3. The Project Technical Lead of affected project is warned and asked to confirm impact
4. Then the reporter, VMT team, PTL and some key developers develop a fix
5. Vulnerability management team and developers get fix pre-approved by Core team
6. Core team alerts  issue and provides fix to all  stakeholders
7. development team updates the latest version of software.  (OpenStack.org)

On the flip side It is relatively new platform with little vendor experience. Hence system administrators and deployment personnel may make mistakes that could later turn out to be security flaws. Also open stack has a small security group which is still uncovering issues. The OpenStack Security Group (OSSG) is the group within the project that is tasked with looking at security.
Recently there have been many commercial implementations of OpenStack system to address these security vulnerabilities. For example PistonEnterprise OS (PentOS) claims to focus on the security and operations of the private cloud. Also there have been some unprecedented changes in the way security is being implemented in cloud systems. We now have “CloudAudit” to specification to help the cloud service providers to implement their architecture in such a way so that it would make security data readily available for their customers. Cloud service providers can emphasize their security measures to differentiate themselves from their competitors in an increasingly homogenous space. The advent of new auditing techniques and entry of open source cloud technologies, can potentially lead to various security vulnerabilities and equally creative solutions to solve them.
Bibliography
OpenStack.org. (n.d.). Retrieved from http://wiki.openstack.org/VulnerabilityManagement?highlight=%28VMT%29.
Wikipedia. (n.d.). Retrieved from http://en.wikipedia.org/wiki/OpenStack.

Penetration Testing on the Cloud

A penetration test looks at the residual risk and vulnerability present in the application or system that can potentially be exploited by a hacker with malicious intent. It involves a simulated attack on a system by a tester who explores the various attack surfaces of the application or system. At the simplest level penetration testing involves 3 phases. The first phase is preparation, where a formal contract is executed with the client. Here the roles and responsibilities as well as the scope of testing is defined.
In cloud computing, it is very important to ensure that the scope of pen testing is appropriately determined. Since resources such as IP addresses  change within the environment the penetration testers should take care to prevent  accidental testing of resources not owned by the client and violating terms of service. It would be more appropriate to ensure that the ip address of pen test defined close to the date of test so that dynamic changes in IP addreses do not create issues.
Typically in the application going to cloud the scope depends on the type of cloud service used. If the client (cloud user) is using a IaaS service, then a thorough pen test must look at vulnerability in virtual machine , solution stack , application layer and APIs. However if it is Platform as service a typical pen test would involve application and API layers. SaaS vendors typically do not allow for third party pen testing unless otherwise explicitly mentioned in a service level agreement.
The next phase is Execution. Here the penetration test is executed with the tester looking for potential vulnerabilities. Pen testing is a fairly prevalent practice for any application – Not just the ones in the cloud. Open web application security project recommends nine types of pen testing categories. They are:
1. Testing of Configuration management practices
2. Testing to ensure that the business logic makes sense.
3. Testing Authentication procedures and policies.
4. Testing who has authorization over various parts of system.
5. Making sure that the session are killed aproriately after their use.
6. Validating data integrity.
7. Checking for denial of service attacks.
8. Checking to ensure web services are secure.
9. Ajax testing
These standard testing practices are necessary to application developed for cloud. However they are not sufficient! Depending on cloud deployment model additional threat vectors might need to induced. For example in a IaaS service model , owing to multi tenancy at infrastructure level, deficiencies in virtualization security like improper VM zoning , segregation must be tested by using the inter VM security/ vulnerability testing.
The last phase of penetration testing is Delivery. Here the results of evaluation are communicated to tester’s contact in the host organization and corrective actions are advised. It is important to maintain logs of all previous pen tests and share it with the tester in order to see the delta improvements in the security posture of the company.

Product Vision Statement

For an Indian university student ,Who needs to acquire grocery The shop_4_me is a website That will enable transport the Indian grocery items from shop to home. Unlike other online retail stores ,Our product shop_4_me will provide incentives to a peer / friend to transport items from shop to destination in return for a discount on a on store purchase.