Hakin9.Org Security”
Total Page:16
File Type:pdf, Size:1020Kb
05/2012 (53) PRACTICAL PROTECTION IT SECURITY MAGAZINE Dear all, Spring finally! After long and cold winter I was looking for an inspiration. I was sitting in a park on a sunny day, enjoying the wonderful weather. Suddenly dark, grey clouds showed up on the sky. This when I thought team “Let’s make an issue about Cloud Computing”. Few authors agreed with Editor in Chief: Grzegorz Tabaka me and here is what we have for you First article by Gurav Shah – “Cloud [email protected] Security”. There are a number of security issues/concerns associated Managing Editor: Marta Jabłońska with cloud computing but these issues fall into two broad categories: [email protected] Security issues faced by cloud providers and security issues faced Editorial Advisory Board: Gurav Shah, Craig S. by their customers. In most cases, the provider must ensure that their Wright, infrastructure is secure and that their clients’ data and applications are Skyler Onken, Ivan Venclova, Mohsen Mostafa Jokar, Mervyn Heng, Christopher Pedersen, Gary S. Milefsky, protected while the customer must ensure that the provider has taken the Julian Evans, David Prokop proper security measures to protect their information. The extensive use Proofreaders: Donald Iverson, Michael Munt, Elliott of virtualization in implementing cloud infrastructure brings unique security Bujan, Bob Folden, Steve Hodge, Jonathan Edwards, concerns for customers or tenants of a public cloud service. Virtualization Steven Atcheson alters the relationship between the OS and underlying hardware – be Top Betatesters: Ivan Burke, John Webb, Nick Baronian, it computing, storage or even networking. This introduces an additional Felipe Martins, Alexandre Lacan, Rodrigo Rubira Branco layer – virtualization – that itself must be properly configured, managed Special Thanks to the Beta testers and Proofreaders who helped us with this issue. Without their assistance and secured. Specific concerns include the potential to compromise the there would not be a Hakin9 magazine. virtualization software, or “hypervisor”. While these concerns are largely Senior Consultant/Publisher: Paweł Marciniak theoretical, they do exist. CEO: Ewa Dudzic Next article by Gary s. Milefsky “Hacking the Cloud. Did someone [email protected] say Swiss Chees?” What is the cloud? Is it the glorified internet? Is it an Production Director: Andrzej Kuca ISP who likes to run virtualized servers? Once we truly understand what [email protected] Cloud Computing is, then let us look at the holes in the Cloud…I argue DTP: Ireneusz Pogroszewski that yes, the cloud is like Swiss Cheese, loaded with holes and ripe for Art Director: Ireneusz Pogroszewski exploitation. By the way, who is responsible for compliance when it comes [email protected] to ‘moving’ everything to the cloud – is it the Cloud Service provider or is Publisher: Software Press Sp. z o.o. SK it you, the company providing a service to end-customers/consumers? 02-682 Warszawa, ul. Bokserska 1 Phone: 1 917 338 3631 When it comes to regulatory compliance, if your cloud provider is not www.hakin9.org/en SAS-70 audited regularly (most are NOT) then don’t expect them to be responsible for your compliance posture. If there is a breach in the cloud, the bottom line is that it’s your responsibility, if you are using Cloud Computing to host servers or services used for your outward facing Whilst every effort has been made to ensure the high business or if you store confidential customer records ‘in the cloud.’ quality of the magazine, the editors make no warranty, Christopher Pedersen in an article “Do You Have The Correct express or implied, concerning the results of content usage. Cloud? Cloud Privacy” talks about types of cloud and how to keep your All trade marks presented in the magazine were used information private. only for informative purposes. We are starting to move to IPv6 and the cloud. Right now, the uptake is minimal at best with very few early adopters for all of the hype. The All rights to trade marks presented in the magazine are reserved by the companies which own them. climate is changing. Soon, IP addresses will be on everything and even To create graphs and diagrams we used the concept of non-disclosure agreements and contracts designed to program by protect intellectual property will require that we consider the nature of the cloud and the Internet as a platform for contractual negotiation. Read in Mathematical formulas created by Design Science more in “Secure commerce in the Mist” by Craig S Wright. MathType™ We have a new section in our magazine. “Extra Articles”. We prestent there articles which are not related to the main topic of the magazine, but DISCLAIMER! are very valuable and interesting. Check them out! The techniques described in our articles Like in every issue at the beginning you will find short news from IT may only be used in private, local networks. world and also we recommend Tool Time and (Il)legal columns. The editors hold no responsibility for I wish you a very good reading! misuse of the presented techniques or consequent data loss. Marta & Hakin9 Team 4 05/2012 �������������� ������������������������������������������������� ��������������������������������������������� ��������������� ��������������� �������������������������������������������� ���������������������������������������������� ���������������������������� ������������������������������������������������������������������������� ���������������������������������� 5 � CONTENTS IN BRIEF different way. The two primary differences are that your organization will share infrastructure resources with 8 IN BRIEF other organizations. Second, your organization trusts by Armando Romeo, eLearnSecurity and ID Theft the strength of the selected cloud vendor’s security Protect infrastructure, policies, and procedures. During the As usual specialists from companies eLearn Security selection of your organizations cloud computing services and ID Theft protect will share with us latest news from IT look in depth at the following areas and ensure that your security world. Read it to up-date yourself. selected vendor has addressed each topic and meets your organizations security policies and regulatory BASICS requirements. 10 Cloud Security 28 Do You Have The Correct Cloud? Cloud by Gurav Shah Privacy There are a number of security issues/concerns by Christopher Pedersen associated with cloud computing but these issues In both personal and business settings, clouding can be fall into two broad categories: Security issues faced a great tool. But how do you know that when you upload by cloud providers and security issues faced by their your information into the cloud it is private? Can anyone customers. In most cases, the provider must ensure that just connect to your data-store and start perusing through their infrastructure is secure and that their clients’ data your information? These are a few questions that we will and applications are protected while the customer must discuss. If you don’t know what the correct type of cloud ensure that the provider has taken the proper security is that you need, you may fail. The reason for this failure measures to protect their information. The extensive could primarily be a privacy issue. Yes, Privacy.The first use of virtualization in implementing cloud infrastructure question is, why are you using the cloud – business or brings unique security concerns for customers or personal? Most people don’t use the right type of cloud. tenants of a public cloud service. Virtualization alters the Are you launching applications, servers, or developing? relationship between the OS and underlying hardware – Are you using the correct cloud type that also delivers the be it computing, storage or even networking. correct amount of privacy? 18 Hacking the Cloud. Did someone say 32 Secure commerce in the Mist Swiss Cheese? by Craig S. Wright by Gary S. Milefsky We are starting to move to IPv6 and the cloud. Right now, What is the cloud? Is it the glorified internet? Is it an the uptake is minimal at best with very few early adopters ISP who likes to run virtualized servers? Once we truly for all of the hype. The climate is changing. Soon, IP understand what Cloud Computing is, then let us look at addresses will be on everything and even the concept the holes in the Cloud…I argue that yes, the cloud is like of non-disclosure agreements and contracts designed to Swiss Cheese, loaded with holes and ripe for exploitation. protect intellectual property will require that we consider By the way, who is responsible for compliance when it the nature of the cloud and the Internet as a platform for comes to ‘moving’ everything to the cloud – is it the Cloud contractual negotiation. Service provider or is it you, the company providing a service to end-customers/consumers? When it comes to regulatory compliance, if your cloud provider is not SAS- EXTRA ARTICLES 70 audited regularly (most are NOT) then don’t expect 36 Understanding Cyber Warfare and its them to be responsible for your compliance posture. Strategic Applications by Skyler Onken 24 A Secure Cloud? Simplicity is very important in every aspect of warfare. It by David Prokop is very difficult to coordinate such a large group of people As IT professionals we can’t look into our inboxes without to do a variety of tasks perfectly synchronized with each seeing a new whitepaper or webcast related to the cloud. other. Every level of complexity adds an exponential While usually helpful, rarely does the information address amount of time that is needed to train and rehearse the our favorite topic, security. In reality can a cloud based coordinated effort. Because of this cyber assets should system protect your data? In short, yes. Security threats keep their tasks relatively straight forward when working to a system based on cloud services are similar to a within a combined arms mission. When follow on units will traditional data center the threats just manifest in a be relying upon the efforts of a non-kinetic cyber force, it 6 05/2012 www.hakin9.org/en CONTENTS creates a large amount of “what-if” scenarios for that unit.