DOCSLIB.ORG

Information Supplement: PCI SSC Cloud Computing Guidelines

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Information Supplement: PCI SSC Cloud Computing Guidelines Date: April 2018 Author: Cloud Special Interest Group PCI Security Standards Council Information Supplement: PCI SSC Cloud Computing Guidelines Information Supplement • Cloud Computing Guidelines • April 2018 Document Changes Date Version Description February 2013 2.0 Initial publication of PCI DSS v2.0 Cloud Computing Guidelines, produced by 2013 Cloud SIG. April 2018 3.0 Updated PCI SSC Guidelines for Secure Cloud Computing, produced by 2017 Cloud SIG. Changes include: • Restructure of the document for better flow (e.g., consolidation of Sections 6.3 and 6.4, and moving Section 6.5 to Appendix E). • Updated guidance on roles and responsibilities, scoping cloud environments, and PCI DSS compliance challenges. • Expanded guidance on incident response and forensic investigation. • New guidance on vulnerability management, as well as additional technical security considerations on topics such as Software Defined Networks (SDN), Containers, Fog Computing and Internet of Things (IoT). • Standardized terminology throughout the document. • Updated references to PCI SSC and external resources. • Minor grammatical updates. The intent of this document is to provide supplemental information. Information provided here i does not replace or supersede requirements in any PCI SSC Standard. Information Supplement • Cloud Computing Guidelines • April 2018 Table of Contents Document Changes .................................................................................................................................................. i 1 Introduction ........................................................................................................................................................ 1 1.1 Intended Audience ........................................................................................................................................ 2 1.2 Terminology................................................................................................................................................... 2 1.3 Summary of Recommendations .................................................................................................................... 3 2 Cloud Overview .................................................................................................................................................. 5 2.1 Cloud Deployment Models ............................................................................................................................ 5 2.2 Cloud Capabilities Types and Cloud Service Categories ............................................................................. 6 3 Cloud Provider/Customer Relationships ........................................................................................................ 8 3.1 Understanding Roles and Responsibilities ................................................................................................... 8 3.2 Roles and Responsibilities for Different Cloud Deployment Models............................................................. 8 3.3 Responsibilities for Different Cloud Service Categories ............................................................................... 9 3.4 Nested Service Provider Relationships ....................................................................................................... 11 4 PCI DSS Considerations ................................................................................................................................. 13 4.1 Understanding PCI DSS Responsibilities ................................................................................................... 13 4.2 PCI DSS Responsibilities for Different Cloud Service Categories .............................................................. 13 4.3 Understanding Responsibilities of Security as a Service (SECaaS) .......................................................... 16 4.4 Segmentation Considerations ..................................................................................................................... 16 4.4.1 Segmentation Challenges .................................................................................................................... 17 4.4.2 Segmentation Responsibilities ............................................................................................................. 18 4.4.3 Segmentation Technologies ................................................................................................................. 18 4.5 Scoping Considerations .............................................................................................................................. 19 4.5.1 Security of Cloud Service Customer Systems ...................................................................................... 21 4.5.2 Scoping Examples for Different Cloud Deployment Models ................................................................ 22 5 PCI DSS Compliance Challenges ................................................................................................................... 26 5.1 What Does It Mean When a Provider States, "I Am PCI DSS Compliant"? ............................................... 27 5.2 Verifying the Scope of PCI DSS Validated Services and Components ...................................................... 27 5.3 Verifying PCI DSS Controls Managed by the Cloud Service Provider ....................................................... 28 6 Security Considerations ................................................................................................................................. 31 6.1 Governance, Risk and Compliance ............................................................................................................ 31 6.1.1 Risk Management ................................................................................................................................. 31 6.1.2 Due Diligence ....................................................................................................................................... 32 6.1.3 Service Level Agreements .................................................................................................................... 32 6.1.4 Business Continuity Plans and Disaster Recovery .............................................................................. 33 6.1.5 Human Resources ................................................................................................................................ 33 6.2 Facilities and Physical Security ................................................................................................................... 33 6.3 Data Security Considerations ...................................................................................................................... 34 The intent of this document is to provide supplemental information. Information provided here ii does not replace or supersede requirements in any PCI SSC Standard. Information Supplement • Cloud Computing Guidelines • April 2018 6.3.1 Data Acquisition .................................................................................................................................... 34 6.3.2 Data Storage and Persistence .............................................................................................................. 36 6.3.3 Data Usage ........................................................................................................................................... 36 6.3.4 Sharing Data ......................................................................................................................................... 36 6.3.5 Decommissioning and Disposal ........................................................................................................... 36 6.4 Incident Response and Forensic Investigation ........................................................................................... 37 6.4.1 Incident Response ................................................................................................................................ 37 6.4.2 Forensics Investigation ......................................................................................................................... 37 6.4.3 Breach Notification ............................................................................................................................... 38 6.5 Vulnerability Management ........................................................................................................................... 39 6.5.1 Web Application Vulnerability Testing .................................................................................................. 40 6.5.2 Network Vulnerability Scanning ............................................................................................................ 40 6.5.3 Penetration Testing .............................................................................................................................. 41 6.5.4 Notification of Testing ........................................................................................................................... 42 Appendix A: Sample PCI DSS Responsibilities for Different Cloud Service Categories ............................... 43 Appendix B: Sample Inventory ............................................................................................................................. 49 Appendix C: Sample PCI DSS Responsibility Management Matrix .................................................................
Load more

Recommended publications
  • The Kernel Report
    The kernel report (ELC 2012 edition) Jonathan Corbet LWN.net [email protected] The Plan Look at a year's worth of kernel work ...with an eye toward the future Starting off 2011 2.6.37 released - January 4, 2011 11,446 changes, 1,276 developers VFS scalability work (inode_lock removal) Block I/O bandwidth controller PPTP support Basic pNFS support Wakeup sources What have we done since then? Since 2.6.37: Five kernel releases have been made 59,000 changes have been merged 3069 developers have contributed to the kernel 416 companies have supported kernel development February As you can see in these posts, Ralink is sending patches for the upstream rt2x00 driver for their new chipsets, and not just dumping a huge, stand-alone tarball driver on the community, as they have done in the past. This shows a huge willingness to learn how to deal with the kernel community, and they should be strongly encouraged and praised for this major change in attitude. – Greg Kroah-Hartman, February 9 Employer contributions 2.6.38-3.2 Volunteers 13.9% Wolfson Micro 1.7% Red Hat 10.9% Samsung 1.6% Intel 7.3% Google 1.6% unknown 6.9% Oracle 1.5% Novell 4.0% Microsoft 1.4% IBM 3.6% AMD 1.3% TI 3.4% Freescale 1.3% Broadcom 3.1% Fujitsu 1.1% consultants 2.2% Atheros 1.1% Nokia 1.8% Wind River 1.0% Also in February Red Hat stops releasing individual kernel patches March 2.6.38 released – March 14, 2011 (9,577 changes from 1198 developers) Per-session group scheduling dcache scalability patch set Transmit packet steering Transparent huge pages Hierarchical block I/O bandwidth controller Somebody needs to get a grip in the ARM community.
    [Show full text]
  • Rootless Containers with Podman and Fuse-Overlayfs
    CernVM Workshop 2019 (4th June 2019) Rootless containers with Podman and fuse-overlayfs Giuseppe Scrivano @gscrivano Introduction 2 Rootless Containers • “Rootless containers refers to the ability for an unprivileged user (i.e. non-root user) to create, run and otherwise manage containers.” (https://rootlesscontaine.rs/ ) • Not just about running the container payload as an unprivileged user • Container runtime runs also as an unprivileged user 3 Don’t confuse with... • sudo podman run --user foo – Executes the process in the container as non-root – Podman and the OCI runtime still running as root • USER instruction in Dockerfile – same as above – Notably you can’t RUN dnf install ... 4 Don’t confuse with... • podman run --uidmap – Execute containers as a non-root user, using user namespaces – Most similar to rootless containers, but still requires podman and runc to run as root 5 Motivation of Rootless Containers • To mitigate potential vulnerability of container runtimes • To allow users of shared machines (e.g. HPC) to run containers without the risk of breaking other users environments • To isolate nested containers 6 Caveat: Not a panacea • Although rootless containers could mitigate these vulnerabilities, it is not a panacea , especially it is powerless against kernel (and hardware) vulnerabilities – CVE 2013-1858, CVE-2015-1328, CVE-2018-18955 • Castle approach : it should be used in conjunction with other security layers such as seccomp and SELinux 7 Podman 8 Rootless Podman Podman is a daemon-less alternative to Docker • $ alias
    [Show full text]
  • AWS Risk and Compliance Whitepaper for Additional Details - Policy Available At
    Amazon Web Services: Risk and Compliance January 2017 (Consult http://aws.amazon.com/compliance/resources for the latest version of this paper) Amazon Web Services Risk and Compliance January 2017 This document is intended to provide information to assist AWS customers with integrating AWS into their existing control framework supporting their IT environment. This document includes a basic approach to evaluating AWS controls and provides information to assist customers with integrating control environments. This document also addresses AWS-specific information around general cloud computing compliance questions. Table of Contents Risk and Compliance Overview .......................................................................................................................3 Shared Responsibility Environment ............................................................................................................................................... 3 Strong Compliance Governance ...................................................................................................................................................... 4 Evaluating and Integrating AWS Controls ...................................................................................................4 AWS IT Control Information ........................................................................................................................................................... 5 AWS Global Regions .........................................................................................................................................................................
    [Show full text]
  • Security of Cloud Computing in the Iot Era
    future internet Article Cyber-Storms Come from Clouds: Security of Cloud Computing in the IoT Era Michele De Donno 1 , Alberto Giaretta 2, Nicola Dragoni 1,2 and Antonio Bucchiarone 3,∗ and Manuel Mazzara 4,∗ 1 DTU Compute, Technical University of Denmark, 2800 Kongens Lyngby, Denmark; [email protected] (M.D.D.); [email protected] (N.D.) 2 Centre for Applied Autonomous Sensor Systems Orebro University, 701 82 Orebro, Sweden; [email protected] 3 Fondazione Bruno Kessler, Via Sommarive 18, 38123 Trento, Italy 4 Institute of Software Development and Engineering, Innopolis University, Universitetskaya St, 1, 420500 Innopolis, Russian Federation * Correspondence: [email protected] (A.B.); [email protected] (M.M.) Received: 28 January 2019; Accepted: 30 May 2019; Published: 4 June 2019 Abstract: The Internet of Things (IoT) is rapidly changing our society to a world where every “thing” is connected to the Internet, making computing pervasive like never before. This tsunami of connectivity and data collection relies more and more on the Cloud, where data analytics and intelligence actually reside. Cloud computing has indeed revolutionized the way computational resources and services can be used and accessed, implementing the concept of utility computing whose advantages are undeniable for every business. However, despite the benefits in terms of flexibility, economic savings, and support of new services, its widespread adoption is hindered by the security issues arising with its usage. From a security perspective, the technological revolution introduced by IoT and Cloud computing can represent a disaster, as each object might become inherently remotely hackable and, as a consequence, controllable by malicious actors.
    [Show full text]
  • Implementation of a Mini-Cloud E-Learning Supplementary Tool by Using Free Tier AWS
    See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/333670196 Implementation of a Mini-cloud E-learning Supplementary Tool by Using free Tier AWS Conference Paper · June 2019 DOI: 10.15359/cicen.1.79 CITATIONS READS 0 148 2 authors: Manuel Espinoza Majid Bayani National University of Costa Rica National University of Costa Rica 1 PUBLICATION 0 CITATIONS 21 PUBLICATIONS 88 CITATIONS SEE PROFILE SEE PROFILE Some of the authors of this publication are also working on these related projects: IoT-Based Library Automation & monitoring System View project All content following this page was uploaded by Majid Bayani on 09 June 2019. The user has requested enhancement of the downloaded file. Implementation of a Mini-cloud E-learning Supplementary Tool by Using free Tier AWS Manuel Espinoza-Guerrero [email protected] Universidad Nacional Costa Rica Majid Bayani-Abbasy [email protected] Universidad Nacional Costa Rica Resumen Las técnicas de e-learning han mejorado el rendimiento en el sistema educativo moderno. Falta un sistema de gestión de e-learning efectivo y de bajo costo, y las herramientas podría tener un impacto negativo en el rendimiento educativo. La incorporación de tecnologías en línea en el proceso de aprendizaje puede cubrir esta desventaja. El sistema de nube de Amazon Web Service es una de las últimas tecnologías que ofrecen grandes volúmenes de servicios en las plataformas de aprendizaje electrónico. Accesando la capa gratuita de AWS, el sistema de gestión de aprendizaje (un Moodle con MYSQL), el alojamiento de archivos y los servicios de gestión de contenido se consideran herramientas complementarias que son viables mediante el uso de la plataforma AWS.
    [Show full text]
  • Practical and Effective Sandboxing for Non-Root Users
    Practical and effective sandboxing for non-root users Taesoo Kim and Nickolai Zeldovich MIT CSAIL Abstract special tools. More importantly, all use cases neither re- quire root privilege nor require modification to the OS MBOX is a lightweight sandboxing mechanism for non- kernel and applications. root users in commodity OSes. MBOX’s sandbox usage model executes a program in the sandbox and prevents Overview MBOX aims to make running a program in a the program from modifying the host filesystem by layer- sandbox as easy as running the program itself. For exam- ing the sandbox filesystem on top of the host filesystem. ple, one can sandbox a program (say wget) by running as At the end of program execution, the user can examine below: changes in the sandbox filesystem and selectively com- mit them back to the host filesystem. MBOX implements $ mbox -- wget google.com ... this by interposing on system calls and provides a variety Network Summary: of useful applications: installing system packages as a > [11279] -> 173.194.43.51:80 > [11279] Create socket(PF_INET,...) non-root user, running unknown binaries safely without > [11279] -> a00::2607:f8b0:4006:803:0 network accesses, checkpointing the host filesystem in- ... Sandbox Root: stantly, and setting up a virtual development environment > /tmp/sandbox-11275 without special tools. Our performance evaluation shows > N:/tmp/index.html [c]ommit, [i]gnore, [d]iff, [l]ist, [s]hell, [q]uit ?> that MBOX imposes CPU overheads of 0.1–45.2% for var- ious workloads. In this paper, we present MBOX’s design, wget is a utility to download files from the web.
    [Show full text]
  • Cloud Security and Privacy: an Enterprise Perspective on Risks and Compliance Pdf, Epub, Ebook
    CLOUD SECURITY AND PRIVACY: AN ENTERPRISE PERSPECTIVE ON RISKS AND COMPLIANCE PDF, EPUB, EBOOK Tim Mather, Subra Kumaraswamy, Shahed Laitf | 338 pages | 20 Oct 2009 | O'Reilly Media, Inc, USA | 9780596802769 | English | Sebastopol, United States Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance PDF Book Data ownership. Cloud Compliance Summary An integrated compliance view gives the overall health score, the total number of checks against compliance, the number of passes, and classified failures based on severity levels. Follow Us. Language: English. Cloud computing is a multi million dollar business. Francisco Eduardo Alves rated it it was amazing Jun 29, Book is in NEW condition. View 3 excerpts, references background. Get A Copy. Skip to search form Skip to main content You are currently offline. Content protection. Ideal for IT staffers, information security and privacy practitioners, business managers, service providers, and investors alike, this book offers you sound advice from three well-known authorities in the tech security world. Error rating book. General privacy challenges of cloud computing One of these challenges in cloud computing is connected to the sensitivity of the entrusted information. With Cloud Security and Privacy you will: Review the current state of data security and storage in the cloud Learn about identity and access management IAM practices for cloud services Discover which security management frameworks and standards are relevant Understand how privacy in the cloud compares with traditional computing models Learn about standards and frameworks for audit and compliance within the cloud Examine security delivered as a service--a different facet of cloud security Advance Praise " Cloud Security and Privacy is the seminal tome to guide information technology professionals in their pursuit of trust in 'on-demand computing.
    [Show full text]
  • Demystifying Internet of Things Security Successful Iot Device/Edge and Platform Security Deployment — Sunil Cheruvu Anil Kumar Ned Smith David M
    Demystifying Internet of Things Security Successful IoT Device/Edge and Platform Security Deployment — Sunil Cheruvu Anil Kumar Ned Smith David M. Wheeler Demystifying Internet of Things Security Successful IoT Device/Edge and Platform Security Deployment Sunil Cheruvu Anil Kumar Ned Smith David M. Wheeler Demystifying Internet of Things Security: Successful IoT Device/Edge and Platform Security Deployment Sunil Cheruvu Anil Kumar Chandler, AZ, USA Chandler, AZ, USA Ned Smith David M. Wheeler Beaverton, OR, USA Gilbert, AZ, USA ISBN-13 (pbk): 978-1-4842-2895-1 ISBN-13 (electronic): 978-1-4842-2896-8 https://doi.org/10.1007/978-1-4842-2896-8 Copyright © 2020 by The Editor(s) (if applicable) and The Author(s) This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Open Access This book is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made. The images or other third party material in this book are included in the book’s Creative Commons license, unless indicated otherwise in a credit line to the material.
    [Show full text]
  • Hardening Kubernetes Containers Security with Seccomp an Often Overlooked Way to Harden Kubernetes Containers’ Security Is by Applying Seccomp Profiles
    eBook: Hardening Kubernetes Containers Security with Seccomp An often overlooked way to harden Kubernetes containers’ security is by applying seccomp profiles. A relatively ancient security mechanism in the Linux kernel, seccomp (short for secure computing mode) tells the Linux kernel which system calls a process can make. Restricting a process from accessing the kernel via system calls restricts the attack surface, and can prevent privilege escalation. The original seccomp was very restrictive and unwieldy to use. The first version of seccomp was merged in 2005 into Linux 2.6.12. It was enabled by writing a "1" to /proc/PID/seccomp. Then, the process could only make 4 syscalls: read(), write(), exit(), and sigreturn()"). Today, the seccomp-bpf extension, which uses the Berkeley Packet Filter rules, is more commonly used as it allows filtering system calls using a configurable policy. 1 Given the number of system calls invoked to execute a Customizing seccomp profiles, in effect, provides a container, each of which is a potential entry vector for deeply embedded line of defense that adds a layer of attackers, appropriately applying seccomp profiles goes a protection to your application in case of breach. As the long way to securing a container. probability of any application being breached is constantly rising, limiting the possible extent of a successful breach should be applied at as many levels as possible. Ever-increasing interconnections between applications, and increased reliance on external service providers as well as open-source images makes restricting seccomp profiles crucial to improving cloud-native security. Filtering system calls is not the same as sandboxing.
    [Show full text]
  • THE EMERGING CLOUD ECOSYSTEM: Cyber Security Plus LI/RD
    Day 2, Thursday, 2012 Jan 19, 09.00 hrs SESSION 4: Security in the Cloud THE EMERGING CLOUD ECOSYSTEM: cyber security plus LI/RD Tony Rutkowski, Yaana Technologies 7th ETSI Security Workshop, 18‐19 Jan 2011 © ETSI 2012. All rights reserved Outline Security as a Business opportunity: A winning driver to ensure technology success and increase confidence and trust amongst end‐users ! CtCurrent Clou d dldevelopment s Cyber security and LI/RD developments Business opportunities 2 ETSI/Security Workshop (7) S4 The Basics: a new cloud‐based global communications infrastructure is emerging Global network architectures are profoundly, rapidly changing • PSTNs/mobile networks are disappearing • Internet is disappearing • Powerful end user devices for virtual services are becoming ubiquitous • End user behavior is nomadic • Huge data centers optimized for virtual services combined with local access bandwidth are emerging worldwide as the new infrastructure These changes are real, compelling, and emerging rapidly Bringing about a holistic “cloud” ecosystem is occupying idindustry in almost every venue around the world 3 ETSI/Security Workshop (7) S4 The Basics: a new cloud‐virtualized global communications architecture Virtualized Line or air Access, IdM & transport Intercloud Other cloud virtualization services, devices interfaces cloud virtualization services services especially for application support Access, IdM & transport General services Intercloud General Access, IdM & transport services General Intercloud Access, IdM & transport services
    [Show full text]
  • Enclave Security and Address-Based Side Channels
    Graz University of Technology Faculty of Computer Science Institute of Applied Information Processing and Communications IAIK Enclave Security and Address-based Side Channels Assessors: A PhD Thesis Presented to the Prof. Stefan Mangard Faculty of Computer Science in Prof. Thomas Eisenbarth Fulfillment of the Requirements for the PhD Degree by June 2020 Samuel Weiser Samuel Weiser Enclave Security and Address-based Side Channels DOCTORAL THESIS to achieve the university degree of Doctor of Technical Sciences; Dr. techn. submitted to Graz University of Technology Assessors Prof. Stefan Mangard Institute of Applied Information Processing and Communications Graz University of Technology Prof. Thomas Eisenbarth Institute for IT Security Universit¨atzu L¨ubeck Graz, June 2020 SSS AFFIDAVIT I declare that I have authored this thesis independently, that I have not used other than the declared sources/resources, and that I have explicitly indicated all material which has been quoted either literally or by content from the sources used. The text document uploaded to TUGRAZonline is identical to the present doctoral thesis. Date, Signature SSS Prologue Everyone has the right to life, liberty and security of person. Universal Declaration of Human Rights, Article 3 Our life turned digital, and so did we. Not long ago, the globalized commu- nication that we enjoy today on an everyday basis was the privilege of a few. Nowadays, artificial intelligence in the cloud, smartified handhelds, low-power Internet-of-Things gadgets, and self-maneuvering objects in the physical world are promising us unthinkable freedom in shaping our personal lives as well as society as a whole. Sadly, our collective excitement about the \new", the \better", the \more", the \instant", has overruled our sense of security and privacy.
    [Show full text]
  • Data Protection and Collaboration in Cloud Storage
    Technical Report 1210 Charting a Security Landscape in the Clouds: Data Protection and Collaboration in Cloud Storage G. Itkis B.H. Kaiser J.E. Coll W.W. Smith R.K. Cunningham 7 July 2016 Lincoln Laboratory MASSACHUSETTS INSTITUTE OF TECHNOLOGY LEXINGTON, MASSACHUSETTS This material is based on work supported by the Department of Homeland Security under Air Force Contract No. FA8721-05-C-0002 and/or FA8702-15-D-0001. Approved for public release: distribution unlimited. This report is the result of studies performed at Lincoln Laboratory, a federally funded research and development center operated by Massachusetts Institute of Technology. This material is based on work supported by the Department of Homeland Security under Air Force Contract No. FA8721-05- C-0002 and/or FA8702-15-D-0001. Any opinions, findings and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of Department of Homeland Security. © 2016 MASSACHUSETTS INSTITUTE OF TECHNOLOGY Delivered to the U.S. Government with Unlimited Rights, as defined in DFARS Part 252.227-7013 or 7014 (Feb 2014). Notwithstanding any copyright notice, U.S. Government rights in this work are defined by DFARS 252.227-7013 or DFARS 252.227-7014 as detailed above. Use of this work other than as specifically authorized by the U.S. Government may violate any copyrights that exist in this work. Massachusetts Institute of Technology Lincoln Laboratory Charting a Security Landscape in the Clouds: Data Protection and Collaboration in Cloud Storage G. Itkis B. Kaiser J. Coll W. Smith R.
    [Show full text]