The Magnificent 7: Best Practices for Cloud Security
-
Upload
alert-logic -
Category
Technology
-
view
106 -
download
1
Transcript of The Magnificent 7: Best Practices for Cloud Security
THE MAGNIFICENT SEVEN: BEST PRACTICES FOR CLOUD SECURITY
James Brown, Director Cloud Computing & Solution Architecture
Before We Begin
Housekeeping Speaker
• Turn on your system’s sound to
hear the streaming presentation
• Questions? Submit them to the
presenter at anytime into the
question box
• The presentation slides will be
available to download from the
attachment tab after the webinar
• The webinar will be recorded
and published on BrightTalk
• Technical Problems? Click
“Help”
• James Brown
• Director of Cloud Computing &
Security Architecture, Alert Logic
Providing fully managed and monitored security and compliance for
cloud, hybrid, and on-premises infrastructure, with the benefits of deep
insight, continuous protection, and lower costs
Continuous Protection
Lower Total Costs
Deep Security Insight
Leading Provider of Security & Compliance Solutions for the Cloud
Leading Provider of Security & Compliance for the Cloud
#1 for Cloud Platforms
#1 in Security-as-a-Service
#1 for Managed Cloud & Hosting Providers
Over 3,000
customers
worldwide
Sensitive Data is the Heart of Your Business
“Most organizations
(almost 80%) will suffer
at least one successful
attack that will cause
some serious harm...”
Worldwide Security and
Vulnerability Management
2014–2018 Forecast
Innovation
Competitive
Advantage
Shareholder
Value
Increasing
Sales
The IT and Threat Landscape has Changed
D A T A C E N T E R S
The Hybrid Data Center
• Cloud/mobile First approach
by many companies
• Public cloud and Hybrid IT
environments mainstream
The Virtual Data Center
• Virtualization becomes
mainstream
• Public clouds launch
• Mobile devices proliferate
The Physical Data Center
• X86 server pre-dominant
• Primarily on-premises
• Hosting providers emerge
• Cloud options being
developed
T H R E A T S A N D A T T A C K S
Next Generation Threats
• Advanced attacks
• Multi-vector approach
• Social engineering
• Targeted recon
• Long duration compromises
Catalyst for Change
• Proliferation of malware
• Organized hacking groups
• Access to information
• Financial gain motivation
The Early Days of Threats
• Basic malware
• Spray and pray
• Smash-n-grab
• Solo hackers
• Mischief motivation
EARLY 2000’s MID 2000’s 2015 & BEYOND
Today’s Attacks are Becoming More Complex
• Attacks are multi-stage using multiple threat vectors
• Takes organizations months to identify they have been compromised
• 205 days on average before detection of compromise1
• Over two-thirds of organizations find out from a 3rd party they have been compromised2
1 – IDC Worldwide Security and Vulnerability Management 2014–2018 Forecast
2 – M-Trends 2015: A View from the Front Lines
Initial
Attack
Identify &
Recon
Comman
d &
Control
Discover &
Spread
Extract &
Exfiltrate
The Impact
• Financial loss
• Harm brand
and reputation
• Scrutiny from
regulators
Attacks Happen at Multiple Layers of the Application Stack
THE IMPACT
• Every layer of the
application stack is under
attack
• Attacks are multi-stage
using multiple threat
vectors
• Web applications are #1
vector in the cloud
• Security must be cloud-
native, cover every layer of
application stack, and
identify attacks at every
stage.
SQL Injection
Identify &
Recon
Command
& Control
Worm
Outbreak
Extract &
Exfiltrate
Malware
Brute
Force
Identify &
Recon
Seven Best Practices for Cloud Security
1. Secure your Application
2. Create access management policies
3. Adopt a patch management approach
4. Review logs regularly
5. Build a security toolkit
6. Stay informed of the latest vulnerabilities
7. Understand your cloud service provider security model
1. Secure Your Application
• Test inputs that are open to the Internet
• Add security into the DevOps pipeline
• Use encryption when you can
• Test libraries
• Scan plugins
• Scan your code after every update
• Limit privileges
• Stay informed
2. Create Access Management Policies
• Start with a least privilege access model
• Define roles and responsibilities
• Simplify access controls (KISS)
• Continually audit access
3. Adopt a Patch Management Approach
• Inventory all production systems
• Devise a plan for standardization, if possible
• Compare reported vulnerabilities to production infrastructure
• Classify the risk based on vulnerability and likelihood
• Test patches before you release into production
• Setup a regular patching schedule
4. Importance of Log Management and Review
• Monitoring for malicious activity
• Forensic investigations
• Compliance needs
• System performance
• All sources of log data is collected
• Data types (Windows, Syslog)
• Review process
• Live monitoring
• Correlation logic
5. Build a Security Toolkit
• Recommended Security Solutions
• Antivirus
• IP tables
• Intrusion Detection System
• Malware Detection
• Web Application Firewalls
• Anomaly behavior via netflow
• Future Deep Packet Forensics
6. Stay Informed of the Latest Vulnerabilities
• Websites to follow
• alertlogic.com/weekly-threat-report/
• securityfocus.com
• exploit-db.com
• seclists.org/fulldisclosure/
• securitybloggersnetwork.com/
7. Understand Your Cloud Service Providers Security Model
• Review of Service Provider Responsibilities
• Questions to use when evaluating cloud service providers
Alert Logic Cloud Defender: Cloud Security Suite
Lower Total Cost
Continuous Protection
Deep Security Insight
ALERT LOGIC
CLOUD
DEFENDER
How Cloud Defender Works
Continuous
protection
from
threats and
exposures
Big Data
Analytics
Platform
Threat
Intelligence
& Security
Content
Alert Logic
ActiveAnalytics
Alert Logic
ActiveIntelligence
Alert Logic
ActiveWatch
24 x 7
Monitoring
&
Escalation
Data
Collection
Customer IT
Environment Cloud, Hybrid
On-Premises
Web Application
Events
Network Events &
Vulnerability
Scanning
Log Data Alert Logic Web Security Manager
Alert Logic Threat Manager
Alert Logic Log Manager
Alert Logic
ActiveAnalytics Alert Logic
ActiveIntelligence
Alert Logic
ActiveWatch
Threat Research
Customer
ACTIVEWATCH
INCIDENTS
Honey Pot Network
Flow based Forensic Analysis
Malware Forensic Sandboxing
Intelligence Harvesting Grid
Alert Logic Threat Manager Data
Alert Logic Log Manager Data
Alert Logic Web Security Manager Data
Alert Logic ScanWatch Data
Asset Model Data
Customer Business Data
Security Content
Applied Analytics
Threat Intelligence
Research
INPUTS
Data Sources
Threat Research – Honeypots
Honeypot Research Benefits
Collect new and
emerging malware
Identify the
source of the
attacks
Determine
attack vectors
Build a profile of
the target
industry
Native Cloud Security
Certified on all major cloud platforms
Consistent security and compliance
• Same solution across all
clouds
• Single pane of glass
• Security content designed
to protect cloud applications
Built for the Cloud
• Automated deployment
• Scales with your cloud
infrastructure
• Usage based billing
Questions and Resources
Resources
All available under the
“Attachments” tab of the webinar:
• Vulnerability Response Best
Practices Whitepaper
• Weekly Threat Newsletter
• Weekly update of breaches and
vulnerabilities
• Alert Logic Blog
• Zero Day Magazine
• New Magazine with the latest on
IT Security trends
Questions
• Questions? Submit them to the
presenter at anytime into the
question box
Get Connected
www.alertlogic.com
James Brown, Director of
Cloud Computing & Security
Architecture, Alert Logic
@OtherJamesBrown
@alertlogic
linkedin.com/company/alert-logic
alertlogic.com/resources/blog/
youtube.com/user/AlertLogicTV
brighttalk.com/channel/11587