IaaS Security Challenges: New Draft Guidance from NIST

The National Institute of Standards and Technology has come out with a publication explaining selected security challenges involving Infrastructure as a Service (IaaS) cloud computing technologies and geolocation. The publication titled “TRUSTED GEOLOCATION IN THE CLOUD: PROOF OF CONCEPT IMPLEMENTATION (DRAFT) (NIST Interagency Report 7904 or simply IR 7904) describes a proof of concept implementation that was designed to address those challenges. The publication is intended to be a blueprint or template that can be used by the general security community to validate and implement the described proof of concept implementation. IR 7904 provides sufficient details about the proof of concept implementation so that organizations can reproduce it if desired.
From the publication, here’s how NIST explains the problems the draft guidance addresses:

    Shared cloud computing technologies are designed to be very agile and flexible, transparently using whatever resources are available to process workloads for their customers. But there are security and privacy concerns with allowing unrestricted workload migration.

    Whenever multiple workloads are present on a single cloud server, there is a need to segregate those workloads from each other so that they do not interfere with each other, gain access to each other’s sensitive data, or otherwise compromise the security or privacy of the workloads. Imagine two rival companies with workloads on the same server; each company would want to ensure that the server can be trusted to protect their information from the other company.

    Another concern with shared cloud computing is that workloads could move from cloud servers located in one country to servers located in another country. Each country has its own laws for data security, privacy and other aspects of information technology. Because the requirements of these laws may conflict with an organization’s policies or mandates – for instance, laws, regulations – an organization may decide that it needs to restrict which cloud servers it uses based on their location.

    A common desire is to only use cloud servers physically located within the same country as the organization. Determining the approximate physical location of an object, such as a cloud computing server, is known as geolocation. Geolocation can be accomplished in many ways, with varying degrees of accuracy, but traditional geolocation methods are not secured and they are enforced through management and operational controls that cannot be automated and scaled, and therefore traditional geolocation methods cannot be trusted to meet cloud security needs.

    The motivation behind this use case is to improve the security of cloud computing and accelerate the adoption of cloud computing technologies by establishing an automated hardware root of trust method for enforcing and monitoring geolocation restrictions for cloud servers. A hardware root of trust is an inherently trusted combination of hardware and firmware that maintains the integrity of the geolocation information and the platform. The hardware root of trust is seeded by the organization, with the host’s unique identifier and platform metadata stored in tamperproof hardware. This information is accessed using secure protocols to assert the integrity of the platform and confirm the location of the host.

    NIST requests comments on Draft IR 7904 by Jan. 31. Comments should be sent to ir7904-comments@nist.gov, with “IR 7904 comments” in the subject line.

Advertisements

Mobile Security: Malware Threats

Secure your Mobile !


Mobile devices, of late, gaining popularity with the acceptance of BYOD (Bring your Own Device) policy across the Corporates. Many large organizations are realizing that it’s easier to develop and deploy their own secure apps for employees with off-the-shelf solutions. Barclays bank, one of the world’s largest bank, hits the News this week by giving 8,500 of its employees an early Christmas present: iPads !  According to Baxter-Reynolds, Barclays’ total cost of ownership for 8,500 iPads works out to approximately £13.8 million, or $2,600 USD per unit.

What about Information Security?

While Barclays is focusing on a bigger business gain and employee confidence, security, of course, is a major concern. “With the lockdown offered on iOS devices — including encrypted content — iPads have all the things that reassure the ‘necessarily-paranoid’ in any bank’s IT department,” wrote Charles Arthur in the Guardian UK, commenting on Barclays’ decision to go with iPads.

barclays logo Zack Whittaker at ZDNet agrees, saying Barclays confidence in IPad safeguards sets a trend for other companies, particularly banks. “The huge iPad deployment shows a significant level of trust in the Apple platform — that it’s secure enough for banking,” Whittaker wrote in his analysis. “Finance, after all, is only one-notch below national security in the grand scheme of data protection priorities.”

Mobile Security in General

Yes, Barclays invested huge amounts on the devices, training and security mobile logomanagement of mobile technology. Waht about other companies- big and small – adopting rapidly the policy of BYOD yet not fully geared to understand and prepare to the face the risk? FBI & Internet Crime Complaint Center (IC3are warning the smart phone users of malware targeting mobile devices. Malware seems to be the worst threat to the mobility considering the low levels of mobile security awareness equally among the management & users.

Some tips to secure your mobile 

  • When purchasing a Smart phone, know the features of the device, including the default settings. Turn off features of the device not needed to minimize the attack surface of the device.
  • Depending on the type of phone, the operating system may have encryption available. This can be used to protect the user’s personal data in the case of loss or theft.
  • With the growth of the application market for mobile devices, users should look at the reviews of the developer/company who published the application.
  • Review and understand the permissions you are giving when you download applications.
  • Passcode protect your mobile device. This is the first layer of physical security to protect the contents of the device. In conjunction with the passcode, enable the screen lock feature after a few minutes of inactivity.
  • Obtain malware protection for your mobile device. Look for applications that specialize in antivirus or file integrity that helps protect your device from rogue applications and malware.
  • Be aware of applications that enable Geo-location. The application will track the user’s location anywhere. This application can be used for marketing, but can be used by malicious actors raising concerns of assisting a possible stalker and/or burglaries.
  • Jailbreak or rooting is used to remove certain restrictions imposed by the device manufacturer or cell phone carrier. This allows the user nearly unregulated control over what programs can be installed and how the device can be used. However, this procedure often involves exploiting significant security vulnerabilities and increases the attack surface of the device. Anytime a user, application or service runs in “unrestricted” or “system” level within an operation system, it allows any compromise to take full control of the device.
  • Do not allow your device to connect to unknown wireless networks. These networks could be rogue access points that capture information passed between your device and a legitimate server.
  • If you decide to sell your device or trade it in, make sure you wipe the device (reset it to factory default) to avoid leaving personal data on the device.
  • Smartphones require updates to run applications and firmware. If users neglect this it increases the risk of having their device hacked or compromised.
  • Avoid clicking on or otherwise downloading software or links from unknown sources.
  • Use the same precautions on your mobile phone as you would on your computer when using the Internet.

 

Information Security Trends: Cloud, Mobility & Social Tools add complexity

 Cloud and Mobility Complicate Security

Cloud computing, mobility, social tools and other technologies that put mor e power in the hands of individual users pose new challenges for organizations seeking to secure data, devices and networks, new research released today by CompTIA, the non-profit association for the information technology (IT) industry, reveals.
This was the big take-home from the latest Information Security Trends study by Computing Technology Industry Association (CompTIA). Among the 308 security breaches reported by participants in the 10th annual study, 54% were caused by human error. Nearly half those errors (49%) were attributed to end-user failure to follow policy and procedure. The study is based on a survey of 508 IT and business and IT executives directly involved in setting or executing information security policies and processes for their organizations; and 368 executives at U.S. IT firms, with most having some level of involvement in the IT channel.

“As users gain more responsibility for their own technology, the human element becomes more and more important,” said Seth Robinson, director, technology analysis, CompTIA.

“There’s a growing need that we see to educate the end users and bring them up to speed with security awareness, and [increase] their knowledge of what an attack might look like,” said study author Seth Robinson. “Educating the end user really should be a bigger priority.”

cloud The message doesn’t seem to be getting through to the people in charge of enterprise security. About 60 % of survey respondents cited malware, such as viruses and Trojans, as a “serious concern.” Other types of security threats from the outside, namely hacking (54%), also outranked human error as major threats. Indeed, only 24% of respondents viewed end-user error as a “serious concern.” The respondents’ focus on external threats does not surprise Robinson. “It’s what they’ve been concerned about for years, and it informs how they’ve built and continue to build security defenses.”

Robinson attributes the  disconnect between resource allocation and rising internal threats to both stagnant budgets and an outdated understanding of what constitutes adequate end-user training. A basic run-through of security policies at the time of hire with a yearly refresher isn’t enough, he said. Today, the advice from top information security experts calls for training that is frequent and interactive. For example, Robinson said a simulated phishing attack among the workforce can be a useful training tool. IT can track the number of employees who click the link, and give those employees additional information security training to recognize that type of threat.

A net 49 percent of companies say they intend to hire security specialists, including those that also plan on training current staff.  Executives have a strong preference for security professionals with industry certifications. A full 84 percent said they experienced a positive return on investment in security certifications,

cloudwith certified staff viewed as more valuable because of their proven expertise and ability to perform at a high level than non-certified staff. Putting employee security training in the hands of a security specialist — and off the to-do list of CIOs — is something experts

strongly advocate. Decisions about device and platform management and application access should be made by infrastructure and operations (I&O) teams. However, security experts should be the ones figuring out what threats their organizations face from different end-user access scenarios.