Tag Archives: CSA

Cloud 2

A plethora of security articles has appeared in the mainstream IT press over the last few weeks that makes me believe that security is one of the new buzzwords that you can expect to hear a lot more about in 2016. As a security practitioner and someone who has done this for well over fifteen years it's bizarre how something that we do as business as usual is now getting some attention. For over a decade we were the people you didn't talk to, or if you did you did it through gritted teeth knowing we would try to hold you to a better standard or a greater ideal for the common good.

Any and all focus on security best practice is welcome. As we all witness the explosive growth of container based cloud provisioning gather pace it's circumspect to hope that this due diligence around security will filter down through programs in organisations to build in security as a de-facto standard building block and process rather than retro fitted to shore up poor code or poor deployment / management practices.

That's not to say by having the best security folk and best practices you can't get hacked from internal or external threat or fall prey to a security vulnerability. What it does mean is that you have the plan as to how to react, how to behave during an outage, what steps to take during a fix process and how you learn from that experience, growing from it. Sharing that knowledge is even more important in the Open Source space.

Please though don't fall into a trap. Having a CISSP does not make you a security professional. Having a CISSP on board your staff says you have someone who can pass an exam and who has an understanding of how a proprietary network environment and elevated threat levels and reaction capabilities to someone hosing your Cisco / Juniper / (add other vendor kit here) will have on your ability to provide service.

Any qualification that allows it's students to keep qualified by collecting points attending conferences is devalued by stupid brand marketing folk who allow such a practice. I've met some great people who also had CISSPs and I've also met some self styled pen testers, auditors and "security professionals" with CISSPs and other exam qualifications who communally couldn't find their arse with both hands. Those same people also knew how to pass exams but who had never had actual realtime experience in the trenches with developers and operational datacentre folk to get up to speed with emerging threat.

Certification is important. Want to hire good folk or get your CISSP folk up to speed with real life threat from bleeding edge threat actors that impact actual platforms now ? Get them to sign up and study for the CCSK exam. Amazon get their staff to, so do Microsoft and HP and I personally rate the material and the exam and it will allow you to get your staff to be at a point where you have a proper belts and braces ability to deal with threat and react realtime rather than a post mortem. No this isn't an advert for the Cloud Security Alliance or a trolling attack on CISSPs it's a call to arms to employers to look outside the box because sadly the hackers are better qualified than ever before,

So while you're eating your Thanksgiving meal or preparing for a quiet Christmas think about how you can increase your security skills and also maybe think about joining an Open Source project to see how security issues and vulnerabilities are managed in the wild.

Happy Thanksgiving 2015 and have a great time with your families.

This evening I've been working my way through changes and modifications on the beta of version 3.1 of the Cloud Security Alliance CCM controls. Version 3.0 is the current shipping version of this living breathing bible of cloud security goodness. Recently I was in Amsterdam with Jim Reavis and his crew at the CSA Securecloud Conference, and I'll be out in the US at the annual CSA Congress in the fall. Whilst there I recorded a podcast with Jim that I will bring out midweek this week.

Regularly I talk at conferences expressing why the CSA CCM matrixes are one of the most powerful Swiss Army tools an IT practitioner can have when approaching a governance exercise in any facet of private, public or open hybrid cloud. Crossing business verticals allowing an organisation to be able to consider pressures of location and data type, workload or platform. This then allows you to make weighted decisions around application migration, infrastructure deployment and the isolation of services or provisioned platform services.

As the audit community continue to hone and document how they are are assessing technical and actual risk in on premise cloud, a contracted out public cloud or hybrid elastic combination of the two.

As 3.1 emerges and becomes the new defacto standard I will bring more information as to how best to adopt it, for now please point your browsers at the current shipping version of the matrix which you will find here.

2 Comments

For those of you who've known me or my work for the last decade or more you'll appreciate that one of my main call to arms is security and in particular enforcement of security enforcing technologies at the gateway and application level, my little hobby (developing publishing and supporting a firewall technology which with variants based on the code) reached millions of homes, offices and enterprises across the globe and allowed me to make a career out of security.

So it's often a question I get asked at conferences and when speaking about security in Cloud and security enforcement and responsibility in the Cloud and virtualisation arena. Fortunately at Red Hat we take security incredibly seriously and have contributed technologies such as SELinux and sVirt into our architectures and supported versions of our releases, as well as employing the mainstays in the SELinux world on our payroll to ensure that we have continuity and those folk are rewarded for their efforts.

However, to put it bluntly most architects and network  guys turn SELinux off when building out platforms and virtualised instances which is quite short sighted. When I do pose the question why a lot of responses are aligned to the fact that SELinux can sometimes due to configuration issues and past experiences where stuff broke and was hard to diagnose so easier to just turn off.

Let's be blunt, it's there to help you, it's a free secure template based technology so turning it off if you haven't got a full toolkit of other security hardening in your build schema or your platform is at best shortsighted. Did I say it was free ? In this current credit crunch culture can you justify not looking at using it ?

If you're concerned or you struggle then enable it in permissive mode in the first instance making sure you make relevant mods to /etc/sysconfig/selinux to make it persistent on reboot. Simple boolean logic is the best way (and easiest way) to start experimenting with the functionality you want to add. Then if you want to know more then search for the audit2allow function and remember if you're concerned with restrictive AVC denials breaking stuff then a quick search through auditd in /var/log/audit/audit.log then aureport is your friend. There are loads of howto's available or if you're thinking about large scale SELinux use in anger Red Hat even have a course to upgrade your RHCE to give you a complete comfort blanket in your own capabilities. It's part of the assurance and certification mode we bring to the whole Linux piece. Belt and braces if you will.

Now this article really isn't a security masterclass or SELinux howto, I'm actually more interested in getting to grips with culture change and trying to pass on my thoughts of how we need to get traction in influencing how protecting your assets, your data and your reputation in Cloud can take shape.

Over the last three years I've been using what I would describe as an almost military approach to building out legacy platforms be they physical or virtual. In days of old people might remember Jay Beale and his Bastille Linux hardening script, which was a great starting point when building simple Linux stacks. I remember vividly when he posted it to newsgroups and Slashdot picked up on it. It represented for the first time really in the Linux Open Source community someone who took a simple exercise but made it mainstream towards security as a standard rather than a retrofit. It enabled many of us to not only run it but get under the hood to find out "how" it worked. What is it they say "a little bit of knowledge is a dangerous thing ?".

So as we move into provisioning our Cloud environments across one or multiple hypervisor types, or moving applications into hybrid or public Cloud having that "accreditation" process or controls breakdown is invaluable. Mine runs over about 5 tabs of a spreadsheet and would make most auditor feel out of a job. However maybe my way of having a moving spreadsheet of controls that I've built up over time for all the certifications / governances that I've had to deploy to (including in NATO battlefield accredited above classified environments) probably is going a bit far for standard run of the mill server environments.

So its fortunate that my friends and fellow members of the Cloud Security Alliance started many moons ago to put together an authoritative set of controls to allow you to get to work now building out your platforms or engaging with a Cloud provider regardless of the tenacity or the aggressive nature of your certification or audit model. The controls are designed to get you out the blocks building Cloud platformst that need to meet the regulations around ISO 27001/27002, ISACA COBIT, PCI, NIST, Jericho Forum and NERC CIP. Let's not mention SAS 70. I still, do not, and believe me I've tried, understand why an accounting standard has ANY place in Cloud service provision. CCM will help you there and you can also take a look at the CSA STAR programme while you're there.

I've mentioned the Cloud Security Alliance before here numerous times (lets call them the CSA from now on). The CSA are one of the most critical building blocks of the Cloud community and Jim Reavis and the steering members of the CSA have made the education and communication of security best practices to the community their ethos and commitment since they were founded. Red Hat support the CSA and if you've heard me talk you'll hear me mention them proudly on a regular basis. I am continually mentioning them.

Shortly I am recording an often re-arranged podcast with Jim Reavis of the CSA and we'll get that out to to you as fast as I can mix it in the coming days and weeks.

Whether you're playing with Cloud in your dev/test sandpit or migrating to a hybrid  cloud understanding what part reputation protection of your app dev environment and your underlying transportation of data is critical. Reputations are lost in minutes as are share prices when a company is seen as damaged by data loss. Simple breaches of major household name organisations are often met with lax fines and investigation by sovereign territory governments and information commissioners, however the risk factors involved are enormous. At the back end of the application architecture - in the trenches - are the technical guys who have to turn the dreams and aspirations of sales people and marketing types into the portals and customer facing Cloud hosted environments that will generate the revenue. If we arm you to do your job better and to do it in a way that allows generic controlled growth of your platforms and your Cloud aspirations then thats a good thing right ?

Do visit the CCM matrixes today and learn how they help you go to work in ways that will make your auditor despair. It's kinda cool actually because auditing Cloud and typically follow the sun type datacentre clouds has always been a dark art. By following this article and my advice you can actually have a retort to this argument. Cut a huge percentage out your auditors workload (and their resulting invoice) by owning the moral upper ground and in the process maybe think about turning SELinux back on. Blended use of SELinux, sVirt, supported certifed Red Hat subscriptions and technology such as CloudForms gives you everything you need from an IaaS perspective today to go to work. If PaaS security is your thing then listen out soon to another podcast I'm going to record with Tim Kramer of the OpenShift team (in fact if you haven't already read it go visit Tim's great security post here).

Also I'm promised a security podcast with Mark Cox at some point in the coming month so if security is your thing you're going to be kept busy listening to me warble down your earbuds about everything related to CloudSec. If you think that more people could benefit from a primer in Cloud security deployment and the need to think out the box then share this article - I appreciate every Twitter mention I get if it helps educate another Linux user as to how to do things better.

Then get to the CSA website and join. It costs nothing and you'll learn a lot if you are an active participant. Tell them I sent you.

Last week while I was on vacation, before I got waylaid in preparing for todays Cloud Computing World Forum in London and next weeks Open.CH Cloud event in Switzerland I promised my snapshot on Gartner's release a fortnight ago now on EMEA Cloud activity being a pale comparison of the US's activity.You can read it here, in fact reading it before digesting this article might be a great start.

So before we start let's be very clear, I'm not remotely out to bash Gartner, they have a well earnt position in the pantheon of analysts and are a valued member of the technical analyst community working hard to help a lot of customers across verticals globally make comprehensive strategies. The report itself lists four specific inhibitors for adjudging that Cloud growth in the EU region as a whole will fall behind the North American marketplace.

Inhibitor 1. Diverse (and Changing) Data Privacy Regulations

Gartner make a good job of outlining the concerns many companies have over data regulation and privacy.They do so without actually going into any concise clarified detail but do at least admit that a lot of the privacy issues are communicated and understood badly by organisations, which is a positive. Certainly the Cloud community as a whole has a duty of care to ensure that we make it easier for companies and institutions to understand that issues such as ENISA and EU guidelines at the provider level and your enshrined responsibilities as a data processor are actually quite simple to quantify. That issues such as the Patriot Act and Safe Harbor that apparently scare many companies off hosting in North America are not actually as realistic as painted. It's an unwritten rule that even in the EU the liason between intelligence services is acknowledged as making local EU sovereign data privacy controls and the Patriot Act immaterial therefore nullifying the concerns in the first instance. If you read the authoritative report by Hogan Lovells on behalf of the OpenForum Academy published last month you'd understand even more that it should be the Cloud community and providers working harder to communicate this as a non risk to customers regardless of geographical location, that actually if you architecture your public key encryption properly it actually disappears as a risk.

Inhibitor 2. Complex B2B Multienterprise Integration and Processes

In the EU we have a better understanding than most other global territories around working across boundaries. It's a fact many of the boundaries between organisations in multiple EU territories where data transmission storage and processing occur daily have evolved their own processes based around international standards such as COBIT, ITIL, ISO, BASEL as mandatory controls in business nullifying actual risks to growth. So this inhibitor seems to be badly defined and badly understood as a doorstop to Cloud. EU businesses as a whole adopting Cloud are better positioned than many organisations outside Europe given that we have had corporate governance in place that dwarfs SOX, SAS 70 and less capable non EU derived process controls.

Inhibitor 3. The Slowness and Undesired Effects of Some EU Policies

Gartner do a good job of outlining where they think sovereign mandated process and policy can potentially act as a roadblock to inertia in Cloud. In four years of Cloud specific activity up to and including EU government ENISA guided Cloud architecture I'm yet to identify one actual identifiable deployment slowed down by this "inhibitor". Gartner then give an example of the European Multi Stakeholder Forums e-invoicing guidelines published in March which are at best a steering piece designed to help and assist organisations rather than slow them down, although it has taken almost five years to get to it's findings it's still comforting to know that it exists.

Inhibitor 4. The Investment Hold Caused by the Euro Crisis

I can't argue with this point, there is a critical crisis of confidence in the euro and the financial markets, this is a technical blog not a financial one. You'd have to have had your head in the sand to have not noticed the major slowdown in IT spend across all areas of technology not just Cloud. It's an added benefit to the marketplace that Red Hat is positioned to actually allow customers in that position to actually achieve a lot more with a huge amount less and the Open nature of Red Hat cloud technologies and our continued work with emerging technologies to prosper growth during a time of economic and financial instability. In fact Red Hat is growing continually even during a downturn as our customers enjoy so much more capability based on our subscription and Cloud access model for their workloads. This then increases when they see how CloudForms and OpenShift start reducing workload costs and reduce complex associated ownership and process costs.

I'm very surprised that nobody from Gartner read the synopsis of the Cloud Security Alliance's 2011 study into EU Cloud growth and factors which gave more clarified detail and credible guidance to the very readers that digest Gartner articles as verbatim. I've uploaded my copy of their slides here as it returns a more authoritative piece to you towards doing your own clarified research.

So my message here is one of balance. Read the Gartner article, it's a balanced and authoritative viewpoint from a global leader. Once you're done then go read the links below:

PC World Report on Data Concerns over Patriot Act
Business Software Alliance report on Cloud in Europe
(downloadable pdf)
Jipitec EU Cloud Computing Synopsis

My last words on this article from Gartner is that they missed a trick by forgetting that the same people who read their reports are the same architects and technically capable thought leaders who use open architectures and enjoy more competitive and open economies of scale from using Open Cloud.

If you use an Open Cloud, if you think about your architecture planning and build that portability and security of process and control into your Cloud using tools such as CloudForms then I reckon 80% of the actual inhibitors outlined in the Gartner report become actual reasons to go Open and to speed up Cloud adoption.