Network Security: The Basics

New to network security? Before you get lost in the bits and bytes, this guideline provides a look at the essential concepts.

There are exactly two keys to information security or information assurance: first, configure the system and network correctly and keep it that way. Because this is impossible to do perfectly, the second key to information assurance is to know the traffic coming into and out of your network.[1] That way, if something terrible is happening you can detect it. Therefore, all the tasks that have to be done in network security break down into three phases or classes:

• Protection, where we configure our systems and networks as correctly as possible
• Detection, where we identify the configuration has changed or that some network traffic indicates a problem
• Reaction, after identifying quickly, we respond to any problem and return to a safe state as rapidly as possible

Defense in Depth
Because we cannot achieve perfect security we have to accept a certain level of risk. Risk is defined as the probability a threat will cross vulnerability. Risk is hard to calculate, but we get a rough idea by considering our attack surface, the exposure, and the reachable and exploitable vulnerabilities that we have. A vulnerability scanner or penetration test helps us measure or define our attack surface. One thing we do to lower our risk and improve our odds of survival is to use multiple defenses. There are five basic architectures to develop defense in depth.[2]

• The uniform method of protection for defense-in-depth generally involves a firewall separating the internal trusted zone from the Internet, most implementations have anti-virus in the mail store and forward on the servers and desktops. It generally means that all internal hosts receive the same level of protection from attack by the computer network infrastructure. It is the most commonly and easily implemented architecture and least effective in terms of achieving a high degree of information assurance unless all IT contained information assets are of equal importance to the organization.
• Protected enclaves simply means subdividing the internal network so that it is not one large zone without internal protections. This can be done with firewalls, VPNs, VLANS and Network Access Control.
• Information Centric. Adm. Grace Hopper, a famous early researcher in computing said, "Some day, on the corporate balance sheet, there will be an entry which reads, 'Information'; for in most cases, the information is more valuable than the hardware which processes it."[3] it is critical to understand and to be able to help others understand the value of information. In addition to richly valuable information such as intellectual property (patents, trademarks, copyrights, know how, data schema), there is also data including the increasingly important business record. To build an information centric defense-in-depth architecture, we must locate our critical and valuable information and ensure the proper protections are in place. This used to be very costly and was avoided, but due to changes in the Federal Rules of Discovery, many organizations have to build process to locate all information and tag it, so this becomes much easier.
• Threat Vector Analysis defense-in-depth is similar to information centric; it requires us to identify the assets we want to protect in order of priority, perform an analysis to determine the paths the threat could use to reach the vulnerability and figure out how to place controls on the vectors to prevent the threat from crossing the vulnerability.
• Role-based access control (RBAC) is an access control method that organizations implement to ensure that access to data is performed by authorized users. Unlike other access control methods, role-based access control assigns users to specific roles, and permissions are granted to each role based on the user's job requirements. Users can be assigned any number of roles in order to conduct day-to-day tasks. For example, a user may need to have a developer role, as well as an analyst role. Each role would define the permissions that are needed to access different objects.[4] With Network Access Control we can extend this from groups on systems to the entire enterprise. It requires more configuration than protected enclaves, but it yields more protection.
• CryptographyWhen defense in depth fails, the only remaining protection for the data is cryptography. Cryptography is very strong: if your organization is using a modern algorithm, the encrypted information is so powerfully protected, the encrypted data cannot be attacked. However, the processes we use to manage the crypto keys can be attacked, so strong processes related to key management are a must. As an example, many organizations have purchased full disk encryption for their laptops. There is no way to reverse that encryption without the key. However researchers at Princeton recently demonstrated ways to capture the key from memory defeating the protection with many vendor s products.[5] There are three types of cryptography algorithms: secret key, public key, and hash functions. Unlike secret key and public key algorithms, hash functions, also called message digests or one-way encryption, have no key. Instead, a fixed-length hash value is computed based on the plaintext that makes it impossible for either the contents or length of the plaintext to be recovered. The primary application of hash functions in cryptography is message integrity. The hash value provides a digital fingerprint of a message's contents, which ensures that the message has not been altered by an intruder, virus, or by other means. Hash algorithms are effective because of the extremely low probability that two different plaintext messages will yield the same hash value.[6]
  Access, Authentication, Authorization
  Sometimes called Triple A or AAA, these are the keys to implementing security in the organization. Access process should ensure the correct person is accessing your organization s computing and networking resources. Since passwords can be shared, many organizations use a physical token in addition to a password during the authentication process. Once authenticated, controls should be in place to make sure individuals only access the resources they are authorized to access.
  Separation of Duties, Separation of Services
  Separation of duties is a common policy when people are handling money so that fraud requires collusion of two or more parties. This greatly reduces the likelihood of crime. Information should be handled in the same way since it can be bought and sold easily. If your system administrators claim that their duties cannot be broken up, it is important to understand well run organizations do just that.[7] A long time ago, servers were so expensive that a single server would run multiple services. One of the lessons we learned from the first worm (malicious software that spreads by breaking into systems) was that if a server crashed with multiple services running on it we would lose the ability to supply all of those services. For the next ten years, it was considered good practice to have one service per machine; a mail server, a file server, and so forth. Today, with virtual machines and service oriented web architecture, we are moving back to multiple services, in fact far more services than before. This is fine as long as we factor in how to keep operating if something bad happens to that machine. There are fields of study called continuity of operations, disaster recovery and business impact that provide insight into these fields of study.
  Endpoint Security and Ubiquitous Computing
  Wireless networking continues to grow, entire cities are connected with metropolitan wireless, if you have a PDA or advanced cell phone you are connected to the Internet at all times. These devices can communicate with your desktop or laptop computer via Bluetooth. Organizations are going to have to engineer security at the device itself, this is called endpoint security. It is no longer possible to believe in a security model where you are fairly safe because we are connected to a corporate LAN protected by a firewall and an intrusion prevention solution. Rather, we need to consider security in a ubiquitous computing paradigm, always on the Internet wherever we are.
  Web, Web Browsers and AJAX
  Odds are very high that your organization is spending a lot more money on webmasters, web programmers and the like than you were just five years ago. Most software application development is becoming focused on the web for delivery. This means that most of the information entering and leaving the majority of user computers is via the web. However, web browsers such as Internet Explorer were not purposely designed as security gateways. It is possible to attack a user s computer via their browser. Until security becomes the most important priority for web browsing software, problems will continue to exist. This is going to be especially true with the new web 2.0 interfaces that use recently developed extensions to a programming language web browsers support called AJAX to deliver enhanced functionality, but at the cost of increased risk.
  SOA and the Future
  Web based programs are very complex to create and maintain because they potentially offer so much functionality. For instance, if you have an online stock trading account, you can research, trade, run financial reports and even do online banking. To manage complexity and make it possible to get product to market faster, organizations are learning to simply create atomic services. This is known as Service Oriented Architecture (SOA) and may one day be the primary tool to support mission critical applications. If your organization needs a service, it consults a directory called UDDI to find it. This is similar to using a search engine like Google, but programs do this without human intervention, at least that is the idea.
  SOA offers and exposes more business logic than a regular web server, after all each and every service you offer has to be in the directory if you want client programs to find you. A big part of the security battleground of the future will be centered around SOA, limiting the unauthorized release of sensitive information and creating gateways and other tools to protect the services.
  
  
   

Log management basics

View log management systems as a source of business intelligence—and choose one that fits your business needs.

System logs generated by servers and other various network apparatus can create data is in vast quantities, and sooner or later, attempts at managing such information in an off-the-cuff fashion is no longer viable.
Consequently, information systems managers are tasked with devising strategies for taming these volumes of log data to remain compliant with company IT policy, and also to gain holistic visibility across all IT systems deployed throughout the organization. With a tad of guidance and a bit of planning, the recipe for log management is actually straightforward, and the rewards are surprisingly favorable.

What is log management?

First and foremost, a definition of log management is in order. The National Institute for Standards and Technology (NIST) defines log management in Special Publication SP800-92 as: "the process for generating, transmitting, storing, analyzing, and disposing of computer security log data." As you probably knew that much already, what does log management really entail? Put simply, log management is defining what you need to log, how to log it, and how long to retain the information. This ultimately translates into requirements for hardware, software, and of course, policies.
Benefits of log management systems are abundant, and their return on investment is significant. To quantify the value of an investment in this area, it helps to view log management systems as business intelligence systems. Our business is of course information security, but many of the same features and benefits found in traditional BI systems are also present in log management systems. From data extraction, transforming, and loading (ETL) to even back-end enterprise data warehouses, all of the standard BI moving parts are also found in many log management systems.

Also see 'Evaluation criteria for SIEM systems'
View log management systems as a source of business intelligence—and choose one that fits your business needs.The log management system may be a highly specialized business intelligence system in disguise, yet like its business-focused cousin, it brings game-changing benefits to the table. For example, day-to-day transactional data can finally be viewed across the organization as a whole rather than in discrete and disjointed silos. This ability to watch all systems simultaneously is a bit like being everywhere at once. As godly as it may sound, the reality is that this new set of virtual eyes increases your effectiveness without increasing your headcount. Amplified visibility into enterprise-wide events also equates to an increased awareness of real-time activity, which ultimately improves overall security posture by empowering staff to react quickly to malicious events.
Security professionals have long understood the benefits log management systems provide through the centralized storage of logs. Given that it's practically standard operating procedure for hackers to obfuscate their method of intrusion by destroying logs and disabling accounting mechanisms, having a protected and centralized copy of such data ensures that valuable information is preserved for post-mortem analysis, and that evidence is available for any follow-up legal action.

Interestingly, not all benefits of log management systems are security-centric. For instance, many network devices such as routers or firewalls have limited electronic buffers reserved for logging. Once those buffers reach capacity, older entries are discarded to accommodate more recent events. Devices hosted on busy circuits are sure to have high log volume, and discarding the majority of events simply isn't feasible for engineers tasked with troubleshooting operational issues. By forwarding logs to centralized systems that are packed with high-capacity disk drives, operations staff can access event data within time spans that yield adequate context to the issue at hand. Non-volatile storage of log data also opens the door to better infrastructure sizing projections through trend analysis. This allows managers to accurately gauge future growth patterns and perhaps justify budget requests.
For organizations required to comply with legal or regulatory reporting obligations such as those common in the Sarbanes Oxley or HIPAA Acts, properly implemented log management systems can advance the overall efficiency of compliance activities considerably. While many commercial log management solutions flagrantly tout compliance as a major selling point, the degree of variance in real-world auditing requirements and scope is vast, and particular audit controls are often company-specific. (See Jennifer Bayuk's 'Information system audit basics'.) Therefore, any notion of "compliance in a box" should be quickly disregarded as marketing hype.
However, assuming company-specific control audits may be properly massaged into the log management system, reports commonly requested by auditors can be canned into templates that are generated ad-hoc, perhaps even at the auditor's discretion through self-help facilities. Of course, the integrity of a specific log management system must be blessed by your official assessor, so obtaining prior auditor review should be an integral step in the log management system purchase criteria.

Choosing the right log management system

Before making any purchases, it's important to remember that not all log management systems are created equal. Regardless of whether you examine a specific product or a particular service hosted in the cloud, the variation in log management functionality can typically be simplified by ascertaining which category the system falls into. Fortunately, there are only two basic classes of log management system:

• the basic centralized log collector
• security information and event management or "SIEM"-style system.

Centralized logging servers are just that: no-frills systems designed to simply collect and consolidate logs from numerous sources for later consumption. Venerable contenders in this space are typically of the UNIX variety, and often sport open-source packages such as syslogd or Syslog-ng. Even modest hardware configurations coupled with open source software can handle considerable amounts of log data. However, do keep in mind that raw consolidation power is only part of the equation. Centralized logging servers lend themselves well to complex, hierarchical logging systems in which each component of the system must do one thing very well.
Conversely, if you need a system that can actually analyze data in order to extract meaningful information, then you are instead in the market for a SIEM.
SIEMs take event consolidation to the next level by providing not only event collection, but also aggregation, correlation, alerting, and reporting services. Event aggregation allows users to quickly ascertain how many events occurred without having to painstakingly count each and every event in detail. Correlation is essentially multidimensional analysis that pivots two or more categories of events against each other in order to yield high level information.
A typical example of SIEM correlation would be to automatically connect a series of brute-force login attempts to a sudden spike in network traffic from the host in question. This provides credibility, often in the form of a numeric "weight," to the assumption that one of those brute login attempts actually succeeded. Correlation provides tremendous value to humans staring at otherwise isolated events, and is particularly useful for identifying ominous activity occurring across numerous systems. Finally, alerting allows administrators to configure triggers which notify staff of anomalous or potentially threatening activity, and reporting ties everything together by summarizing events, trends, and incidents in various formats.

Also see 'Network security: The basics' by Stephen Northcutt

While open source SIEMS such as "OSSIM" are starting to make their debut in business environments, their gallant strides toward enterprise adoption are often met with stiff resistance in a market space otherwise dominated by mature, commercial offerings from companies such as Q1 Labs, RSA, and ArcSight. The overall landscape of the SIEM industry is well covered by analyst firms such as Gartner and Forrester, and there are plenty of freely available product reviews to peruse at one's leisure.
Upon examining the available offerings, it should become apparent that most SIEM solutions have a common baseline set of functionality, and follow a relatively standardized pattern of collecting and consolidating logs, transforming the logs into an internal (and almost always proprietary) format, then providing alerting and reporting services on top of this normalized information. Despite the fact that most SIEM offerings share a common set of functions, there are in fact differentiating features as well as strengths and weakness among the competitors. As form should follow function, having a thorough understanding of your organizational requirements will ensure you choose the right log management system.
Before shopping for a log management system, some basic planning on your part is in order. It is imperative to first survey the type of logs your infrastructure generates, and then determine what type of information you plan on gleaning from these event generating systems. This sounds deceptively simple, yet often times turns out to be quite challenging given the fact that even small organizations can easily generate over a dozen different logging formats such Syslog, Netflow, Windows Event Logs, and SNMP.
Adding to the fun are usually a handful proprietary formats as well, more often than not from the telecom side of the house. Wrangling this proverbial herd of cats together with a log management system requires one to think about the end product, and to keep in mind that log management systems typically normalize various data formats into a common schema. Rather than examining each type of log data in isolation, the end goal is to instead analyze a well orchestrated view of aggregate information across many different sources. Therefore, you should not only think about how a singular piece of log information is useful by itself, but also how it can enhance the usefulness of other information through correlation.
There's no need to go overboard here by hiring expensive data architects or database administration wizards. Simply think about how each component fits into the big picture and you'll be well on your way to a successful deployment.
With respect to log management system planning, one must take the overall volume of logs, as well as the geographical dispersion of systems into consideration. As mentioned earlier, log management systems are typically categorized into two different families: the basic log collector, and the SIEM.
However, these two classes are by no means mutually exclusive, and can in fact work in concert to build highly scalable systems capable of handling massive amounts of data from systems spread far and wide. Take a hypothetical company with a headquarter office located in Chicago and satellite offices in New York and California. Assuming each office generates a fair amount of system logs, one could deploy the potentially expensive commercial SIEM within the headquarters, yet strategically position free, open source log collectors/forwarders at the satellite offices. Within the California and New York offices, the chatty local traffic could be aggregated at the local server, which would then filter out noise and forward only important events upstream to the SIEM in Chicago. Rather than receiving logs from each and every server at the remote offices, the Chicago-based SIEM would only see events originating from two remote aggregation servers. This not only cuts down on extraneous network traffic, but may also reduce your license count dramatically.
SIEM solutions that natively support standard formats such as Syslog and Netflow are better equipped at fostering heterogeneous environments consisting of mixed open source and commercial components. Be on the lookout for vendor lock-in signs such as solutions that require proprietary agents to be installed on all systems, or systems that generally do not play well with open standards.

Reading the logs

Having examined the general benefits of log management systems as well as the planning methodology that goes into a successful log management system roll-out, one must take into consideration what resides at very heart of the system. I am of course referring to the logs themselves, and understanding their various formats and nuances is an integral factor in deciding which specific technologies to deploy. An in-depth analysis of specific log formats is well beyond the scope of this article, but suffice it to say certain log some formats are intended for human consumption, whereas others are more apt to machine parsing.
Formats such SNMP and Netflow are examples of highly structured data which are easily processed by software. On the other hand, system logs such as those generated by UNIX or Windows servers were historically designed for human evaluation rather than machine review. As such, they actually bare a closer resemblance to an email message rather than that of an event record. Much like email headers, Syslogs and Windows Event Logs have basic fields which convey only metadata such as the category, severity, and time of the event. The relevant information pertaining to the event itself is actually embedded within the "message" field of the record, which is analogous to the body of an email message. Just as there is there no standardize format for composing an email message, the placement of vital event information is often sporadic and comingled within other key data that really should be logically separated into their own discrete fields.
Coming full circle, this is where SIEM-type systems prove their worth through the data normalization process. That is, the intelligent parsing and transformation of loose data into structured information. Obviously, how well a given solution performs this task should be closely scrutinized during the product analysis phase.
Once the technological hurdles of a log management system have been addressed, the final stage of deployment is to compile a proper log management policy. Policies essentially define what to log, how the logs are recorded, and for how long logs are to be retained. Logging policies are frequently requested during times of legal action such as lawsuits or public records requests. Documenting what to log serves as the record of decision with respect to what is recorded versus that which is discarded.
Therefore, having language that clearly defines what is recorded and for how long it is retained can make the difference between efficient records requests and prolonged, time-draining depositions. Be aware that if records are requested from your organization, the requesting entity will most likely be using a completely different technology tool set. As such, it's imperative that copies of your original logs are kept in their native, unaltered state. If this isn't possible, then at the very least, logs should be easily exportable to a standardized format without loss of relevant information.
From the procedural perspective, log management policies should serve as a model for how logging is actually implemented across all enterprise systems. Areas of focus should include accurate time-keeping, log rotation and archival routines, as well as testing procedures to ensure the policies are upheld at all times.

Simple defenses are sometimes the best

Evaluating the actual attacks in the wild can pinpoint a few simple security measures that can dramatically reduce the likelihood of a successful attack.

If companies had turned on a security measure known as data-execution protection in Windows systems, they would have been immune to 14 of the 19 attacks based on memory corruption vulnerabilities.
That's one of the data points that led security consultant Daniel Guido of iSec Partners to recommend that corporate defenders focus on the vulnerabilities exploited by current attacks, rather than attempting to give all vulnerabilities equal weight. In a presentation at last week's SOURCE Boston conference, Guido noted that there are some 8,000 vulnerabilities found every year, yet only 27 flaws were massively exploited by malicious software in 2009 and 2010.
That's because, similar to defenders, attackers like to be efficient and don't have unlimited time, Guido says.
"Attackers are better at certain things than they are at others -- they have capabilities that they exercise and they prefer certain tactics, they prefer certain techniques," he says. "If we can inform our defenses to focus on those capabilities, those tactics, and those techniques, then we can make much more effective defenses than just going from top to bottom and patching vulnerabilities from zero to 8,000 every year."
Guido analyzed the most popular exploit kits and malicious software and found that the attackers increasingly use exploitation techniques that first appeared in targeted attacks. Memory corruption vulnerabilities accounted for 19 of the vulnerabilities exploited by such kits, while 11 of the 15 exploit packs also targeted Java flaws.
The lesson, says Guido, is to focus on countermeasures that foil these attacks, rather than focus on compliance and patching every vulnerability. In fact, all the memory corruption vulnerabilities were in five targets: Microsoft's Internet Explorer, Mozilla's Firefox, Sun's Java, and Adobe's Flash and Acrobat Reader applications. Turning on data-execution protection (DEP) -- a technology that prevents attackers from writing code to memory and then executing it -- in those applications can prevent the majority of the flaws from being exploited.
Also see: Does patch management need patching?
"Everybody said you should apply DEP because it is a good thing to do, and that is not a great selling point," he says. "But now that we know what we are getting out of it. I can take this and sell it to my upper management."
Of course, DEP and other protections can be bypassed, but attackers focused on massive compromises are not attempting to circumvent the countermeasures, he says.
In the end, companies should use intelligence on attackers, whether through their own analysis of attack tools or through a security service provider, to determine their defensive focus, he says. The efforts should augment efforts to increase the overall security of the company and should be part of a defense-in-depth strategy, not a replacement, he says.
"I am not advocating just going to get a couple of vaccines and then stop washing your hands," Guido says. "You need to patch the vulnerabilities that are out there, but there are ways to go about it more effectively, to reorder your priorities, to look at different mitigations in the absence of patching, ... because there may be easier ways of dealing with things that are causing you pain."

Cloud security: The basics

The Cloud Security Alliance and others are working to define security requirements for SaaS, IaaS, and PaaS cloud computing models.

Cloud computing is one of the most-discussed topics among IT professionals today. And not too long into any conversation about the most highly touted cloud models—software as a service (SaaS), infrastructure as a service (IaaS) or platform as a service (PaaS)—the talk often turns to cloud security.
According to Milind Govekar, an analyst at Gartner, cloud has rocketed up the list from number 16 to number two in Gartner's annual CIO survey of key technology investments. "Like with anything new, the primary concern is security," he says. In fact, the vast majority of clients who inquire about cloud, he says, would rather create a virtualized data center on their own premises—what some call a private cloud—because they're uncomfortable with the security issues raised by cloud computing and the industry's ability to address them.

Read the companion article "Cloud security in the real world: 4 examples"

"We are in the early stages of a fascinating journey into a new computing model that, for all its purported advantages, from a security and risk point of view, is a difficult thing to deal with," agrees Jay Heiser, an analyst at Gartner. "The things that make it easy and appealing—like the immediate plug-and-play productivity—also make it impossible to conclusively assess your relative risks." Current certifications, such as SAS 70 and ISO 27001 and 27002, are not sufficient, he says, leading to frustration for both buyers and sellers.
For this reason, securing cloud computing environments will be a major focus of vendor efforts over the next year, says Jonathan Penn, an analyst at Forrester Research. In the short term, he sees users having to do a lot of the legwork, but over time, "cloud providers themselves will see the opportunity to differentiate themselves by integrating security," he says. Security vendors accustomed to selling directly to the enterprise will find that they need these cloud providers as a way to reach the market, Penn says, and as the market matures, customers will want this stuff baked into the services they're buying. "That will be quite a radical change and a disruption," he adds.
In the meantime, organizations such as the Cloud Security Alliance (CSA) are working to put some shape around the security issues and the ways to address them. The CSA recently released a summary of the strategic and tactical security pain points within a cloud environment, along with recommendations on how to address them. The organization divided the domains into two broad areas: governance and operations.
Domains grouped under governance include:

• governance and ERM
• legal and electronic discovery
• compliance and audit
• information lifecycle management
• portability and interoperability

Domains grouped under operations include:

• traditional security, business continuity and disaster recovery
• data center operations
• incident response, notification and remediation
• application security
• encryption and key management
• identity and access management
• virtualization

The CSA also summarized the top threats of cloud computing, along with the cloud models each threat most pertains to and guidance for remediation.
The categories of tools that can help address these threats include XML, SOA and application security; encryption tools for data in transit and at rest; smart key management; log management; identity and access management; virtual firewalls and other virtualization-management tools; data-loss prevention; and more. "You're translating the existing security architecture into the cloud, so there are a lot of different tools you'll need, some of which already exist and other cases where you need new technology," Reiser says.
For instance, malware scanning tools will need to look specifically for emerging malware that targets virtual platforms; identity management systems will need to authenticate not just users but also devices and applications; and security information management (SIM) systems will need to log billions of events and analytics.
Forrester also released a list of questions that enterprises should ask to secure their cloud implementation, covering the areas of security and privacy, compliance, and other legal and contractual issues.
Cloud layers
Experts also emphasize that the level of exposure and risk for the three cloud models are very different, and the way of addressing security also differs, depending on which layer you're engaging with. "The security requirements are really the same, but as you go from SaaS to PaaS and IaaS, the level of control you have over security changes," says Mike Kavis, founder of Kavis Technology Consulting and CTO at a startup company. "From a logical view, nothing has really changed, but how you physically do it changes dramatically."

SaaS.

As the CSA explains, with SaaS, the provider's applications run on a cloud infrastructure and are accessible through a Web browser. The consumer does not manage or control the network, servers, operating systems, storage or even individual application capabilities. For this reason, the SaaS model integrates the most functionality directly into the offering, with the least consumer extensibility, and "security responsibilities are almost entirely up to the vendor," Reiser says. "If the vendor doesn't encrypt data, it's not encrypted. If there isn't activity monitoring, you won't get any."

PaaS.

With PaaS, consumers create applications using programming languages and tools supported by the vendor and then deploy these onto the cloud infrastructure, the CSA explains. As with SaaS, the consumer does not manage or control the infrastructure—the network, servers, operating systems or storage—but does have control over the deployed applications and possibly the application-hosting environment configurations. There are fewer customer-ready or built-in security features with PaaS than with SaaS, the CSA says, and those that do exist are less complete, but there is more flexibility to layer on additional security. This means users need to pay attention to application security, as well as security issues surrounding the management APIs, such as authentication, authorization and auditing.

IaaS.

Here, consumers can provision processing, storage, networks and other fundamental computing resources, as well as deploy and run operating systems and applications, according to the CSA. While they don't manage or control the underlying cloud infrastructure, they do have control over operating systems, storage and deployed applications, and possibly limited control of select networking components, such as host firewalls, the CSA says. With IaaS, there are few integrated security capabilities beyond protecting the infrastructure itself, but there's enormous extensibility, according to the CSA. This means users need to manage and secure operating systems, applications and content, typically through an API.

Also see "How to avoid the stormier implications of the cloud"

"A lot of the perimeter security is handled by the vendor, but they're giving you access to virtual machines, so you still have to build the application and provide the infrastructure control," Kavis says.
With IaaS, virtualization management is a big concern, says Heiser, particularly when it comes to intrusion detection and the integrity of partitioning virtual machines. "You need to mediate separation and make sure they don't interact with each other," he says.
Chris Barber, CIO at Wescorp, says he is concerned about multitenancy and hypervisor vulnerabilities. "Since you have multiple users on a single physical box, there may be a security vulnerability that one user could somehow access another user's virtual machine," he says.

Five cloud security trends experts see for 2011

What do IT security practitioners expect to be major cloud security issues in 2011? Here are five things to watch for.

What do CSOs and other IT security experts expect to be top-of-mind cloud security issues in 2011? Here are five things to watch for in the coming year:
1. Smart phone data slinging . More users will be accessing large amounts of data on the devices of their choice, says Randy Barr, CSO at Qualys Inc. and member of the Cloud Security Alliance (CSA). "This comes with a lot of unaddressed security issues," Barr says. "We can expect new solutions to address mobile devices, but could see a large data breach to expose the issue of mobile security before we see a solution." Among the possible scenarios, Barr says, are insecure cloud-based backup and highly confidential data on mobile devices."There are some interesting inter-dependencies when using multiple cloud services on mobile devices, with possibly different security models and assumptions," he says. A hacked cloud provider could provide mass access to confidential mobile device data when mobile users are using cloud-based mobile device support, he says. In addition, loss or theft of mobile device could provide root-level access to cloud services and data. Mobile apps are often providing direct and automated access to cloud services and data, he says. If an admin-level person's mobile device is stolen, this could be a major threat to highly confidential data or even cloud services administered by such a person from an insecure mobile device.
2. Need for better access control and identity management."The cloud by nature is highly virtualized and highly federated, and you need an approach to establish control and manage identities across your cloud and other peoples' clouds," says Alan Boehme, senior vice president of IT strategy and architecture at financial services firm ING. "There are some third parties that have delivered products and services that will address these issues, but they might not be adequate for large enterprises that have a mix of legacy and cloud components."
3. Ongoing compliance concerns."I think that compliance, especially PCI, is likely to continue to be a security issue," says Andy Ellis, CSO at Akamai. "Organizations still often need to come to grips with completely different processes that they have for managing data and apps in the cloud. And I think we will hear more rumblings about healthcare data in the cloud."
4. Risk of multiple cloud tenants. Given that most cloud services make heavy use of virtualization technology, the risks associated with multiple organizations' data housed on a single physical hypervisor platform exist, and will continue to unless specific segmentation measures are enacted, says Dave Shackleford, director of security assessments and risk & compliance at Sword & Shield Enterprise Security, and a member of the faculty of research firm IANS. Although it is assumed that virtual machines and virtual network components are 'separated by default', flaws and potential weaknesses in hypervisor platforms have been documented that could cause segmentation issues.
The most well-documented flaw was the one noted last year by Kostya Korchinsky of Immunity, where he "broke out" of a VMware Virtual Machine and executed a program on the underlying hypervisor system with a proof-of-concept tool called CloudBurst, Shackleford says. And in 2008 Core Security found a directory flaw that could allow an attacker to access files on the hypervisor from the virtual machine, he says.

5. Emergence of cloud standards and certifications. Because security will be evaluated when choosing cloud services, standards and certifications will be extremely important to help customers gauge how secure their data will be kept, Barr says. Cloud users will continue to leverage their existing processes for evaluating the security postures of cloud providers, but will begin looking at some of the more popular organizations developing guidance and standards, he says.

Seven Deadly Sins of Social Networking Security

To users of LinkedIn, Facebook, Myspace, Twitter or other social networking sites: Are you guilty of one of these security mistakes?

Admit it: You are currently addicted to social networking. Your drug of choice might be Facebook or Twitter, or maybe Myspace or LinkedIn. Some of you are using all of the above, and using them hard, even IT security practitioners who know better.
While it's impossible to escape every social networking security threat out there, there are steps one can take to significantly reduce the risks. CSOonline recently checked in with dozens of IT security professionals (ironically, using more than one social networking platform to do so) to pinpoint seven typical mistakes people make, and how to avoid them.
Over-sharing company activities
This is a sin of pride, when someone gets excited about something their company is working on and simply must tell everyone about it. Maybe you work for a drug company that is on the verge of developing the cure for cancer. Maybe the company is developing a new car that runs on curbside trash -- in other words, something everyone will want. (See also: Intellectual Property Security: Don't Lose Your Head)
By sharing too much about your employer's intellectual property on social networks, you threaten to put it out of business by tipping off a competitor who could then find a way to duplicate the effort or find a way to spoil what they can't have by hiring a hacker to penetrate the network or by sneaking a spy into the building.
Then there are hackers controlling legions of botnets that could be programmed to scour a company's defenses and, upon finding a weakness, exploit it to access data on the intellectual property. With the data in hand, the hacker can then sell what they have to the highest bidder, which just might be your biggest competitor.
"Sharing this kind of information could lead to targeted attacks on specific technology-producing enterprises," says Souheil Mouhammad, a senior security expert at Altran Technologies.
This social networking security sin has sparked a debate in the industry about whether companies need to revise their employee computer use policies with more specific language on what is/isn't allowed in the social networking arena (see also: Debate: Does Social Networking Require User Policy Changes?).
To rein in the urge to share too much, it might be useful to repeat this saying, which has started to appear in the public domain: "Loose Tweets Sink Fleets."
Mixing personal with professional
This sin is closely related to the first, but extends beyond the mere disclosure of company data. This is the case where someone uses a social network for both business and pleasure, most commonly on Facebook, where one's friends include business associates, family members and friends.
The problem is that the language and images one shares with friends and family may be entirely inappropriate on the professional side. A prospective employer may choose to skip to the next candidate after seeing pictures of you drunk or showing off a little too much leg at someone's birthday party. In sharing such things, you also stand a good chance of making the company you represent look bad.
"In my view one of the major rules when engaging in social networking is to be aware that your words belong in the public domain," says Paul V. de Souza, chief security engineer at AT&T. "You may be quoted all over the Internet, so make sure to choose your words carefully. Be diplomatic and extremely professional."
In some cases, it's nearly impossible to separate business from the personal on a social networking site. Those who work for media companies, for example, are sometimes required to use all their social networking portals to proliferate content in an effort to boost page views which, in turn, attract potential advertisers. But wherever and whenever possible, security practitioners work to keep each locked in their respective boxes.
"You have to understand very clearly what the objective of your presence on any given social network is. If it is for work, keep it for work only. If it is for personal/fun use, keep it for personal use only," says Benjamin Fellows, a senior IT security and risk consultant at Ernst & Young. "I can't tell you how many times I have been invited to Facebook by a work colleague only to find things on their wall or profile that are definitely not politically correct or are downright offensive. I keep all my work friends in LinkedIn and my personal friends in Facebook. Even then, I am very careful what I say on either site. I guess you could also put this under the heading of know your audience."
Engaging in Tweet (or Facebook/LinkedIn/Myspace) rage
For the person who has just been laid off or had their professional integrity called into question online, the urge to fire back with a stream of vitriol can be irresistible. Call this a sin of wrath.
"You don't want to get into a flame war," says John Bruggeman, a Cincinnati-based IT director. "Be mindful of what you say and imagine you are at a party where everyone is listening, including your boss, spouse or future employer."
Scott Hayes, president and CEO of Database-Brothers Inc., agrees, saying, "Posting any content when angry is about as dangerous as sending flaming emails, if not more so. Think twice about clicking 'submit' because the world may be looking at your angry, immature rant for years."
Believing he/she who dies with the most connections wins
For some social networkers, it's all about accumulating as many connections as possible. Folks on LinkedIn are notorious for doing this, especially those in such LinkedIn groups as TopLinked and LION. This may seem harmless enough or, at the worst, just annoying. But when the name of the game is quantity over quality, it's easy to link or "friend" a scam artist, terrorist or identity thief.
"Always verify the person who wants to get in contact with you," says Ruud van den Bercken, a security specialist at XS4ALL Internet in the Netherlands. "Do you know him or her? If not, why is the person trying to connect with you? Check if the profile of the other person is secured. If you can't retrieve a list of that person's connections, you have to ask yourself" if you really want to go down that road.
As San Francisco-based network and security architect/engineer Jatinder Thukral puts it: "I'd rather have 50 relevant contacts than 500 unknowns."
Password sloth
Another common sin is one of laziness, in this case picking passwords for your social networks that you're least likely to forget. In many cases, that means using the same password for LinkedIn and Facebook that you're using for your online bank account or work machine. If someone with malicious intent figures out the password for one social network, that person can now go and access everything else.
"Using the same password on several sites is like trusting the weakest link in a chain to carry the same weight. Every site has vulnerabilities, plan for them to be exploited," says Daniel Philpott, information security engineer at OnPoint Consulting Inc.
Trigger finger (clicking everything, especially on Facebook)
Facebook in particular is notorious as a place where inboxes are stuffed with everything from drink requests to cause requests. For some social networkers, clicking on such requests is as natural as breathing. Unfortunately, the bad guys know this and will send you links that appear to be from legitimate friends. Open the link and you're inviting a piece of malware to infect your machine. Christophe Veltsos, president of Prudent Security, describes this as being "click-happy" and warns, "Don't click unless you're ready to deal with drive-by downloads and zero-day attacks."
Endangering yourself and others
All of the above tie into the seventh and perhaps most serious sin, which is that reckless social networking can literally put someone's life in danger. It could be a relative or co-worker. Or it could be yourself.
Security experts advise extreme caution when posting birthday information, too much detail on your spouse and children, etc. Otherwise, they could become the target of an identity thief or even a kidnapper.

Is it possible to erase your Digital Footprint ?

In a world where we share more information online than ever before, it might seem impossible to disappear completely. But Frank Ahearn can help. A professional skip tracer for many years, he tracked down 'missing' persons for clients who were searching for them for legal or financial reasons. His arsenal included use of public records, credit reports, utility bills, criminal background checks, tax information and other revealing documents.

But these days, Ahearn assists people who want to go the other way--those who want to disappear and erase evidence of their existence. In his book How to Disappear: Erase Your Digital Footprint, Leave False Trails, and Vanish without a Trace, Ahearn details some of the tricks he uses when helping clients "get off the grid," as he refers to it, and shares tips for those concerned about information and privacy in this digital-sharing era. And while he refuses to assist people looking to get lost for illegal purposes, he says they often do come looking for help and advice on strategically manipulating information in the wrong direction.
CSO: How did you first become interested in helping people disappear?
Frank Ahearn: Originally, I had a skiptracing company for over 20 years where l located people. Most of my clients were investigators, insurance companies and attorneys. So I've always been good at accessing information. Then, a couple of years back, I was in book store and there was this guy buying all these books about privacy, offshore banking and Costa Rica. He ended up getting in line in front of me and paying for it with a credit card. I thought: "That's kind of dumb. You're buying these books that are about discretion and you're using a credit card."
I saw him in the bookstore's café and started shooting the breeze with him. I told him I was a skip tracer and that I could find him with that credit card transaction he just had to purchase the books. I gave him a breakdown of how I would find him.
It turned out he was a corporate whistle blower and had some money he wanted to take off shore. He asked if I could help him disappear. That was kind of the genesis of the idea.
Who comes to you looking for help with disappearing?
Clients typically come from two kinds of scenarios: Money or violence. Violence is usually a victim of stalker or in a domestic situation with an abusive ex and not sure how to get away. Then there is the money end of it. People who have come into some money and want to leave the world behind.
Recently things have kind of changed. Clients come to me now saying they are concerned about their information. That has definitely become a more prominent issue.
How do you hide people who actually want to disappear? Do you change their identity?
You can't legally change an identity. Identities are kind of this myth. Where do you get one from? And how do you know where it's from and that it hasnt been given to fifty other people? Who knows if it's on the Megan's Law list or if it belongs to someone who owes the IRS $100,000?
When someone comes to me in violent situation is I ask "Where are you going to go and how are you going to earn money?" You can't be Joe the Bus Driver in Chicago and then be Joe the Bus Driver in Seattle. You can be traced through your driver's license. But sometimes you can open a corporation, depending on what you do, and work on a 1099.
So, what we do in a nutshell, is make you a virtual entity where you work for this corporation. You lease your apartment through this corporation, your electricity, your phone. Everything about you exists under the corporation. The address doesn't have to be in the same city you're in. The goal is to make you virtual and have you communicate virtually through this corporation.
Do any of your clients pose an ethical dilemma for you?
I have people contact me all the time and I can tell there is something shady going on. But I know how to screen my clients well. People who come to me and are sincere will say "I have this problem. How can I solve it?" Where as individuals who want to do something shady, such as wire money off shore, or who are facing law enforcement issues, always have an agenda. They'll say "I want to do this, and then I want to do that." There is a difference between that kind of person and the people who have a real problem and want help solving it.
Now that there is so much push to share information through social networking and other digital venues, does it make your job more difficult?
It's kind of a double edge sword. You have to remember just because its online doesn't mean it's correct. Just like you can use social networking to find information about people, I can use social networking information to create disinformation about my clients. It's all a matter of who is better at something.
Have you actually used the web and social networks as a tool to create a false profile?
What we use it for is to create confusion.
About a year back, a client of mine was in Africa and he was in a hotel bar. He struck up conversation with someone and that person ended up saying something that they shouldn't have known about my client. The client just went to his room, got his bags and left without even checking out.
We were able to find out that someone in that hotel had accessed a real estate web site like Trulia or Zillow and put his address in. It revealed his home was valued at $4 million or $5 million. The problem international travelers are facing now is you go somewhere where you assume no one really knows who you are. But in a hostile environment, someone can now look at your information and realize you're worth the trouble of a potential abduction.
So, we create bogus individuals around client names. One person could be a photographer, one person could be a chauffeur, or whatever. We develop about 15 to 20 web sites and create all these social media sites around you. Now if you are traveling somewhere and someone puts your name in, they are going to locate those 20 other people before they get to you, depending on how much information is known about you. And when you travel, you'll have information about your photography business in your hotel room. That way, if someone is going through your room, they will realize you are Joe Blow the Photographer instead of Joe Blow the CEO. That is how we are starting to use misinformation online.
As another example, I worked with a woman who, if you entered her name online, the only thing that was known about her was that her father was selling his company for $45 million. That was a big threat. We took her name and took similar slices of information about her and built all these characters, fake individuals around her. Thats becoming something more in demand with clients.
What kind of recommendations do you give to people who aren't necessarily wanting to disappear, but are concerned about their privacy?
Social networking has become a huge issue when it comes to privacy. You wouldn't put a billboard on the side of the road that says "Look! Here's my wife, here's my kids! Take a look at these pictures of my backyard barbeque!" But people do put that stuff on social networking sites. I can understand wanting to use social networking from a business point of view. But keep in mind every time you put something out there, you are creating this digital DNA.
Take Facebook, for example. Facebook will delete your information online (if you close your account), but anything you share is not deleted. And Facebook has in their terms of service that they keep the information in their system for an undetermined amount of time. That could be 500 years.
Do you know the 7 deadly sins of social networking?
I think that is one of the problems; people not realizing where this is going to bring us and that the information can be used against you. Companies now are searching people's social media. What are they like? Are there pictures of them drinking at tail-gating parties? Is there someone who has an outspoken web site that may impact a hiring decision? People dont even think that their bosses may search this stuff out. And if the wrong person gets hold of your information, they really can wreak havoc on you.
When you do something online, ask yourself "Can this affect me negatively in the future?" Think about if you really need pictures of your kids online. If you wouldn't show them to a stranger sitting next to you on a plane, why put them online for everyone to see?
Ask yourself: What is the definition your own privacy? With the internet, we dont have a choice; we have to be a part of it whether we like it or not. So we have to decide what is important to us in terms of privacy and start doing things about that. Whether it's to reduce what is out there about us, or just control some of the information.