Quando inizi ad accettare l'impossibile, rischi di scoprire la verità

Transcript

1 Quando inizi ad accettare l'impossibile, rischi di scoprire la verità (sulla sicurezza delle applicazioni in the cloud) Alessio L.R. Pennasilico - apennasilico@clusit.it 5 Giugno 2013 Security Summit Roma

2 $whois -=mayhem=- Security Committed: AIP Associazione Informatici Professionisti, CLUSIT AIPSI Associazione Italiana Professionisti Sicurezza Informatica Italian Linux Society, Sikurezza.org, AIP/OPSI Hacker s Profiling Project, CrISTAL 2

3 Fabrizio Fiorucci Senior Field Systems Engineer & Subject Matter Expert F5 Networks Italy 3

4 Cloud Un mondo dorato di soffici arcobaleni? 4

5 Cloud Ci sedemmo dalla parte del torto visto che tutti gli altri posti erano occupati Bertolt Brecht 5

6 Value proposition? DDOS? High Performance? Scaling resorces? Pay per use? Dynamic adapting? Mobile users? 6

7 Non è tutto oro... Ma forse è ora? 7

8 Problemi secondari PT? Data location? Audit? 8

9 Digital divide Hai abbastanza banda? Una linea di backup? 9

10 What s in the box?

11 Is Cloud all good?

12 Some Cloud benefits... No infrastructures No rooms, cooling, environment security No backup No servers HW maintenance No personnel, training... No expensive Internet bandwidth

13 Connect the users to your application Forget everything else...

14 You got a cloud service! What are you going to do with that?

15 What about SECURITY?

16 What about SECURITY? Well... of course we have FIREWALLS!!

17 L3 / L4 Firewalls Positive policy, everything out, only 80 / 443 in HTTPS... how do they handle it? DoS / DDoS: how do they handle them? Web Application attacks: how do they handle them?

18 Cloud services -

19 Servizi cloud Possono essere declinati in diverse modalità operative 19

20 Cloud Services 20

21 SaaS (Software as a Service) - Consiste nell'utilizzo di programmi installati su un server remoto, cioè fuori del computer fisico o dalla LAN locale, spesso attraverso un server web. Questo acronimo condivide in parte la filosofia di un termine oggi in disuso, ASP (Application service provider). 21

22 DaaS (Data as a Service) - Con questo servizio vengono messi a disposizione via web solamente i dati ai quali gli utenti possono accedere tramite qualsiasi applicazione come se fossero residenti su un disco locale. 22

23 HaaS (Hardware as a Service) - Con questo servizio l'utente invia dati ad un computer che vengono elaborati da computer messi a disposizione e restituiti all'utente iniziale. 23

24 PaaS (Platform as a Service) - Invece che uno o più programmi singoli, viene eseguita in remoto una piattaforma software che può essere costituita da diversi servizi, programmi, librerie, etc. (ad esempio Google's App Engine) 24

25 IaaS (Infrastructure as a Service) - Utilizzo di risorse hardware in remoto. Questo tipo di cloud è quasi un sinonimo di Grid Computing, ma con una caratteristica imprescindibile: le risorse vengono utilizzate su richiesta o domanda al momento in cui una piattaforma ne ha bisogno, non vengono assegnate a prescindere dal loro utilizzo effettivo. 25

26 Cloud services 26

27 Cloud services 27

28 Cosa proteggere? A seconda del servizio sottoscritto possiamo adottare diverse misure 28

29 SSL Solo perché sono paranoico non significa che non mi stiano seguendo... 29

30 Cosa proteggere? Proteggere una applicazione è impossibile Proteggere una infrastruttura è doveroso 30

31 Ambienti misti 31

32 IaaS Segregation 32

33 Firewall Cosa posso proteggere? 33

34 AF Possiamo proteggere le nostre applicazioni se il deploy ha previsto questa funzionalità 34

35 WAF E quasi certamente roba web : posso fare security su quel traffico? 35

36 Protocolli del secolo scorso Posso gestire correttamente protocolli complessi? Lo posso fare io? 36

37 VPN E necessario aggiungere ulteriori layer di sicurezza? E possibile farlo? 37

38 DNS Non sottovalutate l importanza delle Pagine Gialle 38

39 Chi sei? Cloud provider MSSP Cloud System Integrator Rivenditore Cliente 39

40 Etica... DPI Filtering 40

41 A day in the life of a packet

42 A day in the life of a packet Application content port 80 / 443 Network packet DNS Services Users DB

43 Security Challenges 54% of hacking breaches in larger organizations occur at the web application. A denial of service tool using SSL/TLS showed the potential for an everyday laptop on an average connection to take down an enterprise web server. SSL/TLS We still see SQL Injection as a choice point of entry for attacker. Threat detection today hinges on two elements: identifying suspicious activity among billions of data points, and refining a large set of suspicious incidents down to those that matter Anonymous proxies have steadily increased, more than quadrupling in number as compared to three years ago. The most significant change we saw in 2011 was the rise of hacktivism against larger organizations worldwide.

44 Security Challenges 54% of hacking breaches in larger organizations occur at the web application. A denial of service tool using SSL/TLS showed the potential for an everyday laptop on an average connection to take down an enterprise web server. SSL/TLS We still see SQL Injection as a choice point of entry for attacker. Threat detection today hinges on two elements: identifying suspicious activity among billions of data points, and refining a large set of suspicious incidents down to those that matter Anonymous proxies have steadily increased, more than quadrupling in number as compared to three years ago. The most significant change we saw in 2011 was the rise of hacktivism against larger organizations worldwide.

45 Security Challenges 54% of hacking breaches in larger organizations occur at the web application. A denial of service tool using SSL/TLS showed the potential for an everyday laptop on an average connection to take down an enterprise web server. SSL/TLS We still see SQL Injection as a choice point of entry for attacker. Threat detection today hinges on two elements: identifying suspicious activity among billions of data points, and refining a large set of suspicious incidents down to those that matter Anonymous proxies have steadily increased, more than quadrupling in number as compared to three years ago. The most significant change we saw in 2011 was the rise of hacktivism against larger organizations worldwide.

46 Security Challenges 54% of hacking breaches in larger organizations occur at the web application. A denial of service tool using SSL/TLS showed the potential for an everyday laptop on an average connection to take down an enterprise web server. SSL/TLS We still see SQL Injection as a choice point of entry for attacker. Threat detection today hinges on two elements: identifying suspicious activity among billions of data points, and refining a large set of suspicious incidents down to those that matter Anonymous proxies have steadily increased, more than quadrupling in number as compared to three years ago. The most significant change we saw in 2011 was the rise of hacktivism against larger organizations worldwide.

47 Web application are at risk Most websites were exposed to at least one serious vulnerability every day of Only 16% of websites were vulnerable less than 30 days of the year overall. On the average, 50% of organizations require 116 days or less to remediate their serious vulnerabilities. During 2010, the average website had 230 serious* vulnerabilities. - White Hat Website Security Stats Report 64 percent of developers are not confident in their ability to write secure applications. - Microsoft Developer Research

48 A day in the life of a packet Application content R port 80 / 443 Network packet DNS Services Users DB

49 Compliance Che leggi è necessario rispettare? Che policy è necessario rispettare? 49

50 Strumenti Che caratteristiche devono avere gli strumenti usati? 50

51 Dati sensibili? Cosa carico in the cloud? 51

52 Dati in the cloud Posso criptare le informazioni? Posso fare dei backup? 52

53 Dati in the cloud Posso anonimizzare le informazioni ove necessario? Retention in caso di cancellazione? 53

54 Altri meccanismi Come gestisco servizi basati su certificati? 54

55 Monitoring Posso monitorare i miei servizi? Quali / Come? 55

56 It s time to rethink security

57 It s time to rethink security Traditional firewalls fails under heavy DoS / DDoS Attacks Most of the attacks are targeted to the application level DNS Security is becoming a MUST Are you trusting the Cloud in hosting your users data?

58 It s time to rethink security CONSOLIDATE NETWORK AND SECURITY FUNCTIONS Use case Before f5 Firewall Network DDoS Application DDoS Web Access Management Load Balancer DNS Security Load Balancer & SSL Web Application Firewall with f5 Consolidation of firewall, app security, traffic management Protection for data centers and application servers High scale for the most common inbound protocols

59 It s time to rethink security CONSOLIDATE NETWORK AND SECURITY FUNCTIONS Use case Before f5 Firewall Network DDoS Application DDoS Web Access Management Load Balancer DNS Security Load Balancer & SSL Web Application Firewall with f5 Consolidation of firewall, app security, traffic management Protection for data centers and application servers High scale for the most common inbound protocols

60 What about SECURITY? Well... of course we have FIREWALLS!!

61 Application DDoS Network DDoS Web Access Management Load Balancer & SSL DNS Security Web Application Firewall What about SECURITY? You need to be sure to have everything in place to protect your users data!

62 What about SECURITY? F5 Networks has all what you need to protect your application and data in the Cloud

63 What s in the box? It s time to rethink security in the Cloud

64 Fabrizio Fiorucci Senior Field Systems Engineer & Subject Matter Expert F5 Networks Italy M:

65 Conclusioni -

66 No-Cloud Il Cloud Computing può essere un importante strumento per creare valore per l azienda tramite l ottimizzazione di alcuni processi. Tuttavia va valutato con attenzione, sotto ogni aspetto implementativo ed organizzativo. 66

67 Strumenti Non sempre è possibile utilizzare gli strumenti che siamo abituati ad avere a disposizione L importante è poter utilizzare che avevo deciso essere necessari 67

68 These slides are written by Alessio L.R. Pennasilico aka mayhem. They are subjected to Creative Commons Attribution-ShareAlike-2.5 version; you can copy, modify, or sell them. Please cite your source and use the same licence :) Domande? Grazie dell attenzione! Alessio L.R. Pennasilico - apennasilico@clusit.it facebook:alessio.pennasilico - twitter:mayhemspp linkedin:alessio.pennasilico 5 Giugno 2013 Security Summit Roma