Incident response in Cloud
- 1. Incident Response in cloud ~VandanaVerma
- 2. About Me • initiative and passionate about driving more women participation in overall InfoSec. • Chapter lead for OWASP Bangalore • Volunteer Coordinator - Asia Pacific for OWASPWomen in AppSec (WIA) & Secretary. • Leading InfosecGirls in India
- 3. Agenda • Cloud Basics • Shared Responsibility Model • Incident Response in the Cloud • Hardening • Services andTools • Logging and Monitoring • Incident Response • How to prepare for a breach scenario • Some recent issues • Resources
- 4. Lets Get the Basics Right!
- 5. Cloud
- 6. Cloud Basics • In simple terms it is about the delivery of computing services - servers, storage, databases, networking, software, analytics and more - over the Internet (“the cloud”). • Attributes • Multi-tenancy (shared-resources) • Massive scalability • Elasticity • Pay per use • Self-provisioning of resources
- 7. Service & Deployment Models in Cloud • Service Models • IaaS – Infrastructure as a Service • PaaS – Platform as a Service • SaaS – Software as a Service • Deployment Models • Public • Private • Hybrid • Community
- 9. Incidence Response in Cloud
- 10. Traditional IR vs Cloud IR – Environment • The cloud is not static • Systems may start and stop automatically in response to processing load • Including systems that were or still are compromised • Volatile data is gone forever... • IT staff generally has little control over the architecture and resource allocation
- 11. Build Incident Response Plan • Plan and Prepare (Who to contact?, How to communicate?,What information to parse?,Where are backups stored?) • Establish a joint response plan with the cloud provider. • Evaluate the monitoring controls and security measures that are in place in the cloud • Have a Recovery Plan • Make a decision on ForensicsTools • Common things to backup • Mock Drills , Practice
- 13. How to prepare for a breach scenario • Protect • Detect • Respond
- 14. Protection • Identity and Access Management • Multi Factor Authentication • Network Segmentation • Encryption • Secret Management • SecurityTesting / PenTest
- 15. Detect • Monitoring and Alerting • Log user access • Changes • NetworkActivity • Security events
- 16. Respond • Incident Drills • Have a plan • Practice Regularly • RedTeaming • Awesome Incident Response • Ref: https://github.com/meirwah/awesome-incident-response
- 17. Hardening (Cloud Security Controls) • Know what you are responsible for • Control who has access to the data • Protect the data • Secure the credentials • Security hygiene always matters
- 18. Hardening (Cloud Security Controls) • Don’t use root account (Delete or Disable Access Keys) • Policy measures should be in place that Admin’s don’t create Access Keys for root account • Use Multi Factor Authentication for all IAM accounts • Google Authenticator,Yubikey, etc. • Use IAM Policies • https://threatresponse.cloud/blog/2016/tips_for_least_privilege_iam_policies.html • Strong Password Policies
- 19. Logging & Monitoring • Use Free and Open Source Logging and Alerting tools such as ELK Stack • Set up Automated Infrastructure Monitoring and Defense in Cloud • Ref: https://github.com/appsecco/nullblr-bachaav-aismd
- 20. Best Practices for Incident Response in the cloud • Create playbooks that prescribe standard procedures for responding to incidents. • Speaking of automation, many tasks can be automated, especially if they are repetitive and routine. • Foster situational awareness from both the historical and real-time points of view. • Analyse incidents and create a database to help determine the types of problems encountered, the skills needed to address the issue, the frequency of each type of incident, and other facts.
- 21. Some tools and services.. • Auditing for Hardening Best Practices • Prowler • Cloud Custodian • Security Monkey • IAM User / Policy Auditing • Access Advisor • Use CloudTrail Logs • Digital Forensics Framework
- 22. Some Recent Issues • Accenture Insecure Cloud Storage: https://www.upguard.com/breaches/cloud-leak-accenture • TimeWarner Cable Insecure Config: https://www.theregister.co.uk/2017/09/05/twc_loses_4m_customer_records /
- 23. Conclusions • Security in the cloud is really not very different from regular security • Same principles and processes apply • Same tools and techniques apply • IT folks need to simply understand what is the best way to get the same thing done
- 24. Resources • https://downloads.cloudsecurityalliance.org/assets/research/security- guidance/csaguide.v3.0.pdf • http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-risk- assessment/at_download/fullReport • https://benchmarks.cisecurity.org/downloads/latest/ • https://www.slideshare.net/akashm/security-in-the-cloud-workshop-hstc-2014 • Video ofVishwa Bandhu https://www.youtube.com/watch?v=ApQlMm39xr0
- 25. Contact Twitter https://twitter.com/InfosecVandana Linkedin https://www.linkedin.com/in/vandana-verma/ Email [email protected]
- 26. Thank you!