Cloud security alliance
Download 0.94 Mb.
|
Web Application FirewallThe Web Application Firewall service will provide application layer protection for web servers from known attacks via signature based detection, along with some protection from unknown web based application attacks via heuristic detection techniques. Examples of the types of attack these firewalls can prevent are the web application vulnerabilities listed by organizations such as SANs and OWASP with their constantly evolving list of top 10 attacks. Following the principle of ‘defense in depth’, web application firewalling services should be deployed in addition to the traditional boundary firewalls that provide connection state based network protection. Secure Time and DNSTime synchronization is vitally important to your organization. From a security perspective, effective prosecution of security incidents requires accurate matching of timestamps on all log files. Any discrepancies will complicate and delay incident response. There also is a reasonably large body of security software which requires accurate time information to work effectively. If you are a software development organization, correct time information across your NFS servers and clients can make or break your development-- particularly if you use a parallel/distributed build product. The CSP must provide accurate, cloud-wide time synchronization to ensure the security of your organization, both in terms of internal analysis of security data from event logs and other information sources, and when you wish to prosecute computer crime cases. CSPs need to support NTP across their entire cloud. When deploying network security solutions from the cloud to the on-premises network, it is also important to ensure time is synchronized between the CSP’s systems and the customer’s, to enable investigation and log correlation across the customer’s entire environment (cloud and non-cloud).
Network Routing and IP ManagementNetwork routing is one of the most common attack vectors, as everyone uses standard routing protocols such as BGP and OSPF. These protocols can be fairly easily manipulated, and traffic then can be diverted and inspected. The recommended approach to limit the risk is to manage the IP space and access methods. TLS/SSL or IPSec VPN with IP whitelisting is the preferred access and IP management method for protecting traffic and data in the network of the CSP, or before entering the CSP network. Ensure that the CSP uses secure implementations for any of its routing devices that are publicly accessible, including permitting them to connect to and receive update suggestions only from trusted routers, and implementing secure update policies. DDOS Protection/MitigationA Denial of Service (DoS) attack is an explicit attempt by attackers to prevent legitimate users from using that service. Examples include attempts to: Flood a network Use all available processing power or resources (e.g., memory) on the end system Disrupt connections, preventing access to a service or disrupting functionality of the service Prevent a particular individual from accessing a service Focusing on network security, the most prominent form of a DoS attack is probably the Distributed Denial of Service (DDoS), which in the past had been a volume based attack, utilizing thousands of compromised hosts sending malicious traffic to the target either to exhaust networking resources or those of the servers hosting the application. These attacks typically involve (sometimes secretly) installed software on a master computer and a collection of compromised zombie computers (bigger bot networks may utilize many control servers to improve their resilience to being taken down). The attacker hides its true identity and location by using these zombie machines to launch the attack. The attack results in denial of service to legitimate users because their infrastructure is overwhelmed with illegitimate requests. Areas vulnerable to attack include: Routers Firewalls Web Servers DNS Servers Mail Servers Voice Over IP (VoIP) gateways Indirect Victims: elements that share the victims’ network (for example, other VMs in a Cloud environment) The following diagram outlines the primary areas on a network that are vulnerable to DDoS Attacks. 
Directory: wp-content -> uploads -> 2012 2012 -> The Case Against the nypd’s Quota-Driven ‘Broken Windows’ Policing What Is It? 2012 -> Aa and na members Dying from Tobacco 2012 -> [Baby Crying] 01: 04 [Ching 2012 -> Unit Name / Nom de l’unité uic / ciu dates 2012 -> What We Owe Jehovah’s Witnesses 2012 -> Oceans Challenge Badge 2012 -> Canadian cycling olympians 2012 -> Greg landry, june olkowski and tom lysiak 2012 -> William goldman 2012 -> Does translocation and restocking confer any benefit to the European eel population? A review Download 0.94 Mb. Share with your friends:
|