The enterprise should pay attention to the cloud stack security

Essentially, all cloud computing services consist of a "stack", this may include hardware assets (server memory, CPU, disk), virtualization technologies running on hardware, network formation (including physical and virtual), additional computing and programming software, mass storage and virtual machines (VMS), or application and software instances.

While this broad set of technologies opens up a world of opportunity in computing, companies must know that vulnerabilities can occur in the cloud stack because of the way in which these technologies interact and the features that are often shared among cloud computing customers. For example, in a multiuser system, applications and data are hosted in a public cloud or in a commercial cloud environment (like on the same physical platform), and the proper isolation, segmentation, and access control between virtual systems and data is essential.

In any hypervisor, you can host several VMs. In a private network or private cloud, internal fragmentation (or even physical separation on a different physical host) can be easily maintained. However, in a cloud environment, the internal security team does not have control over the infrastructure (public cloud and hybrid cloud deployment), and there is a risk that VMS and data from multiple organizations run on the same physical platform. In addition, monitoring of all activities in management and hypervisor is critical, and the attempt and tracking of other users ' VMS needs to be detected (or blocked) to prevent problems from occurring quickly.

To get a better understanding of cloud stack vulnerabilities, let's take a look at the various threats that might be exposed in different cloud models.

IaaS and PAAs threats

In the infrastructure, the service (IaaS) model, the entire VM can be hosted in a multi-tenant environment, which means that an attacker could create a malicious VM in the same environment. MIT researchers have revealed a way to locate specific physical cloud servers in the Amazon cloud, possibly in many other providers ' environments. This is a fairly innovative attack that allows attackers to pinpoint the physical servers they store through specific victim VM behavior attributes. With the information obtained, an attacker can upload and run a malicious VM, which can then be used to perform data theft attacks and other attacks.

A group of researchers exposed potential shared technology vulnerabilities in another IAAS model when demonstrating a viable "edge channel" attack against a VM running on the same hypervisor platform in November 2013. In this attack, the VM overflows the local hardware cache, causing the target VM to rewrite some data themselves. Based on the written data and how it is written, an attacker can identify information about the target VM, including the encryption keys used in isolation and other cryptographic functions. Although this type of attack may be difficult to implement in the Cloud, the demo shows how vulnerable the enterprise cloud computing multi-tenant environment is.

The platform as a service (PaaS) environment can run all the VMS together, but the customer has no control over their configuration, causing them to not be able to create separate VMS, and attackers can create malicious VMS in an IAAS environment. This also means that the PAAs model does not have a cloud stack vulnerability because other shared components incur risks, such as storage and APIs. In the case of APIs, data can be converted in unencrypted form or implemented in a defective authorization.

As for storage (some of which can affect all cloud models), the key risk is the lack of segregation between customer data. Researchers in the context of information security in April 2012 said they were able to download their own VM disk files from several cloud providers, after forensic analysis, to determine that other customers ' data was also present. Why? Because the provider is not able to isolate and clean storage space in a multi-tenant environment.

How to manage cloud stack risk

So how can companies confront the threat of shared technology? First, you must understand how many practical risks, including those mentioned above, and other risks. For example, "VM Escape" and hypervisor compromise scenarios are similar to the often-explored blue pill, but in real life these threats are less likely to occur. Similarly, the ability to implement side-channel attacks in coordination, environmental knowledge, and required skills is extremely extraordinary in order to obtain the encryption key for the shared storage cache, so such a threat may not occur in most cloud environments.

That said, companies must have appropriate precautions to ensure the security of the cloud stack. Encrypting sensitive data and VM components is a useful deterrent to many of these threats. Internally, the virtualization platform supports built-in segmentation and isolation, many of which are chip-level. In addition, network and managed access control can be implemented at both the physical and virtual network tiers, as well as within the VM itself. Hypervisor access control must also be taken into account, and attackers gain control of hypervisor or their management platform is also devastating.

The key to most businesses is to ask the cloud provider directly about their security practices, especially how to lock hypervisor or other layers on the stack. In addition, find the most appropriate access control, prevent malicious access, and thus manage and compile the application. For example, you should include user account and group management, password and multiple factor authentication policies and time, and more robust identification management tools and processes.