SECURITY ISSUES IN NaaS

Kanchan A. Desai#
#

Department of MCA, G. H. Raisoni Institute of Information Technology, Jalgaon 1 kanchandesai19@gmail.com

ABSTRACT
This paper discusses about what is cloud? Types of cloud, Services provided by cloud, various formations of cloud, service models of cloudSaaS, DaaS, IaaS, NaaS, IPMaaS, PaaS. This paper tried to highlight security Issues in Network as a Cloud (NaaS). We have focus on challenges faced by owners, vendors and customers, tenants in virtualized networks and suggested some remedial solutions and best virtual practices considering networks, databases, operating systems, virtualization, resource scheduling, transaction management, load balancing, concurrency control and memory management to overcome these challenges. These existing and fore coming challenges and remedial solutions are bounded upon the NaaS service model. Our goal is to provide a threat identification deliverable that can be quickly updated to reflect the dynamics of Cloud Computing and its rapidly evolving threat environment.

KEYWORDS:
Security in Naas, APIs, Malicious Insiders, Vulnerabilities, Data Leakage, Multi-Tenancy, Data Mobility & Control

1.

WHAT IS CLOUD?

A cloud is a pool of virtualized computer resources. A cloud can: 1. Host a variety of different workloads, including batch-style back-end jobs and interactive, user-facing applications 2. Allow workloads to be deployed and scaled-out quickly through the rapid provisioning of virtual machines or physical machines 3. Support redundant, self-recovering, highly scalable programming models that allow workloads to recover from many unavoidable hardware/software failures 4. Monitor resource use in real time to enable rebalancing of allocations when needed [1] Cloud computing environments support grid computing by quickly providing physical and virtual servers on which the grid applications can run. Clouds also support nongrid environments, such as a three-tier Web architecture running standard or Web 2.0 applications. A cloud is more than a collection of computer resources because a cloud provides a mechanism to manage those resources. Management includes provisioning, change requests, reimaging, workload rebalancing, deprovisioning, and monitoring. What are the pros and cons of "in-the-cloud" network security services? Can you provide some examples of these services? The term "in the cloud" refers to outsourced managed security services run by external providers or managed security service providers (MSSPs). These services are identified as such because most network diagrams use a picture of a cloud to represent anything beyond a company's perimeter router, such as the diagram below:

Figure 1 Services offered in the cloud range from managed firewalls to intrusion detection/prevention services (IDS/IPS) to antispam/antivirus filtering. Jerry Archer, senior vice president and CSO at Sallie Mae. With some estimating that cloud computing can cut IT costs by 85%. Several different configurations of cloud computing and its deployment models exist to serve the enterprises needs. Each approach offers its own strengths, risks, and level of control it provides the cloud consumer.

1.8 CLOUD SERVICE MODELS

Saas - SOFTWARE AS A SERVICE Software as a Service (SaaS) is capability for a consumer to use the providers applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities. E.g. online tax filing and Network-hosted application. PaaS - PLATFORM AS A SERVICE Platform as a Service (PaaS) provides the cloud consumer with the capability to deploy applications onto the cloud platform using programming languages and tools that are supported by the cloud provider. The cloud consumer does not manage or control the underlying cloud infrastructure. However, the cloud consumer can control the deployed applications and possibly the application hosting environment configurations. Microsoft Azure, Google App and Network-hosted software development platform engine are examples of PaaS. IaaS - INFRASTRUCTURE AS A SERVICE Infrastructure as a Service (IaaS) gives the cloud user the most control of the three types of clouds. The cloud consumer has the ability to provision processing, storage, networks, and other fundamental computing resources, where the consumer is able to deploy and run arbitrary software such as operating systems and applications. However businesses using the IaaS cloud service model are typically

responsible for securing their own virtual machines and the applications and data that reside on them. Amazon EC2 or vCloud are examples of IaaS. DaaS Data as a Service Data as a service answers Customer queries against providers database. DaaS can empower your business, or help you develop great web apps quickly and easily but these opinions seem to be held mostly by academics. The vendors who are leading the charge for this kind of functionality data on tap as and when you need it, priced affordably are calling it DaaS, and they offer the service so they make the rules. IPMaaS Identity and Policy Management as a Service Provider manages identity and/or access control policy for customer. NaaS Network as a Service In cloud users (tenants) have only limited visibility and control over network resources. Even for simple tasks, tenants must resort to inefficient overlay networks. Since NaaS offers a framework that integrates current cloud computing offerings with direct, yet secure, tenant access to the network infrastructure. NaaS Provider offers virtualized networks (e.g. VPNs) and tenants can easily deploy custom routing and multicast protocols [9].

2.

SECURITY IN CLOUD

There are numerous security issues for cloud computing as it encompasses many technologies including networks, databases, operating systems, virtualization, resource scheduling, transaction management, load balancing, concurrency control and memory management. Therefore, security issues for many of these systems and technologies are applicable to cloud computing. For example, the network that interconnects the systems in a cloud has to be secure. Furthermore, virtualization paradigm in cloud computing results in several security concerns. For example, mapping the virtual machines to the physical machines has to be carried out securely. Data security involves encrypting the data as well as ensuring that appropriate policies are enforced for data sharing. In addition, resource allocation and memory management algorithms have to be secure. Security in Network is often as good as or better than under traditional systems, in part because providers are able to devote resources to solving security issues that many customers cannot afford. Providers typically log accesses, but accessing the audit logs themselves can be difficult or impossible. Furthermore, the complexity of security is greatly increased when data is distributed over a wider area and / or number of devices. Our goal is to provide a threat identification deliverable that can be quickly updated to reflect the dynamics of Cloud Computing and its rapidly evolving threat environment. 1. Insecure Application Programming Interfaces 2. Malicious Insiders 3. Shared Technology Vulnerabilities 4. Data Loss/Leakage 5. Multi-Tenancy 6. Data Mobility And Control 7. Data Remanence 8. Data Privacy Selecting appropriate security controls and otherwise deploying scarce security resources optimally require a correct reading of the threat environment. For example, to the extent Insecure APIs is seen as a top threat, a customers project to deploy custom line-of-business applications using PaaS (Platform as a Service). Careful attention to application security domain guidance, such as robust software development lifecycle (SDLC) practices must be given. Similarly Shared Technology Vulnerabilities is seen as a top threat, customers must pay careful attention to the virtualization domain best practices, in order to protect assets commingled in shared environments. Homomorphic encryption is one of the many solutions that will support cloud computing. 3.1 INSECURE APPLICATION PROGRAMMING INTERFACES Cloud providers expose a set of software interfaces or APIs that customers use to manage and interact with cloud services. Provisioning, management, orchestration, and monitoring are all performed using these interfaces. The security and availability of general cloud services is dependent upon the security of these basic APIs. From authentication and access control to encryption and activity monitoring, these interfaces must be designed to protect against both accidental and malicious attempts to circumvent policy. Furthermore, organizations and third parties often build upon these interfaces to offer value-added services to their customers. This introduces the complexity of the new layered API; it also increases risk, as organizations may be required to relinquish their credentials to third parties in order to enable their agency. Examples Anonymous access and/or reusable tokens or passwords, clear-text authentication or transmission of content, inflexible access controls or improper authorizations, limited monitoring and logging capabilities, unknown service or API dependencies. Remedies 1. Analyze the security model of cloud provider interfaces. 2. Ensure strong authentication and access controls are implemented in concert with encrypted transmission. 3. Understand the dependency chain associated with the API. 3.2 MALICIOUS INSIDERS The threat of a malicious insider is well-known to most organizations. This threat is amplified for consumers of cloud services by the convergence of IT services and customers under a single management domain, combined with a general lack of transparency into provider process and procedure. For example, a provider may not reveal how it grants employees access to physical and virtual assets, how it monitors these employees, or how it analyzes and reports on policy compliance. To complicate matters, there is often little or no visibility into the hiring standards and practices for cloud employees. This kind of situation clearly creates an attractive opportunity for an adversary ranging from the hobbyist hacker, to organized crime, to corporate espionage, or even nation-state sponsored intrusion. The level of access granted could enable such an adversary to harvest confidential data or gain complete control over the cloud services with little or no risk of detection. Remedies 1. Enforce strict supply chain management and conduct a comprehensive supplier assessment. 2. Specify human resource requirements as part of legal contracts.

3. 4.

Require transparency into overall information security and management practices, as well as compliance reporting. Determine security breach notification processes.

3.3 SHARED TECHNOLOGY VULNERABILITIES Shared technology inside Cloud Computing environments like Disk partitions, CPU caches, GPUs, and other elements were never designed for strong compartmentalization. As a result, attackers focus on how to impact the operations of other cloud customers, and how to gain unauthorized access to data. IaaS vendors deliver their services in a scalable way by sharing infrastructure. Often, the underlying components that make up this infrastructure (e.g., CPU caches, GPUs, etc.) were not designed to offer strong isolation properties for a multi-tenant architecture. To address this gap, a virtualization hypervisor mediates access between guest operating systems and the physical compute resources. Still, even hypervisors have exhibited flaws that have enabled guest operating systems to gain inappropriate levels of control or influence on the underlying platform. A defense in depth strategy is recommended, and should include compute, storage, and network security enforcement and monitoring. Strong compartmentalization should be employed to ensure that individual customers do not impact the operations of other tenants running on the same cloud provider. Customers should not have access to any other tenants actual or residual data, network traffic, etc. Examples 1. Joanna Rutkowskas Red and Blue Pill exploits 2. Kortchinksys CloudBurst presentations. Remedies 1. Implement security best practices for installation/configuration. 2. Monitor environment for unauthorized changes/activity. 3. Promote strong authentication and access control for administrative access and operations. 4. Enforce service level agreements for patching and vulnerability Remedies. 5. Conduct vulnerability scanning and configuration audits. 3.4 DATA LOSS/LEAKAGE Data loss or leakage can have a devastating impact on a business. Beyond the damage to ones brand and reputation, a loss could significantly impact employee, partner, and customer morale and trust. Loss of core intellectual property could have competitive and financial implications. Worse still, depending upon the data that is lost or leaked, there might be compliance violations and legal ramifications. There are many ways to compromise data. Deletion or alteration of records without a backup of the original content is an obvious example. Unlinking a record from a larger context may render it unrecoverable, as can storage on unreliable media. Loss of an encoding key may result in effective destruction. Finally, unauthorized parties must be prevented from gaining access to sensitive data. The threat of data compromise increases in the cloud, due to the number of interactions between risks and challenges which are either unique to cloud, or more dangerous because of the architectural or operational characteristics of the cloud environment. Examples Insufficient authentication, authorization, and audit (AAA) controls; inconsistent use of encryption and software keys; operational failures; persistence and remanence challenges: disposal challenges; risk of association; jurisdiction and political issues; data center reliability; and disaster recovery. Remedies 1. Implement strong API access control. 2. Encrypt and protect integrity of data in transit. 3. Analyzes data protection at both design and run time. 4. Implement strong key generation, storage and management, and destruction practices. 5. Demand providers wipe persistent media before it is released into the pool. 6. Specify provider backup and retention strategies. 3.5 MULTI-TENANCY Cloud computing users share physical resources with others through common software virtualization layers. These shared environments introduce unique risks into a users resource stack. For example, the cloud consumer is completely unaware of a neighbors identity, security profile or intentions. The virtual machine running next to the consumers environment could be malicious, looking to attack the other hypervisor tenants or sniff communications moving throughout the system. Because the cloud consumers data sits on common storage hardware, it could become compromised through lax access management or malicious attack. Examples In a joint paper published in November 2009 by MIT and UCSD entitled Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds, the authors exhibited the possibility of a side-channel attack in a cloud environment in which an attacker would be able to implant some arbitrary code into a neighbors VM environment with little to no chance of detection. In another scenario, a security bulletin from Amazon Web Services reported that the Zeus Botnet was able to install and successfully run a command and control infrastructure in the cloud environment. Remedies Visibility, reporting and Auditing: SecureCloud accommodates the frequent need to view system configuration settings by providing a full audit trail of key approvals occurring on the management server. SecureCloud also offers detailed logging and reporting for any actions performed within the system and any key approvals. All events and changes, whether they come from an administrator or the system itself, are logged and can be called upon for a full detailed audit trail. 3.6 DATA MOBILITY AND CONTROL Moving data from static physical servers onto virtual volumes makes it remarkably mobile, and data stored in the cloud can live anywhere in the virtual world. Storage administrators can easily reassign or replicate users information across data centers to facilitate server maintenance, HA/DR or capacity planning, with little or no service interruption or notice to data owners. This creates a number of legal complications for cloud users. Remedies 1. Legislation like the EU Privacy Act forbids data processing or storage of residents data within foreign data centers.

2. 3.

Careful controls must be applied to data in cloud computing environments to ensure cloud providers do not inadvertently break these rules by migrating geographically sensitive information across political boundaries. Legislation such as the US Patriot Act allows federal agencies to present vendors with subpoenas and seize data (which can include trade secrets and sensitive electronic conversations) without informing or gaining data owners consent.

3.7 DATA REMANENCE Although the recycling of storage resources is common practice in the cloud, no clear standard exists on how cloud service providers should recycle memory or disk space. In many cases, vacated hardware is simply re-purposed with little regard to secure hardware repurposing. The risk of a cloud tenant being able to gather pieces of the previous tenants data is high when resources are not securely recycled. Resolving the issue can frequently consume considerable negotiating time while establishing service agreements between an enterprise and a cloud service provider. Remedies 1. Secure key management 2. Granular control: SecureClouds unique policy-based approach to key management and data access allows users to determine exactly which server gets access to secure data. 3. Custody of encryption keys: Secure cloud (Secure clouds on-premise solution) helps users control data access with the option of isolating the physical storage of keys away from the cloud infrastructure provider. This stops infrastructure administrators from accessing data/keys and gives customers the freedom to move data from one provider to another without the fear of vendor lock-in. 3.8 DATA PRIVACY The public nature of cloud computing in networks poses significant implications to data privacy and confidentiality. Cloud data is often stored in plain text, and few companies have an absolute understanding of the sensitivity levels their data stores hold. Data breaches are embarrassing and costly. In fact, a recent report by the Cloud Security Alliance lists data loss and leakage as one of top security concerns in the cloud. Recent laws, regulations and compliance frameworks compound the risks; offending companies can be held responsible for the loss of sensitive data and may face heavy fines over data breaches. Sensitive data stored within cloud environments must be safeguarded to protect its owners [3]. Examples Business impacts aside, loose data security practices also harm on a personal level. Lost or stolen medical records. Credit card numbers or bank information may cause emotional and financial ruin, the repercussions of which could take years to repair. Remedies 1. Security that travels with data 2. SecureClouds patented key-management technology combined with industry standard encryption allows businesses to control access to sensitive data stores and operate safely in public, private and hybrid clouds. 3. Simple agent installed on the virtual machine image, SecureCloud is able to ensure that data in the cloud environment is tamper proof, protected through encryption at the kernel level. Communication between the agent and SecureCloud management server is secure, thus avoiding the risk of any man-in the- middle attacks to gain access to the encryption keys 4. SecureCloud uses VM-level encryption, which provides the ability to encrypt data in the working storage, while using different keys for each cloud consumers information.

CONCLUSION

As enterprises make plans to deploy applications in private and public cloud environments, new security challenges need to be addressed. Optimal cloud security practices should include encryption of sensitive data used by cloud-based virtual machines; centralized key management that allows the user (and not the cloud provider) to control cloud data; and ensuring that cloud data is accessible according to established enterprise policies. To address the security threats and issues relevant to cloud computing and virtualization, this paper outlines recommended security best practices in virtual and cloud environments. For virtualized environments, private clouds, portions of hybrid clouds, and public Infrastructure as a Service (IaaS) deployments, the enterprise, not the service provider, needs to assume responsibility for security.

5
1. 2. 3. 4. 5. 6. 7. 8. 9.

REFERENCES
Cloud Computing: Greg Boss, Padma Malladi, Dennis Quan, Linda Legregni,Harold Hall, for High Performance On Demand Solutions (HiPODS) Cloud Computing: Finding the Silver Lining Steve Hanna, Juniper Networks Security Guidance for Critical Areas of Focus in Cloud Computing V2.1 Prepared by the Cloud Security Alliance December 2009 Security Issues for Cloud Computing Kevin Hamlen, The University of Texas at Dallas, USA Murat Kantarcioglu, The University of Texas at Dallas, USA Latifur Khan, The University of Texas at Dallas, USA Bhavani Thuraisingham, The University of Texas at Dallas, USA. Virtualization and Cloud Computing: Security Best Practices CloudNaaS: A Cloud Networking Platform for Enterprise Applications By Theophilus Benson, Aditya Akella-University of Wisconsin Madison, Anees Shaikh, Sambit Sahu- IBM TJ Watson Research Center Addressing Data Security Challenges in the Cloud: The Need for Cloud Computing Security Cloud computing: Challenges and future directions Kim-Kwang Raymond Choo NaaS: Network-as-a-Service in the Cloud - Paolo Costa Matteo Migliavacca_ Peter Pietzuch Alexander L. Wolf