Welcome!

@CloudExpo Authors: Liz McMillan, Karthick Viswanathan, Jason Bloomberg, Pat Romanski, Yeshim Deniz

Related Topics: @CloudExpo

@CloudExpo: Article

Strategies for Securing Enterprise-to-Cloud Communication

IaaS vendors and Enterprise consumers share responsibilities for enabling Cloud Security

The Cloud Security Alliance (CSA) published Version 2.1 of its Guidance for Critical Areas of Focus in Cloud Computing with a significant and comprehensive set of recommendations that enterprises should incorporate within their security best practices if they are to use cloud computing in a meaningful way.

The Guidance provides broad recommendations for operational security concerns including application security, encryption & key management, and identity & access management. In this article, we will consider security implications of REST- and SOAP-based communication between consumers and specifically, Infrastructure as a Service (IaaS) providers.

Cloud Application Security
Cloud application security requires looking at classic application security models and extending these models out to dynamic and multi-tenant architectures. While planning for cloud-based application security, DMZ-resident application security should be used as the starting point. DMZ-based security enforcement models should be extended to incorporate secure enterprise-to-cloud traffic management and operational control.  IaaS cloud providers design their management APIs to accommodate consumers with varying skill sets. Popular IaaS providers (Amazon EC2, Rackspace, Opsource, GoGrid) publish RESTful APIs for keeping a low threshold-of-difficulty to accommodate a broad set of consumers that lack sophisticated SOAP-based communication stacks but can easily consume XML/JSON using RESTful interaction. Amazon EC2, however, also provides a sophisticated WDSL for SOAP-based interaction. Although cloud providers have a greater responsibility of implementing extensive application security provisions while accommodating consumers of varying technical skills, cloud consumers also have to share the burden of risk mitigation by ensuring that their API calls into the cloud providers are secure and clean. The potential for a cascading effect in a shared, multi-tenant environment is high: a single poorly formed SOAP- or REST-based API request can cause a Denial of Service (DoS) attack potentially shutting down access to the cloud management APIs for many.

Implications for Cloud Consumers
Cloud consumers, for example enterprises, usually make outbound calls into an IaaS provider using a REST-based or a SOAP-based API for provisioning and managing server instances. Such standards-based API calls provide significant flexibility and ease for automating cloud resource management. However, this flexibility also opens the door to security risks that should be addressed. Here are a few operational recommendations, expanding on the CSA Guidance for Application Security, that cloud consumers should consider for lowering their risk profile while interacting with an IaaS:

  1. Enable Encryption: Cloud consumer should use SSL (HTTPS) for encrypting data-in-motion. When available, data-at-rest encryption (WS-Security) should also be used for invoking IaaS management services. Enabling content-level encryption for SOAP and REST responses ensures that only authorized consumer can decrypt responses with their private keys and use the API for managing their cloud images.
  2. Check Requests & Responses: Before invoking a REST- or SOAP-based call to an IaaS, consumers should determine whether the invocation is in the correct format and does not contain malware and that the request message integrity has not been compromised. The response from SOAP and REST-XML/JSON calls should also be scanned for malware and possible corruption before consumption by enterprise cloud management applications. Fortunately, structured data such as XML and SOAP provide the ability to check for message hygiene through a variety of ways starting with the simplest check: XSD Schema Validation. A schema, embedded in a WSDL file, provides constraints for message data types, structure, and content (through facets). Enforcing schema validation or simple deep-content validation through regular expression for REST calls ensures that the messages adhere to their required structure. Additional checks must be performed for malware that may be transmitted in a request or response to identify and quarantine infected messages. Such protective actions can prevent malware cascading through an enterprise or its IaaS provider.
  3. Enable Web services: For building a robust and secure framework for interacting with IaaS providers, SOAP-based interaction provides richness over RESTful XML/JSON. With SOAP use, enterprises can leverage their Public Key Infrastructure (PKI) and have full key life-cycle management including the ability to issue, sign, revoke and validate X.509 certificates being used in SOAP calls. By using key-pairs, enterprises have extensive control over authentication, message integrity and privacy while interacting with an IaaS. Using X.509 with GETs in a RESTful interaction is difficult and non-standard (other than for SSL mutual authentication that most IaaS providers do not support).

Implications for Cloud Providers
IaaS vendors usually provide a simple-to-use, web-based UI that enables user to manage cloud-based server images. This web-based interface is great to get up and running quickly, however, for enterprises that deploy numerous images, automated scripting for image management is essential. Most IaaS vendors provide REST, SOAP or Command Line scripting APIs for automating image management functions. Here are a few operational recommendations, expanding on the CSA Guidance for Application Security, that cloud providers should consider for lowering their risk profile:

  1. Provide standards-based flexibility: From the simplest of RESTful XML/JSON GETs to sophisticated signed SOAP requests with embedded X.509, IaaS providers have to address requirements from users with highly-varied technical skills. For large enterprise customers, IaaS vendors must provide strong authentication capabilities and rich SOAP-based interaction, whereas for smaller companies that may not have technical skill for handling a SOAP stack, simple RESTful interaction is usually preferred. Within simple, RESTful type interaction, there is a glaring lack of standardization on identity token use. Enterprises serious about using IaaS have to consider multi-cloud deployments for higher reliability. Standards-based identity tokens - perhaps OAuth for RESTful APIs and WS-X.509 for SOAP APIs - will provide a common management framework for enterprises to build redundancy through multi-cloud deployments.
  2. Enable comprehensive encryption: IaaS vendors must provide both data-in-motion security via protocols such as SSL and data-at-rest security through standards such as WS-Security for satisfying corporate security requirements. All IaaS vendors provide SSL-based encryption for invoking management APIs, however, content-level encryption for data-at-rest is not implement. IaaS providers such as Amazon EC2 support X.509 certificates for authentication and also provides WS-Signature capabilities for their SOAP-based API. Other IaaS vendors should provide such SOAP-based APIs along with more granular security controls. IaaS vendors should support SOAP APIs and provide granular encryption for XML/SOAP responses as an additional level of encryption control so that only enterprises with strict ownership and control of their private keys can view encrypted information within a XML/SOAP response.
  3. Perform comprehensive API testing: Before releasing a set cloud management calls to consumers, the APIs should be thoroughly tested across all exposed interaction formats, e.g., JSON/XML-REST and SOAP over HTTP(S).  The testing should be comprehensive and should cover four aspects of testing:  functional, performance, interoperability, and security.  Functional testing ensures that the cloud provisioning and management calls behave as expected and that no regression errors have been introduced.  Such functional testing has to cover all message types, identity tokens and security artifacts.  Performance testing can establish concurrency and throughput profiles for the APIs.  Interoperability testing ensures the APIs are consumable by the widest array of application platforms.  Adhering to WS-I Basic Profiles, for example, ensures that service description (WSDL) for the cloud management API can be used by .NET, Java, and LAMP environments with relative ease.  Finally, and perhaps, the most overlooked aspect of testing is a full penetration and security test for the IaaS management API that identifies REST, XML and SOAP-based vulnerabilities before the IaaS is exposed for public consumption. The multiplicative effect of a multi-tenant setting and multiple configuration APIs results is a dramatic expansion of the attack surface area. Identifying and remediating such risks through exhaustive penetration testing should be an essential component of IaaS providers Application Security operational plan.

Conclusions
Cloud application security requires extending risk planning and analysis beyond corporate boundaries. Enterprises that are already comfortable with deploying applications in the DMZ for deep integration with external trading partner have already laid the fo undations for interacting securely with IaaS cloud providers. Such mature enterprises have already figured out how to invoke external APIs via XML/SOAP, manage their identity tokens, encrypt communication and monitor traffic. Utilizing IaaS provider APIs and building a reliable multi-cloud application strategy requires extending their existing application infrastructure for centralized cloud management and control. Cloud providers, public and private, on-premise and off-premise have a higher burden of managing cloud application security than cloud service consumers. Cloud providers are required to balance security with flexibility. Greater security may discourage users with lower technical skills whereas enterprise customers may expect only the highest level of security. Cloud vendors should continue to focus on providing flexibility while extending security options available to users. They should also consider using standards-based identity tokens and work towards a standard management API that enables enterprises to build secure and reliable multi-cloud deployments.

References

  1. Guidance for Critical Areas of Focus in Cloud Computing
  2. Beginner's Guide to OAUTH
  3. Understanding WS-Security
  4. Pillars of SOA Testing

More Stories By Mamoon Yunus

Mamoon Yunus is an industry-honored CEO and visionary in Web Services-based technologies. As the founder of Forum Systems, he pioneered XML Security Gateways & Firewalls and was granted a patent for XML Gateway Appliances. He has spearheaded Forum's direction and strategy for eight generations of award-winning XML Security products. Prior to Forum Systems, Yunus was a Global Systems Engineer for webMethods (NASD: WEBM) where he developed XML-based business integration and architecture plans for Global 2000 companies such as GE, Pepsi, Siemens, and Mass Mutual. He has held various high-level executive positions at Informix (acquired by IBM) and Cambridge Technology Group.

He holds two Graduate Degrees in Engineering from MIT and a BSME from Georgia Institute of Technology. InfoWorld recognized Yunus as one of four "Up and coming CTOs to watch in 2004." He is a sought-after speaker at industry conferences such as RSA, Gartner, Web Services Edge, CSI, Network Interop, and Microsoft TechEd. Yunus has the distinction of showcasing Forum Systems' entrepreneurial leadership as a case study at the MIT Sloan School of Management. He has also been featured on CNBC as Terry Bradshaw's "Pick of the Week."

@CloudExpo Stories
yperConvergence came to market with the objective of being simple, flexible and to help drive down operating expenses. It reduced the footprint by bundling the compute/storage/network into one box. This brought a new set of challenges as the HyperConverged vendors are very focused on their own proprietary building blocks. If you want to scale in a certain way, let’s say you identified a need for more storage and want to add a device that is not sold by the HyperConverged vendor, forget about it....
SYS-CON Events announced today that Pulzze Systems will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Pulzze Systems Inc, provides the software product "The Interactor" that uniquely simplifies building IoT, Web and Smart Enterprise Solutions. It is a Silicon Valley startup funded by US government agencies, NSF and DHS to bring innovative solutions to market.
With Cloud Foundry you can easily deploy and use apps utilizing websocket technology, but not everybody realizes that scaling them out is not that trivial. In his session at 21st Cloud Expo, Roman Swoszowski, CTO and VP, Cloud Foundry Services, at Grape Up, will show you an example of how to deal with this issue. He will demonstrate a cloud-native Spring Boot app running in Cloud Foundry and communicating with clients over websocket protocol that can be easily scaled horizontally and coordinate...
SYS-CON Events announced today that Elastifile will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Elastifile Cloud File System (ECFS) is software-defined data infrastructure designed for seamless and efficient management of dynamic workloads across heterogeneous environments. Elastifile provides the architecture needed to optimize your hybrid cloud environment, by facilitating efficient...
For financial firms, the cloud is going to increasingly become a crucial part of dealing with customers over the next five years and beyond, particularly with the growing use and acceptance of virtual currencies. There are new data storage paradigms on the horizon that will deliver secure solutions for storing and moving sensitive financial data around the world without touching terrestrial networks. In his session at 20th Cloud Expo, Cliff Beek, President of Cloud Constellation Corporation, d...
Businesses and business units of all sizes can benefit from cloud computing, but many don't want the cost, performance and security concerns of public cloud nor the complexity of building their own private clouds. Today, some cloud vendors are using artificial intelligence (AI) to simplify cloud deployment and management. In his session at 20th Cloud Expo, Ajay Gulati, Co-founder and CEO of ZeroStack, discussed how AI can simplify cloud operations. He covered the following topics: why cloud mana...
As more and more companies are making the shift from on-premises to public cloud, the standard approach to DevOps is evolving. From encryption, compliance and regulations like GDPR, security in the cloud has become a hot topic. Many DevOps-focused companies have hired dedicated staff to fulfill these requirements, often creating further siloes, complexity and cost. This session aims to highlight existing DevOps cultural approaches, tooling and how security can be wrapped in every facet of the bu...
DevOps at Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to w...
SYS-CON Events announced today that CAST Software will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CAST was founded more than 25 years ago to make the invisible visible. Built around the idea that even the best analytics on the market still leave blind spots for technical teams looking to deliver better software and prevent outages, CAST provides the software intelligence that matter ...
SYS-CON Events announced today that Golden Gate University will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Since 1901, non-profit Golden Gate University (GGU) has been helping adults achieve their professional goals by providing high quality, practice-based undergraduate and graduate educational programs in law, taxation, business and related professions. Many of its courses are taug...
Recently, WebRTC has a lot of eyes from market. The use cases of WebRTC are expanding - video chat, online education, online health care etc. Not only for human-to-human communication, but also IoT use cases such as machine to human use cases can be seen recently. One of the typical use-case is remote camera monitoring. With WebRTC, people can have interoperability and flexibility for deploying monitoring service. However, the benefit of WebRTC for IoT is not only its convenience and interopera...
Translating agile methodology into real-world best practices within the modern software factory has driven widespread DevOps adoption, yet much work remains to expand workflows and tooling across the enterprise. As models evolve from pockets of experimentation into wholescale organizational reinvention, practitioners find themselves challenged to incorporate the culture and architecture necessary to support DevOps at scale.
Vulnerability management is vital for large companies that need to secure containers across thousands of hosts, but many struggle to understand how exposed they are when they discover a new high security vulnerability. In his session at 21st Cloud Expo, John Morello, CTO of Twistlock, will address this pressing concern by introducing the concept of the “Vulnerability Risk Tree API,” which brings all the data together in a simple REST endpoint, allowing companies to easily grasp the severity of t...
SYS-CON Events announced today that CA Technologies has been named “Platinum Sponsor” of SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business – from apparel to energy – is being rewritten by software. From planning to development to management to security, CA creates software that fuels transformation for companies in the applic...
When shopping for a new data processing platform for IoT solutions, many development teams want to be able to test-drive options before making a choice. Yet when evaluating an IoT solution, it’s simply not feasible to do so at scale with physical devices. Building a sensor simulator is the next best choice; however, generating a realistic simulation at very high TPS with ease of configurability is a formidable challenge. When dealing with multiple application or transport protocols, you would be...
In his session at 20th Cloud Expo, Scott Davis, CTO of Embotics, discussed how automation can provide the dynamic management required to cost-effectively deliver microservices and container solutions at scale. He also discussed how flexible automation is the key to effectively bridging and seamlessly coordinating both IT and developer needs for component orchestration across disparate clouds – an increasingly important requirement at today’s multi-cloud enterprise.
WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 6th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, P2P file sharing, and use cases that have already leveraged the power and convenience of WebRTC.
IT organizations are moving to the cloud in hopes to approve efficiency, increase agility and save money. Migrating workloads might seem like a simple task, but what many businesses don’t realize is that application migration criteria differs across organizations, making it difficult for architects to arrive at an accurate TCO number. In his session at 21st Cloud Expo, Joe Kinsella, CTO of CloudHealth Technologies, will offer a systematic approach to understanding the TCO of a cloud application...
An increasing number of companies are creating products that combine data with analytical capabilities. Running interactive queries on Big Data requires complex architectures to store and query data effectively, typically involving data streams, an choosing efficient file format/database and multiple independent systems that are tied together through custom-engineered pipelines. In his session at @BigDataExpo at @ThingsExpo, Tomer Levi, a senior software engineer at Intel’s Advanced Analytics ...
"With Digital Experience Monitoring what used to be a simple visit to a web page has exploded into app on phones, data from social media feeds, competitive benchmarking - these are all components that are only available because of some type of digital asset," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.