Cloud Security Myths with Vandana Verma

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we're going back to the Secure Guild 2019 vaults to have a discussion around cloud security and the myths around it with Vandana Verma. So this is a session that Vandana recorded for the Secure Guild online conference, dedicated 100% to security testing that took place last year, May 20th to the 21st. If you don't know, you can actually get all the recordings for that event. Still, if you head on over to guild conferences.com, click on our events and then click Secure Guild 2019. And if you use the discount code podguildcoin25, you'll get 25% off the already discounted price for that event. So it's almost like a mock interview where I'm going to ask my questions and I'm going to edit in Vandana's answers to those questions. So it feels more like an interview rather than a session that she did for the event. There's a lot of great stuff here if you don't know. Vandana is an experienced security practitioner, but I think over like 13 years of experience and she is awesome. She speaks at a lot of different events and contributes a lot to owasp, so you don't want to miss this episode. Check it out.

It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you could start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security.

Hey Vandana, welcome to the Guild. Before we get into it, could you just tell us a little bit more about yourself?

Hi, I'm Vandana and I'm working as a security architect with one of the MNCs and I'm also working with certain communities to share knowledge on security and also to bring more women or diversity and inclusion in security. So I am one of the chapter leaders for OWASP Bangalore. OWASP is an open community for web application security standards. And I'm Also working with Mr. Owasp has a project called Women in AppSec. I'm their Asia lead and I am also running a community in India that's called Infosec Girls. I'm heading that and trying to spread the arms around the region so that we have a greater space for women in security.

Awesome. So Vandana, before we dive in, why do you think cloud security is so important? Why did you choose this topic to talk about?

Today I will be walking you through cloud security and their misconceptions and myths around it. And myths can be positive and negative. So positive in a way therein wherein people are sticking or the organizations are sticking to cloud because they think that this suits them best and they cannot do something else. And negative in a way wherein they're trying to be away from the cloud providers or cloud environment in general, or they think that my data is not secure in the cloud. So we'll just be walking you through with it and then we'll be talking about certain ground realities in the cloud.

So Vandana, what are some of the basics someone should know about the cloud and cloud security?

So when I started off or when I started hearing about cloud or cloud computing, this was my assumptions that am I going to be throwing balloon in the air or what it is going to be, how it's going to be looking like. So I started reading and I started researching about it. Then I got to know that there are multiple vendors who help you in hosting your data so that you do not have to procure the hardware and you don't have to do much of a headache. You don't have to take much of a headache, but they will help you in bringing up the servers. Help in scalability.

So is that the common intro people usually have about cloud and cloud security?

So this is a usual intro wherein you have cloud computing services, you take help from the cloud providers through servers, storage, database, you host your software and people leverage the services from you over the cloud. And there are different models available wherein there's a private cloud, public cloud, and there's a hybrid model wherein you have some data in house and then some data you have it on the cloud. So you just build services so that you can have connections back to your internal servers because you might not want to have everything shifted to the cloud. Or you think that I'm abiding by certain laws or certain.

Restrictions which I cannot go ahead and move to the cloud.

So are the different models or service models people need to be aware of with cloud services.

So there are different service models in the cloud which is infrastructure as a service, platform as a service and then you have software as a service and so on.

Now when we talk about these service model, let's take a look at the traditional model that we have currently which is an on premise model wherein if you consider it as a pizza, that will translate. Wherein you would be doing everything yourself. Buying the ingredients.

Arranging the table, cooking it, everything that you would be doing your on your own. You cannot rely on anyone else. Anything goes down, you would be responsible for it. So there's somewhere I read a great thing like it's milking your own cow, milking your own cows and kneading your own dose. So you have to do everything on yourself. Now. Now another thing would be wherein you take bake, wherein you go and get the frozen pizza, heat it up and just eat it. Wherein you have infrastructure as a service. You don't need to buy any hardware, you are taking the infrastructure from the cloud provider. So infrastructure as a service usually means that you, you have a vendor that takes care of the hardware which is running the content management server, making sure the server storage, load balancers, network and what all we have at peak performances that is in place for you. Apart from that there are other models wherein when we say platform as a service, you don't even have to manage the underlying operating hardware or a software. So when we take an example in the pizza world. So I really like this concept of pizza as a service. So that's why I'm just trying to explain it in that way. In the pizza world all you need to do is set the table because the pie will be delivered to you ready to eat, just set the table and they will be giving it to you. The only thing you would need to do or you need to be concerned about is the content management system itself. The infrastructure and the platform would be taken care by the vendor. And finally we end up with a software as a service wherein we have been using the softwares and the services on the cloud. You just have to maintain the credentials. That's about it. But that's again a big thing. Wherein you are, you don't have to manage or worry about patches, security and maintenance upgrades. The team would be taking care of, the cloud service provider would be taking care of that.

So what are some basic cloud vendors that you recommend or that are popular now?

These are some common public cloud vendors that we have. We have IBM Cloud, Amazon Web Services, Microsoft Zurich, Google Cloud, platform or GCP and there are many others which are there in the market. So these are the top ones which I could just pick up and.

Post it here. And we have Alibaba, Red Hat and then so on.

All right, Vandana, let's get into the meat of it. So what are some of the common security myths you've heard about when using cloud vendors or reasons why not to use a cloud vendor?

So let's go for the general myth which are as part of the security we have. So one of the biggest misconception that you hear about the cloud is data is safer within the four walls of organization than in the hands of a cloud security provider or cloud service provider. But in reality there have been no evidence, there have been actually no evidence that actually indicates that cloud service providers have performed less securely than the end user organization. So there's also a research firm which has published a security report which is Gartner. The recent history of public cloud was demonstrated that the brand name extremely provisioned multi tenant services are not only susceptible to attack, but are also more secure starting point than the more traditional in house implementation. And also now when we talk about another cloud security myth or cloud computing myth wherein a cloud server has unlimited resources. It does. But again it may appear that your cloud server has unlimited memory and processing power, but consuming more than you need or allocating more than you need would actually raise the price. So you are increasing the price yourself than somebody else doing it.

I think one thing a lot of people are afraid of is if they use a cloud vendor, especially if something's not on premises, that their solution is going to be compromised or it's more susceptible to being breached.

Cloud would be susceptible to breach. But there is a remodel that is there which cloud providers specifically say that it's a shared responsibility model wherein few things cloud service provider would do for sure. But how about responsibility of the organization? They are posting the data on the cloud, they are keeping the data on the cloud. Cloud provider would be taking care of the encryption and making sure that your infrastructure is safe. They are going through the rigorous test without going those rigorous tests or the audits or those compliance check. Cloud provider cannot open up their services to the to the whole world. So they have to go through the rigorous test then only they do it. But an organization also has to make sure that they are taking care of that shared security model. So it's actually a flip side wherein if I trust the cloud to be secure, once I set up my cloud, I'm done. I don't have to do anything. I have heard, I have seen people saying that, but there's a catch here, of course, that the cloud is secure, the cloud provider, but the cloud provider is only responsible for securing their infrastructure. You are responsible for your data and the application stored on that infrastructure. If there is a vulnerability in one of the platform that you are, or backend application that you are owning, which cloud provider has nothing to do, you have to patch that. They're not going to patch that. If there is a platform where you have hosted and you are supposed to take care of the platform, cloud provider cannot do anything. If the breach happens, you are totally responsible for it. They will ensure what they provide. You can go through the guidelines that they have given. When you are signing a contract, read through it properly. But what you put in the cloud or on the cloud is your responsibility. Cyber criminals are still targeting your applications and the stolen credentials. So you need to have, you need to have the ability to identify the threats and control who's accessing the information.

You have. I'll give you an example. You have a house with multiple doors and windows. Even perhaps alarm. You have the tools, but you still have to lock the doors. You can't say that I have locked all my doors, but the windows are open and nobody can come inside my house. So you have to close the windows, set the alarm. You have to practice good cybersecurity, good cybersecurity hygiene. The cloud is no more secure than you make it. So you have to make sure you work on that practice. Another good misconception or.

Another myth is that you can no way figure out who has access to your data. It's actually you can do it when you have proper groups, proper users, proper policies assigned. If you have a proper hierarchy set, you're not letting the people use or your teams use, the root accounts or the master account, but creating the groups, understanding who needs what access and assigning the right policies to it, assigning the right set of rules to it, and then adding those users to it. Then you are creating your own hierarchy. You know who's doing what and if something happens, you would be able to figure out who did it where actually the lag was. Now, apart from that, as we discussed, there is a less control over data. That's not the thing. They will actually give you the required set of accesses and required set of information that you actually need for the cloud. So now they have all the cloud providers. I've seen that they keep on giving you services so that you can monitor. So those services are free of cost. Lot of services are free of cost for you to monitor your own data on your own services. Whether any kind, any kind of breaches, somebody's trying to breach your system or somebody is trying to sniff your credentials. There are many services which are there, but you have to leverage, you have to take care of your own accounts. You can't say that my account is secure if I have a six digit password. There are people who are still practicing that. You need to have proper implementation configuration in place when you are using because the infrastructure is there but the security is in your hands. Another important thing is that a cloud is there, but there can be human error. So accidents can happen. The recent breaches or the data breaches that have happened. The research have shown that 34% of the data lost in the first half of 2018 through breaches were caused by the accidental losses. That means, oops, someone left the data exposed and open to breach. Third parties do increase your risk. And if I say that what about the third parties who access your data day in and day out? You have the integration with them, but you just forget about that. Even there's a password management company. They announced early last year that they exposed a file with 2.4 million names, password hints and encrypted passwords on an unprotected server. Even later in January another astounding breach was announced related to the credential theft. So you have to take care of your own credentials. You can't leave the SSH keys on the GitHub. It's like telling the world go access my system. There was one more recent breach I heard wherein somebody left the Slack keys on the GitHub and while doing osint people found out and then they reported to the company through a responsible disclosure so that the company can get to know and without any further delay they fix that. And then they evaluated. They found out that was actual keys of their slack where developers were working and they fixed it. We have to be very cautious when we are dealing with such data. Another thing is that maintenance of security in the cloud is difficult. I would say it's not the case. If you know your environment better and what you're moving to cloud and what services you're going to be using, what securities around that services are there, then you are not in a fit. You can take care of your environment better in the cloud as well.

But aren't multi tenant systems normally less secure or is that a myth?

That's not the case. Multi tenant secure systems, there's actually no Absolute in cloud security. So multi tenant systems offer two security benefits over single tenant system, wherein they provide an additional layer of content protection and they ensure that security patches are always up to date. Cloud hosted systems may provide hardware based and parameter security. Those who choose a multi tenant system get a third party protection called logical content isolation and designated to help prevent inside parameter attacks. So in that way you have a secure environment. You choose what you want and you choose what you actually are looking forward. Another misconception, I should say that people say that security slow down the performance in the cloud. So it's about protecting your own credentials. The simplest solution I would say would seem to be encrypt everything. Now if you encrypt everything and you're trying to fetch the data on a daily basis, obviously your system will slow down. So you have to think, you have to prioritize, you have to categorize your own information. What is secure, what is, what is confidential, what is critical and what, what is not at all. What is public. If there's something public and you don't need to hide it, you don't need to encrypt that. So you have to categorize your own information. Now we've talked about the general myth, but how about the myth which CEOs developers or even CISOs might have, right? Everyone has their own conceptions and sometimes they're not able to discuss also which they need to start talking about. And some are even coming up and asking questions and discussing it. So CEOs are actually charged with all the strategic planning and operations at their companies and it's actually a lot of responsibility. So they can be forgiven for mistakenly believing that they and.

There are capable people they put in charge of this IT security and doing the right things in the right place. So their security people are doing right thing at the right place, all of it. But how about the threats which just come from the inside or the people who are using your cloud services might not support? So there's a developer who is not supposed to push the code in the in the cloud, why that person needs needs the full access to the root account or even need an admin access. You can have their read only access or even give them the access to only the lower environment so you can segregate there. So there's another myth that that comes into picture that attackers can be stopped. Most computer defenses are so weak and ill advised that hackers and malware can actually break into that them at will, anytime. And that's only if the malicious intruders haven't already pawned the entire environment. So if you have a proper security configurations and mechanisms, we wouldn't say that you are 100% secure, but at least you're taking the best practices, all the cautions in place. You are well aware that this can be done and this shouldn't be done. Apart from that, CISOs, CISOs have their own myth that every time we talk to a company and they say that their data is too important to put in the cloud, we ask them.

We ask them lot of questions and specific questions would be that they're using HR or customer relationship management. Invariably the answer is either Workday or Salesforce or any other XYZ services. Now if you're using Office 365 or other software as a service platform or applications, they say yes, we explain that their data is more critical and they're using customer or their personal, their company organization there that's also a cloud service. So you can't say that.

That we are not using cloud at all. So some form you're using cloud cloud services. And we need to start shifting towards cloud security mindset. So that has to come up with.

A lot of discussions and a lot of thought thinking and moving the cloud. Moving, moving actually to the cloud requires an ability to understand and address a lot of considerations like data migration, the business specific capabilities of solutions, change management, governance, system integration alongside security. So.

You have to know your environment and all these myths will go away. You would be easy, comfortable in the cloud. There cannot be any rapid development and security in the cloud. But the reality is that the cloud is actually enabling a technology for DevSecOps because we've been talking or we are talking, this is the era of DevSecOps wherein everyone wants to have their systems automated, talk about development. They want to make sure that when they develop the port should be the code. When the code is ready, that should be pushed automatically to the test. And once the test is done, it should be automatically. When the test gets passed, it should be automatically passed to the production wherein we have imbibed security to it.

Now.

That happens through a lot of cloud services that we are using. So in some way or the other we are using the cloud services.

Is it harder when you have a cloud based solution that it's more difficult to monitor?

It is not difficult at all. You need to have the right set of integrations and the tools available and the technologies available and you can actually monitor all, all your data. And the cloud security reality is cloud security is everyone's responsibility or security is everyone's responsibility. All has to work together hand in hand to make sure the environment is safe. If something happens, we cannot blame the ciso, we cannot blame the security team, development team or anyone. It's everyone's responsibility. You have to come forward and talk about it, discuss it, understand your environment, and if you have any misunderstanding, misconception or question, just feel free to post on the forums, discuss with the people who are part of it, and your data in the cloud would be safe and sound.

Okay Vandana, before we go, what's the best way to find or contact you?

So if you have any questions around the same topic or you have some feedback or you want to discuss about something, you can reach me on infosec Vandana on Twitter and I am like you can search me on LinkedIn as well.

Thank you Vandana for your security testing awesomeness. For at least everything of value we covered in this episode. Head on over to testguild.coms21 and while you're there, make sure to click on the Try It Today link under the Exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. So that's it for this episode of the Test Guild Security Testing Podcast. I'm Joe and my mission is to help you succeed with creating end to end full stack testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.