Get My Score

Blog

security automation framework

 

We’re excited to wrap up and announce our Winter 2019 release!

Customers will benefit from closed-loop security, which unlike siloed approaches to proactive and reactive security, assesses the impact of alerts related to new, deleted or changed resources from AWS CloudTrail and Google StackDriver Monitoring using CyberPosture scoring to prioritize infrastructure changes based on their risk. As part of closed loop GCP security, a Cavirin-developed Google Function watches Google StackDriver Monitoring for events related to the creation, deletion and changes to specific Google resource types. As these changes accumulate beyond a certain threshold, Cavirin triggers an assessment of your GCP account. This results in CyberPosture scores for affected resources which in turn helps create a remediation plan sorted based on improvement to security posture. A similar (alert -> threshold trips -> assess -> score) blueprint applies to AWS resources based on AWS Lambda Functions and AWS CloudTrail events.

Next, prioritized security gaps can be auto-remediated using AWS Lambda and Google Functions, as applicable. As the figure below shows, the remediation blueprint for Google comprises of a Google Function that watches for remediation requests from the Cavirin server on a GCP PubSub topic. As the Google Function remediates security gaps, the Cavirin server processes the remediation confirmations as another set of changes to your environment. As before, as changes accumulate beyond a threshold, an assessment is triggered, resulting in updated and improved CyberPosture scores. A similar remediation blueprint applies to AWS.

 

machine learning in cyber security

 

Extending closed loop security to operating systems resources, the Winter 2019 release also offers Ansible integration to streamline the hardening of operating systems powering compute instances. Cavirin periodically assesses all instances, checking for drift against a known baseline and recommending and carrying out remediation through Ansible to re-establish the instances’ golden posture. As the figure below shows, as we assess OS resources for policy packs like CIS and generate Ansible artifacts, in particular a variables file (list of failed policies to remediate) and a hosts file (list of Ansible-managed resources that require remediation), which when applied with the Ansible playbook for the given policy pack results in a return to the golden posture.

ai machine learning

Compliance and security professionals struggle with translating regulatory requirements and industry standards to automated technical controls – spreadsheets and manual mapping processes are the state of the art. While organizations like UCF have provided a universal/canonical representation of regulatory requirements, gaps still remain with respect to mapping requirements to technical controls with quantitative inputs that can drive risk scoring and security analytics.  Cavirin’s Winter 2019 release is the first to apply machine learning to recommend technical controls for industry standards (e.g. NIST 800-171) and regulatory frameworks (e.g HIPAA) with associated weights and severities which in turn drives the ability for customers to drive compliance based on risk, using Cavirin’s CyberPosture scores. Machine Learning ensures consistency of mapping and the resulting weights and severity. This further improves the efficacy of CyberPosture scoring and resulting remediation guidance.

 

cybersecurity through machine learning

Announced earlier, we now feed security findings for resources in a customer’s Google Cloud Platform into Google Cloud Security Command Center, which unifies security finds from a select group of Google Cloud partners. To leverage this feature, be sure to check out Cavirin Cloud SCC Companion and Cavirin CyberPosture Intelligence on the Google Cloud Marketplace!

deep learning for cybersecurity

Reporting enhancements: A new change reports feature offers the ability to compare the latest assessments against the previous one enabling users to quickly gauge the effectiveness of change management. A new reporting service for RSA-Archer permits management of Cavirin-reported compliance posture gaps through an organization’s existing GRC platform. 

Enhanced connectivity through Bastion and proxy hosts: Network segmentation and isolation are important best practices. With the Winter release, customers can isolate compute instances behind bastions and proxy hosts while allowing Cavirin to discover and assess these assets.  

Other new capabilities include additional OS scanning support, including for Amazon Linux 2, SUSE Linux 11/12 and Ubuntu 18.04.

 

0
0
0
s2sdefault
Smart City Security - NIST CSF

Our Rush to Automate Our Cites 

In “The ‘Too-Smart’ Home – Uninvited Guests,” I look at unintentional threats due to insecure internet-connected devices. Do we face some of the same issues with our rush to automate our smart cities, where spending is expected to grow from $80 billion in 2018 to over $158 billion by 2021? As reported numerous times over the past year, the answer is a resounding yes, with Industrial Internet of Things (IIoT) devices harboring an unknown number of vulnerabilities. The New York Times even recently reported on the potential threat, citing that cities, in the rush to publicize their ‘smart creds’, many times don’t understand the privacy, security, and financial implications of their deployments. These deployments are many times proposed by technology vendors, not always taking into account the readiness of the city to properly manage them. However, not all is lost!

Smart City threats - NIST CSF 

Attack Vectors

As with the home, it is not only the infrastructure that may be compromised, but the data gathered as well.  But in contrast with the home, both outcomes may be much more damaging, if not fatal.  One good measure of potential vulnerabilities is to map a typical smart city to the 16 DHS critical infrastructure sectors

 

NIST CSF

 

Relevant areas of concern include communications, emergency services, government, and commercial facilities, information technology, transportation systems, water and wastewater, and in many cases, energy, healthcare, and dams. Instead of each of these separately managed and secured, under a smart city initiative, one or more may very well be under the control of a single, interconnected operations platform, where a single breach may impact multiple sectors simultaneously.  Highlighting concerns, a recent ISACA survey identified energy, communications, and transportation as the three sectors (71%/70%/64%) that will benefit most from a smart cities initiative but are also the most susceptible to breach.

Attacks can come from multiple sources, including malware/ransomware as well as denial of service, with both nation-states (67%) and hacktivists (63%) likely culprits.  And, with more smart infrastructures in place, hackers have a larger attack surface, with pre-existing vulnerabilities more likely to be found and exploited.  Research from Threatcare and IBM X-Force Red, lends credence to this, having uncovered multiple zero-day vulnerabilities across different IIoT vendors. Security gaps identified include the use of default passwords, authentication bypass flaws, SQL injection vulnerabilities, and even open ports where control is possible from across the internet.  And the threat has only increased, with a recent Gemalto study finding that almost half of all businesses can’t detect if an IoT device has been breached.  There are even websites such as Censys and Shodan (among others) that make an attempt at tracking IoT devices.  And, more sophisticated attacks could take place against RF-controlled devices that may find their way into smart city architectures.  For example, Trend Micro recently identified security gaps in many commercial products, vulnerable from hardware-based rogue RF controller man-in-the-middle attacks.

 

The Threat Landscape

Moving from the general to the more specific, what are the types of IIoT devices one may encounter, and what specific actions are most effective and that one or more of the sectors described earlier?

Sector

Function / Use

Description

 Facilities

 

 

 

Structural monitoring

Monitoring of vibrations and material conditions in buildings, bridges and historical monuments.

 

Noise monitoring

Sound monitoring in bar areas and centric zones in real time.

 Transportation

 

 

 

Smart roads

Intelligent Highways with warning messages and diversions according to climate conditions and unexpected events like accidents or traffic jams.

 

Smart lighting

Intelligent and weather adaptive lighting in street lights.

 

Smart parking

Monitoring of parking spaces available in the city.

 

Traffic congestion

Monitoring of vehicles and pedestrian levels to optimize driving and walking routes.

 Emergency

 

 

 

Forest fire detection

Monitoring of combustion gases and preemptive fire conditions to define alert zones.

 

Air pollution monitoring

Control of CO2 emissions of factories, pollution emitted by cars and toxic gases generated in farms.

 

Snow level monitoring

Snow level measurement to know in real time the quality of ski tracks and allow security corps avalanche prevention.

 

Landslide and avalanche protection

Monitoring of soil moisture, vibrations and earth density to detect dangerous patterns in land conditions.

 

Earthquake early detection

Distributed control in specific places of tremors.

 

Perimeter access control and geofencing

Access and communications control to restricted areas and detection of people in non-authorized areas.

 

Liquid presence monitoring

Liquid detection in data centers, warehouses and sensitive building grounds to prevent breakdowns and corrosion.

 

Radiation levels

Distributed measurement of radiation levels in nuclear power stations surroundings to generate leakage alerts.

 

Explosive and hazardous gases

Detection of gas levels and leakages in industrial environments, surroundings of chemical factories and inside mines.

 

Crime noise monitoring

Gunshot monitoring in real time.

 Water and Wastewater

 

 

 

Potable water monitoring

Monitor the quality of tap water in cities.

 

Chemical leakage detection

Detect leakages and wastes of factories in bodies of water.

 

Water leakages

Detection of liquid presence outside tanks and pressure variations along pipes.

 

River floods

Monitoring of water level variations in rivers, dams, and reservoirs.

 

Pollution levels

Control real-time leakages and wastes in bodies of water.

 

Water flow

Measurement of water pressure in water transportation systems.

 Energy

 

 

 

Smart grid

Energy consumption monitoring and management.

 

Tank level monitoring

Monitoring of water, oil and gas levels in storage tanks and cisterns.

 

Photovoltaic installations

Monitoring and optimization of performance in solar energy plants.

 

High voltage line monitoring

Monitoring of line issues due to severe weather.

From Iibelium
 

Threat

Countermeasure

Example

Privacy, data, and identity theft

Authentication, encryption, and access control

Electric car charging stations,

Device hijacking

Device identification and access control, security lifecycle management

Traffic lights, robotics

Permanent and Application Level Denial of Service

Authentication, encryption, access control, application level DDoS protection, security monitoring, and analysis

Electric grids, monitoring systems

Man-in-the-middle attacks

Authentication and encryption, security lifecycle management

Water supply

From:  Rambus

 

Solutions 

One way to look at a solution is to first consider a set of universal security hygiene actions, and then look at specific requirements sector-by-sector.  An analysis by Microsoft looked at the properties of highly secure devices, and came up with the following recommendations:

Property

Examples and Questions to Prove the Property

Hardware-based Root of Trust

Unforgeable cryptographic keys generated and protected by hardware. Physical countermeasures resist side-channel attacks.

Does the device have a unique, unforgeable identity that is inseparable from the hardware?

Small Trusted Computing Base

Private keys stored in a hardware-protected vault, inaccessible to software. Division of software into self-protecting layers.

Is most of the device’s software outside the device’s trusted computing base?

Defense in Depth

Multiple mitigations applied against each threat. Countermeasures mitigate the consequences of a successful attack on any one vector.

Is the device still protected if the security of one layer of device software is breached?

Compartmentalization

Hardware-enforced barriers between software components prevent a breach in one from propagating to others.

Does a failure in one component of the device require a reboot of the entire device to return to operation?

Certificate-based Authentication

Signed certificate, proven by unforgeable cryptographic key, proves the device identity and authenticity.

Does the device use certificates instead of passwords for authentication?

Renewable Security

Renewal brings the device forward to a secure state and revokes compromised assets for known vulnerabilities or security breaches.

Is the device’s software updated automatically?

Failure Reporting

A software failure, such as a buffer overrun induced by an attacker probing security, is reported to a cloud-based failure analysis system.

Does the device report failures to its manufacturer?

From: Microsoft Research, The Seven Properties of Highly Secure Devices

 

IBM’s recommendations, based on the identified vulnerabilities described earlier, and more focused on software and processes, include: 

  • Implementing IP address restrictions for who can connect to the smart city devices, especially if networks rely on the public internet.
  • Leveraging basic application scanning tools that can help identify vulnerabilities.
  • Using strong network security rules to prevent access to sensitive systems, as well as safer password practices.
  • Disabling unnecessary remote administration features and ports.
  • Taking advantage of security incident and event management tools to scan network activity and identify suspicious internet traffic.
  • Hiring ethical hackers to test systems, such as IBM X-Force Red. These teams are trained to “think like a hacker” and find flaws in systems before the bad guys do.

From:  IBM, The Dangers of Smart City Hacking

And remember that these recommendations also apply to 3rd parties, an environment known to be especially vulnerable, and one where a breach may lead to disastrous consequences in the context of a smart city.  

In essence, develop a comprehensive architecture for proposed smart city services and applications, planning head vs creating a bolt-on architecture where every new sector becomes an exception or custom integration.  This planning is also critical in defining a least-privilege architecture where only those systems that must communicate with one another are actually able to do so.  Sure, a single screen depicting power, water, and roadways may look good and not disappoint Hollywood, but this may not be the most secure implementation. As with enterprises, leverage best practices such as the NIST-CSF, CIS, SOC2, and others, as a baseline to evaluate one’s security posture. 

To draw an analogy from the public cloud, the cities and their vendors share responsibility for the secure deployment, operation, and updates of any hardware and software deployed.  And, as opposed to deployments where detailed lifecycle security plan may be a ‘nice-to-have,’ here it is critical.  This is doubly true for devices whose data is made available to the public-at-large, such as the City of Santa Clara, CA traffic cameras.  In support of this, the government will step in to push the industry along, as with California’s recent IoT legislation.  Though only a beginning and not by any means comprehensive, it does imply that IIoT security has gained awareness.

 

Divergent Views – The East and the West

 Are there different priorities and approaches between smart city deployments in London and Shanghai, for example?  The answer is yes.  Though much of the technology will be the same, approaches to individual privacy differ.  There is less reluctance to gather PII from multiple sources and then correlate it, and many of the views track debates concerning just how to open the internet should be and to what data citizens should have access.  Already, many deployments include facial recognition to target individuals, and these use cases are spreading to the US.  On the positive side, there is probably a greater emphasis on centrally planning and securing any deployment.

 

The Future

As I noted earlier, there is still time to properly secure the IIoT with many of the suggestions listed above.  Looking to the future, a few initiatives are in play to better secure the various devices deployed.  As an example, the major public cloud providers, with their interests in the IoT space, have proposed and deployed architectures to better secure their services and devices.  Examples include Google’s Titan, Microsoft Azure Sphere/Pluton, and AWS’s IoT Device Defender.   One would hope that the various players reach consensus on a single, interoperable approach, but in any case, it will take years for these more secure devices to be deployed, and existing devices will still present vulnerabilities.

Check out our Leveraging NIST CSF Playbook, for more information on securing our critical infrastructure. 

0
0
0
s2sdefault
HHS Releases Voluntary Cybersecurity Practices for Health Industry

Voluntary Cybersecurity Practices for the Healthcare Industry

Just after the new year, the US Dept of Health and Human Services (HHS) released updated guidance to help healthcare organizations protect themselves against a cyber attack.  This guidance is not only timely, but essential given the continued escalation of attacks against healthcare environments--attacks that are becoming more complex, including DDoS, ransomware, and those against connected devices.   As they say, thieves go where the money is, and the typical healthcare record is worth $100 , 10x more than those across other verticals such as financial records.   The cost of a breach is just as impactful, with a loss of over $400 per record compromised.

 

     healthcare data breach cost 2018

 Organizations of all sizes, but especially smaller ones that may not have deep IT expertise, will, therefore, benefit from this guidance. 

The overall intent of the guidance is a:

  • Cost-effectively reduce cybersecurity risks for a range of health care organizations;
  • Support the voluntary adoption and implementation of its recommendations; and
  • Ensure, on an ongoing basis that content is actionable, practical, and relevant to health care stakeholders of every size and resource level.

Note that these are great goals for any vertical!

Resulting from the 2015 Cybersecurity Act (CSA), the guidance, Health Industry Cybersecurity Practices:  Managing Threats and Protecting Patients, aligns closely with the NIST CSF, a set of best practices that Cavirin embraces and supports.  The five threats explored in this document are as follows:

  • E-mail phishing attacks
  • Ransomware attacks
  • Loss or theft of equipment or data
  • Insider, accidental or intentional data loss
  • Attacks against connected medical devices that may affect patient safety

The two technical HHS volumes, Cybersecurity Practices for Medium and Large Health Care Organizations, and Cybersecurity Practices for Small Health Care Organizations go into much greater detail and the 
Managing Threats and Protecting Patients Resource and Template document maps the best practices to specific NIST identifiers.  

Best practices for threat mitigation fall into ten areas:

  • E-mail protection systems
  • Endpoint protection systems
  • Access management
  • Data protection and loss prevention
  • Asset management
  • Network management
  • Vulnerability management
  • Incident response
  • Medical device security
  • Cybersecurity policies
 NIST CSF for Healthcare


Check out the Cavirin NIST CSF Playbook, where we outline the mapping between the NIST CSF and healthcare-specific standards and best practices such as HIPAA and IEC/TR 80001-2-2 similar to what the HSS recommends here.  
Cavirin's healthcare solution supports the NIST CSF, HIPAA technical controls as well as the AWS HIPAA Quickstart, and the ability to customize frameworks based on specific business requirements including the CIA (Criticality, Impact, Availability) for specific controls so that healthcare organizations can automate compliance to achieve and maintain their golden cybersecurity posture just as Pacific Dental Services, Cepheid, and a large national healthcare partner have done.

 

 

0
0
0
s2sdefault
2019 Cloud Security Predictions

Plus Other Cloud Security Predictions for 2019

Well, 2018 is almost behind us, (sigh!) and we see 2019 as a watershed moment in hybrid and multi-cloud adoption. Organizations, maybe yours included, are increasingly comfortable in running critical workloads across multiple environments as long as they can maintain visibility and control. And, the major public cloud providers have embraced hybrid deployments with products that streamline adoption, such as Microsoft’s Azure Stack and the just-announced AWS Outposts. But we still have a long way to go. For example, how do you best secure these more complex deployments?

At Cavirin, we’ve supported and embraced the hybrid cloud from our earliest days. We offer security monitoring and remediation via CloudTrail and Lambda Functions for AWS, as well as the equivalent StackDriver and Functions on Google Cloud. The same capabilities are shortly coming to Azure. Across all three clouds, CIS hardening and network policy checks are available today. Increasingly, the public cloud providers are combining their own security offerings with those of their cloud partners, offering their customers better control. We recently announced Google Cloud Security Command Center integration--a good example of this trend.

Not to ignore the workloads, remember once again that under the cloud provider shared responsibility model, AWS, Azure, and Google Cloud secure the services they offer ‘in the cloud,’ but the customer takes over for their ‘on the cloud’ applications and data. Our new Ansible Playbooks, in combination with our continuous assessment, permits the operator to first create ‘golden images’ based on their risk profile, and then track any deployments for drift and immediately invoke corrective actions if required.

So, what are some specific predictions for 2019? Here’s a selection from our input to various publications:

  • Cloud 2.0: Security, especially across multi-cloud and in combination with on-premise, will continue to be top of mind. Additional awareness of both insider and external threats will be combined with effective tools that balance protection and usability. More CISOs will peer with CIOs as opposed to reporting to them. Further, mainstream enterprises will look beyond just getting their apps to work in the cloud. They will move to the next phase of optimizing performance, manageability, and security as part of a true multi-cloud deployment, where they have critical workloads both on-premise as well as within one or more public clouds. Smaller enterprises, with an awareness of cloud risks, will deploy third-party cloud security software.
  • Mind the Gap: Too often, SecOps or SIEM tools report on issues, but follow-up by DevOps is delayed. For security, this can result in major risks. We’ll see a wider deployment of tools that close the loop from this monitoring to change management, helping to automate many processes that require manual intervention. An example could be monitoring one’s hybrid infrastructure for change in security posture, automatically triggering Ansible Playbooks to correct to the known good baseline.
  • DevSecOps Becomes Real: On the back of DevOps and SecOps, many now understand the concept behind DevSecOps. But, that has happened, is that this is still pushback on how to best automate checks, and how to protect against potential job loss. This is solvable with some of the new approaches on the market, and through past technology and role transitions, job loss was never as high as anticipated.
  • Elevating the Importance of Cybersecurity: Business executives will embrace cybersecurity as a primary business responsibility, and not simply a technology issue. This will be combined with new state and potentially federal laws that improve privacy and reduce exposure. These shifts parallel trends internal to the organization, where technologies are increasingly vendor-managed and IT moves to the business units. The overall move to the cloud is only one example of this. Conversely, cyber and information security, due to importance, will transition from a technology function to a legal function.
  • ML and AI Reality Check: No set of predictions would be complete without homage to AI. There is no shortage of investment in this space, and startups with novel ideas. The goal will be to better understand how these technologies solve well-understood problems, how they integrate with existing workflows, and most importantly, how they remove risk. This all can’t happen soon, given that the hackers, especially those state-sponsored, are deploying many of the same tools. As noted in BlackHat this past summer, 2019 is the year that the industry must go back on the offensive.

 

Check out our News page for links to all the articles our leaders were featured in during 2018. 

0
0
0
s2sdefault
auto-remediation

Cloud Security Command Center (Cloud SCC) Integration

Many of the most high-profile breaches from recent years have been caused by misconfigured servers and cloud services that left sensitive information exposed. Cavirin is focused on protecting your cloud, container and server resources in the Google Cloud Platform (GCP), AWS, Azure and on-premises environments. With our Summer 2018 release, customers can:

  • automatically discover 9 GCP cloud resource types including VPCs, subnets, Cloud Account (including Identity and Access Management (IAM)), Google Kubernetes Engine (GKE), Google Compute Engine (GCE), BigQuery, Cloud SQL and Cloud Key Management Service (KMS), and 22 operating systems
  • evaluate several thousand technical controls at the cloud, container and OS levels spanning configuration, compliance and vulnerability checks
  • compute a proprietary CyberPosture Score that helps you translate assessments into an easy-to-understand risk metric
  • prioritize remediation plans based on CyberPosture score improvement potential
  • auto-remediate, where possible, via Ansible and serverless approaches

Today, we are thrilled to preview our integration into GCP Cloud Security Command Center which aggregates vulnerabilities, threats and security findings from Cavirin and other GCP security ecosystem partners. With this integration, customers will benefit from the following improvements:

Unified Dashboard for SecOps teams:  Cavirin’s security, compliance and vulnerability findings will be presented in the Cloud SCC dashboard alongside findings from other security offerings that customers may have purchased.

 Cloud SCC dashboard

Findings Prioritized by CyberPosture Scores. Each finding presented in the Cloud SCC dashboard represents a single configuration, compliance or security issue for one instance of 9 resource types. Cavirin presents up to 500 findings prioritized by their CyberPosture Score improvement potential, which is proportional to the relative risk of any finding based on the underlying technical control, its weight, resource criticality and other factors in Cavirin’s proprietary CyberPosture Scoring methodology.

Cloud Security Command Center CyberPosture Score 

Actionable Finding Details. Each finding also presents additional details on the security or compliance control framework that generated the finding, the GCP identifier of the failed resource, CyberPosture Score improvement potential, remediation steps, and other details.

 cloud scc and gcp identifier

Comprehensive Security & Compliance Frameworks. Findings in Cloud SCC are powered by the following control frameworks that contribute over 80,000 technical controls. Several of these frameworks were led by Cavirin security experts:

  • CIS GCP Foundation Benchmark, co-authored by Cavirin
  • Cavirin GCP Network Policy Pack to protect against open TCP ports
  • Compliance frameworks: GDPR, HIPAA, PCI-DSS 3.2, ISO 27002:2013, AICPA SOC2, CJIS
  • Security frameworks: CIS (OS-level), DISA, CIS Google Chrome, NIST 800-171, NIST 800-53r4, NIST CSF, Cavirin Patches & Vulnerabilities
  • Container frameworks: Cavirin Image Hardening, Cavirin Patches & Vulnerabilities, CIS Docker CE, Container Linux, CIS Kubernetes

CyberPosture Intelligence for GCP. Cloud SCC customers are one click away from the Cavirin dashboard with a “credit-score”-like representation of security and compliance posture across GCP, AWS, Azure, containers, and on-premises infrastructure. The Cavirin CyberPosture score helps customers analyze trends and drill into scores by asset group, environment, policy pack, cloud service, operating systems, and individual resources to pinpoint risk and prioritize remediation plans.

cybersecurity posture score for Cloud SCC customers 

Making the magic work

Getting started with Cavirin and Cloud SCC is easy. Contact Cavirin to get you provisioned for Cloud SCC access.  Once you have that information, please browse and find the Cavirin Cloud SCC Companion in the Google Marketplace. This application establishes trust and connectivity between Cavirin and GCP to post security findings about your organization’s GCP resources into Cloud SCC. Follow the self-service provisioning wizard steps for Cavirin Cloud SCC Companion (found in the Marketplace documentation).

Cavirin Cloud SCC Companion in the Google Marketplace 

Next, provision the Cavirin CyberPosture managed VM app in the Google Marketplace.

Finally, connect Cavirin to GCP Cloud SCC using the integration steps within Cavirin.

More to Come!

In the coming months, we plan to further strengthen our GCP features by closing the loop from monitoring to risk scoring and auto-remediation by detecting new, deleted or changed resources via Google StackDriver Monitoring, scoring changes and allowing users to remediate via pre-built Google Functions.

Next Steps

 

0
0
0
s2sdefault
auto-remediation

 

Minimize Risks Due to Change Management Delays 

As DevOps leaders continue to deliver greater agility to the business, SecOps is faced with a widening security gap needing more time to manually work through change requests that ensure appropriate testing is achieved taking into account risk, security, and compliance. This whitepaper is for those looking to minimize the risks due to change management delays and manual processes. It highlights how Cavirin auto-remediates both compute instances and cloud services to minimize the security gap between SecOps and DevOps.

AUTO-REMEDIATE TO MINIMIZE RISKS DUE TO CHANGE MANAGEMENT DELAYS 

Many organizations separate security posture monitoring from change management, leaving them exposed when security alerts monitored by SecOps teams wait for DevOps teams for remediation. Closing this security gap via auto-remediation is a key outcome enabled by Cavirin. In this document, we discuss how Cavirin auto-remediates both compute instances and cloud services, starting with a chart that highlights an organization with and without auto-remediation. 

AUTO-REMEDIATION APPROACH LEVERAGING ANSIBLE 

For compute instances, Configuration Management systems like Puppet Enterprise, Chef Automate, or Red Hat Ansible offer a good foundation. Their cloud counterparts include Microsoft Azure Automation as well as the AWS Elastic Compute Cloud Systems Manager. Cavirin’s approach, below, leverages Ansible to remediate compute instances in AWS, GCP, Azure or on-premise environments. 

First, a SecOps user using the Cavirin system defines a “golden configuration” of operating system parameters for a group of machines using Cavirin’s technical controls (CIS, in the figure below). The system continually assesses the organization’s machines against “golden” technical controls and identifies those assets drifting from it (Step 2 in the figure below). 

Next, the Cavirin system creates the list of drifting machines (“host file”) as well as a list of configuration settings (“variables file”) that require remediation in Ansible’s format. Finally, the Ansible server retrieves the Ansible hosts file, variables file and the Cavirin-supplied Ansible playbook to remediate machines to the golden state. 

The same approach can also be used to create ‘golden’ images during pre-production by assessing candidate images against a golden posture and involving Ansible with Cavirin playbooks to remediate images to a golden state. 

Moving from compute instances to cloud services, here we can use the monitoring, queuing, and remediation services provided by public clouds. Options for remediation include AWS Lambda, Azure Functions and Google Functions. Cavirin monitors cloud services via provider APIs and assessing them for various technical controls. The system then develops a list of the top resources for remediation, and then executes the provider-specific functions. 

Using AWS as an example, Cavirin, via its AWS Network Policy Pack, periodically assesses the status of commonly used TCP ports associated with the Security Groups created within a given AWS account. It then informs the operator of the top 50 ports, which if remediated will positively impact the score (see Figure below). 

Technically, in the figure below, 

  1. The operator issues the remediation command from the Cavirin dashboard 
  2. Which publishes a remediation request to an AWS SNS topic 
  3. …that then invokes the Cavirin-authored Lambda function 
  4. Remediation occurs and confirmation is now posted to Cavirin via SQS 
  5. Cavirin takes this confirmation and modifies the scoring accordingly 

To summarize, auto-remediating compute instances and cloud services as described in the article can help organizations accelerate responses to security gaps, reduce security risks, and eliminate manual processes. 

 

 

 

0
0
0
s2sdefault

© 2018 Cavirin Systems, Inc. All rights reserved.