Cavirin Blog

Azure Hardening

This morning, Cavirin announced the near-term availability of the new CIS Microsoft Azure Foundations Benchmark.  The document is expected to be generally available within the next week or two, but why wait?  It is available today to anyone with CIS access, and is a milestone for public multi-cloud security as a foundational and prescriptive guideline for organizations to establish a healthy security posture in Azure Cloud investments.  This is the first hardening benchmark for Azure, completing an earlier available benchmark for AWS, also supported by Cavirin.  To address any confusion, other cloud security vendors do offer a view into one’s Azure security posture via published APIs.  We do the same, but the CIS Benchmark takes a different approach to uncover a deeper level of understanding.

The availability of the new CIS Benchmark is critical in securing hybrid cloud environments.  CNBC recently reported that AWS held a 62% market share for public cloud deployments, a drop from 68% a year earlier.  In the same timeframe, Azure jumped from 16% to 20%.  More importantly, ESG states that by the end of 2018, 81% of enterprises in the cloud will deploy on more than one provider. Cavirin’s goal is to enable hybrid cloud security, offering an organization a single, correlated view of their security posture across multiple public clouds, as well as on-premise.  This is very different from a simpler multi-cloud deployment that looks at each cloud in isolation, ‘clouds in the night’ if you will.

The recommendations fall into eight areas:

  • Identity and Access Management
  • Security Center
  • Storage Accounts
  • SQL Services
  • SQL Databases
  • Logging and Monitoring
  • Networking
  • Virtual Machines
  • Other Security Considerations

As with other CIS benchmarks, the document permits quantitative scoring of an organization’s Azure security posture, and with that, the ability to automatically assess and remediate any deficiencies.  These capabilities tie together cloud security and DevOps automation – DevSecOps for the cloud.

The Benchmark defines two levels of implementation, or ‘profiles,’ depending upon the importance of the security posture to one’s organization.  Level 1 is the basic set of recommendations, while Level 2 is for more security-focused environments.  It is developed in such a way as to be applicable across a wide range of IT professionals, from application administrators and security specialists, through auditors, help desk personnel, and platform developers.  When deployed within an automatic assessment platform, the intent is ease of use. 

We at Cavirin would also like to thank the other vendors that have contributed to the benchmark, as well as Pravin Goyal, who lead the effort.

The Cavirin Platform is available on the Azure Marketplace.

 

 

0
0
0
s2sdefault
Hybrid Cloud Strategy Advantages

A Hybrid Cloud Strategy is Important for Security 

Cybersecurity is evolving and strengthening every day, but Lloyd’s, in partnership with AIR Worldwide, released a cautionary report entitled Cloud Down – The impacts on the US economy. This report outlines the possible, and probable, repercussions of the failure of one of the leading cloud providers. In focus: the financial impact of such an event.

Why should we care? If these insights are heard and headed, insurance managers could better grow their cyber business in a judicious manner. Along the same train of thought, it is important to remember that these analyses are made with the notion that a unique CSP would be affected at a time. As such, distributing workloads across multiple CSP’s, taking the time to analyze which advantages of each cloud would best help you attain your goals, would be a possible real-world application of this report.

To provide us with a baseline, the report specifies that “the results published in the report are based on the top 15 cloud providers in the US, which account for a 70% market share.”

This report materializes the monetary impacts of the interruption of US companies’ e-businesses if a cloud service provider should be compromised for a certain duration of time.

“Given the state of the cyber insurance industry today, a cyber incident that takes a top three cloud provider offline in the US for 3-6 days would result in ground-up loss central estimates between $6.9 and $14.7 billion and between $1.5 and $2.8 billion in industry insured losses.”

The report details its methodology, in that it takes a different angle from the usual market share approach methodology. Instead, its approach uses company specific risk attributes. This allows for a truer reflection of the risk insurers face. It narrows down which companies would be affected by the scenario and eliminates from the estimates the companies that would not be affected. A great deal of information can be drawn as “the scenario classes presented in this report considers the impact of disruption to several key cloud service providers for different periods of time.”

 

Many conclusions and lessons can be drawn from the raw data presented in this report, but the one that Cavirin finds most applicable and immediately helpful is that risk can mitigated through the spreading of workloads across multiple clouds. But this strategic move comes with its own challenge: how best to manage the increased complexity of splitting data across more than one cloud? Cavirin tackles that challenge proactively through the automation of cybersecurity and compliance, drawing from the richest set of frameworks, benchmarks, and guidelines.

 

 

0
0
0
s2sdefault
DevOps automation

Earlier today, Bashyam Amant, our Sr Director of PLM, and Vaidehi Rao, our Director of Engineering, hosted a webinar entitled ‘Full-Stack Container Security,’ borrowing for the container space a (sometimes confusing) term familiar to many of you.  One of the best definitions, and a good jumping-off point, is at codeup:

‘A full-stack developer is simply someone who is familiar with all layers in computer software development. These developers aren’t experts at everything; they simply have a functional knowledge and ability to take a concept and turn it into a finished product. Such gurus make building software much easier as they understand how everything works from top to bottom and can anticipate problems accordingly. In our opinion, this is the most realistic definition of a full-stack developer.’  For those looking for even more history on the topic, the turtles end at FB.

Extending this paradigm to containers and Docker, in our view, and in order to have a complete awareness as to how your container deployments impact your overall security posture, you must have tools that look at each ‘layer’ of the ‘stack’ while at the same time offering a unified vs a disjointed view. 

0
0
0
s2sdefault
DevOps security automation

Devops Security Automation plays a key role in DevSecOps

Check out the executive viewpoint, “It’s Time to Stir Security into the DevOps Mix”, posted on the Security Current Web site earlier this month.  The article highlights the fact that creating secure software and systems has never been more challenging as the number of devices that hook into company data, coupled with increased mobility and a shift to cloud services and storage, has dramatically increased the potential attack surface of most organizations.  These organization changes required the adoption of a new security approach–chiefly breaking down barriers, boosting collaboration, and increasing automation works—often referred to as DevSecOps.  In the article we emphasize three key ingredients necessary to pursue DevSecOps.

Tags:
0
0
0
s2sdefault

Too start off the year, at least two publications have reported on surveys that detail the criticality of the cybersecurity skills gap.  For those old enough, it harkens back to the Cold War missile gap of the 1950s.  But unlike the missile gap, which was mostly fictional, this gap is very real, and much more relevant to the typical enterprise.

CSO drew on a Nov, 2017 ESG study that looked at gaps and potential solutions. The most alarming observation is that, despite increased spending and visibility, the percentage of respondents that reported a shortage of skills rose from 23% in 2014 to 51% in 2018. This doubling implies that the majority of organizations are threatened. As solutions, two areas that stand out include:

  • Moving toward technologies with advanced analytics.Think of artificial intelligence and machine learning as a helper application that can accelerate security processes and make the staff more productive.
  • Automating and orchestrating processes.Cybersecurity grew up with a reliance on manual processes, but these processes can no longer scale to meet growing demands. As a result, security automation/orchestration has become a top priority for many organizations.

 

0
0
0
s2sdefault

In my previous blog, I looked it just how easy it is for the typical hacker to obtain a variety of exploit tools, or to obtain compromised data. The hacker lifecycle roughly maps to the diagram below, where he or she first obtains or develops the various tools, or leverages ‘dark web’ services, then leverages these to compromise physical assets with a goal of obtaining useful data.  Here, I’ll look at how Cavirin helps you counter these threats by focusing on the middle phase – how to protect your assets, either on-premise or in the cloud. 

 

 

Hacking as a Service (HaaS)

For those familiar with the Cyber Kill Chain concept (and I realize that there are different views on applicability, but it is useful to frame the discussion), the lifecycle may look familiar.  There are seven stages, with stages 3-5 of interest.  

  1. Reconnaissance: Intruder selects target, researches it, and attempts to identify vulnerabilities in the target network.
  2. Weaponization: Intruder creates remote access malware weapon, such as a virus or worm, tailored to one or more vulnerabilities.
  3. Delivery: Intruder transmits weapon to target (e.g., via e-mail attachments, websites or USB drives)
  4. Exploitation: Malware weapon's program code triggers, which takes action on target network to exploit vulnerability.
  5. Installation: Malware weapon installs access point (e.g., "backdoor") usable by intruder.
  6. Command and Control: Malware enables intruder to have "hands on the keyboard" persistent access to target network.
  7. Actions on Objective: Intruder takes action to achieve their goals, such as data exfiltration, data destruction, or encryption for ransom.

    0
    0
    0
    s2sdefault

Cavirin provides security management across physical, public, and hybrid clouds, supporting AWS, Microsoft Azure, Google Cloud Platform, VMware, KVM, and Docker.