Mohammed Al Mulla - Best practices to secure working environments

Best Practices to Secure Working Environments

Mohammed AlmullaKuwait University

Executive Summary

• Recent changes in computing architecture from dedicated servers in datacenters to virtualization and Cloud Computing suggest that we rethink our IT security methodologies.

• The focus is on database security, as well as on securing most enterprise applications.

Table of Contents

• Limitations of existing database security approaches.

• Security considerations when deploying virtualization.

• How distributed monitoring best fits virtual and Cloud Computing environments.

Securing Information in Virtualization

Many enterprises future plan is to move some applications to Cloud Computing.

How does this affect their IT security methodologies?

Recent Requirements

• Working environments are centered around two major technological requirements:

– Very High Performance Networks (VHPN) – Complex applications.

Market Response

• To meet these requirements, security companies introduced a range of network appliances.

• Network Appliances: machines positioned somewhere in the network, to inspect the traffic for either protocol violations, malicious code, viruses malware or spams.

Types of Security Solutions

• Network-based system

• Host-based system

Winning the Battle

• In this era, solutions that depend on host-based software are neglected.

• Network-based IDS and IPS won the battle against host-based solutions.

• The concept of simply placing an appliance in a rack and attaching it to a switch is very attractive, especially when resources available for security are limited.

Recent Trend

• Today, many distributed applications have been leading to the adoption of host-based solutions, in conjunction with network appliances, specially

when the enterprises are concerned with

insider transactions.

Network-based Isn’t Enough

• The new databases are dynamically appearing in new locations.

• Question1: Will the network appliance approach be relevant when many transactions will not make it to the network

• Question2: Is the network monitoring approach efficient when the application network moves from LAN to WAN.

Before & After

• Previously, databases were not monitored or protected.

• Now monitoring DBs must cover local and intra-db attacks. Because of database breaches, customers are now investing time and effort in securing their databases.

Today’s Solutions

• Recently, appliance vendors have added local agents to their solutions, making many of today’s network-based solutions a hybrid of network appliance and host-based solution.

Solution Analysis

• The hybrid approach is not ideal, but as long as most applications run on the network in plain sight of the appliance, some enterprises were willing to accept the risks.

Disadvantages

• These hybrid solutions introduce complex implementation requirements such as kernel-level installation of the agent, for example, requiring reboots to the DB server.

• They still miss the sophisticated attacks generated from within the database itself.

• They also fail to address several technical challenges when implemented in either a virtual environments, or in the cloud.

Challenge #1 – Visibility Into VM-to-VM Transactions

One of the benefits of virtualization is the ability to share resources, resulting in environments where both the application and the databases are migrating to virtual machines.

Challenge #1 – Visibility Into VM-to-VM Transactions

The communication from the CRM application to the database storing customer data occurs entirely within the same physical server.

In such a case, there is little or no network traffic as the transactions between the application and the database occur from VM-to-VM within the server.

Network monitoring appliances will not see these transactions.

Solution

• Bring security inspection closer to its target: This is called “virtual appliance”, where a virtual machine is installed on virtual servers and the servers are re-architected to send traffic through the virtual machine.

• Warning: This approach has two severe drawbacks: -Performance -Architecture complications.

Challenge #2 – The Dynamic System Environments

• If virtual security appliances are not ideal solutions for virtual machines, they are even less applicable in cloud-based applications, where networks are dynamic.

Solution

• The only solution that works in all environments, including Cloud environment is a solution that is based on sensors that run side by side with the database on every machine that hosts one database or more.

Challenge #3 – Performance Over WAN

In Cloud Computing deployments, network bandwidth and latency will make off-host processing too inefficient.

Cloud Computing prevents you from co-locating a server close to your databases – you simply won’t know where they are.

This will slow down network performance, and prevents timely interruption of malicious activity.

Solution

Implement the necessary protection locally. This will ensure network’s performance.

For Cloud Computing, make sure that the system supports wide area network (WAN) topologies.

To limit exposure of sensitive data, encrypt all traffic between the management console and sensors, and for optimum performance, compression techniques should be implemented so that policy updates and alerts are efficiently transmitted.

Distributed Host-based Solutions The Only Efficient Approach

• The only way to secure databases on virtual machines or cloud environments, without sacrificing the huge benefits of these new architectures, is using software-based solutions that share the elasticity of virtual machines and Cloud Computing.

The Ultimate Challenge

• The challenge is to create host-based solutions that do not suffer the same drawbacks that made old host-based solutions irrelevant namely:– Intrusive implementations, – Performance issues – Quickly adapt to new and volatile environments.

Next-generation Solutions

• Next generation solutions must be lightweight, easily added to the virtual machine where needed, and installed in parallel to the first database that is installed on a machine.

Promoting Stability

• Adding a layer of security does not require changes in architecture and does not rely on the virtualization technology in use.

Conclusions

Many organizations found themselves drawn towards virtualization and Cloud Computing.

They realized that the complexity of ensuring adequate data security is an obstacle.

But, the movement towards these technologies is inevitable.

There are solutions out there that protect sensitive information as well as provide both effective and efficient data security across dedicated database servers as.

Thank You