Securing Your Cloud Servers with Halo NetSec

Securing Your Cloud Servers with Halo NetSecRand WackerVP of Productsrand@cloudpassage.com@randwacker

CloudPassage Halo was purpose-built to

deliver real security for servers in the cloud.

What does CloudPassage do?

Firewall Management

Server Configurations

Server account Management

Compromise & intrusion alerting

Security & compliance auditing

Vulnerability Management

Security for virtual servers running in public and private

clouds

CloudPassage Halo Packages

Halo BasicFree security for initial cloud migrations

Halo NetSecFull perimeter protection and security

integration

Halo ProfessionalComprehensive security and compliance

controls

Cloud Requires A New Approach to Security

www-1 www-2 www-3 www-4

Cloud Security Is Newprivate datacenter

public cloud

Cloud Security Is Differentprivate datacenter

public cloud

www-1 www-2 www-3

Cloud Security Is Complex

Cloud Provider A

www-10

Cloud Provider B

Private Datacenter

Security Products Aren’t Adapting

Cloud Provider A

www-4 www-5 www-6 Cloud Provider B

Private Datacenter

www-1 www-2 www-3

Temporary & Elastic Deployments

Multiple CloudEnvironments

Metered Usage

Cloud Security Responsibility

Physical Facilities

Hypervisor

Compute & Storage

Shared Network

Virtual Machine

App Code

App Framework

Operating System

ilityP

“…the customer should assume responsibility and management of, but not limited to, the guest operating system.. and associated application software...”

“it is possible for customers to enhance security and/or meet more stringent compliance requirements with the addition of… host based firewalls, host based intrusion detection/prevention, encryption and key management.”

Amazon Web Services: Overview of Security Processes

AWS Shared Responsibility Model

Survey: Cloud Providers

Amazon EC2 Rackspace Terramark GoGrid Other

Source: CloudPassage CloudSec Community Survey

Question: Which cloud hosting providers do you use?

Survey: Cloud Security Practices

Open source or custom-de-veloped tools

Commercial Tool

My provider does it for me

Amazon Security Group

We're not securing our cloud servers

Question: How do you secure your cloud servers today?

Survey: Cloud Security Concerns

Enterprise security tools don't work in the cloud

Provider access to guest servers

Achieving compliance with PCI or other standards

Multi-tenancy of infrastructure or applications

Lack of perimeter defenses and/or network control

Multiple Choice

Question: What security concerns are most important to you regarding public cloud computing?

Introducing Halo NetSec

Halo NetSec provides firewalling, 2-factor

authentication, and full automation for the protection of cloud

servers.

Halo NetSec:Dynamic Cloud Firewall

Traditional Perimeter Securityprivate datacenter

Firewall

Load Balancer

App Server

Load Balancer

App Server

Dynamic Cloud Firewall

public cloud

Load Balancer

App Server

DB Master

public cloud

Load Balancer

App Server

Load Balancer

App Server

DB Master

DB Slave

App Server

public cloud

Load Balancer

App Server

Load Balancer

App Server

DB Master

DB Slave

public cloud

Load Balancer

App Server

Load Balancer

DB Master

DB Slave

App Server

Multi-Cloud Firewall

US West Cloud

Private Datacenter

App Server

US East Cloud

App Server

Firewall

Multi-Cloud Firewall

US West Cloud

Private Datacenter

App Server

US East Cloud

App Server

Firewall

Halo NetSec:GhostPorts 2-Factor Authentication

GhostPorts 2-Factor Auth

YubiKey-generated one-time password

USB token contains no batteries or moving parts

Prevent brute force attacks on SSH and web

applications

DB Server

Halo Grid

DB Server

Halo Grid

DB Server

Halo NetSec:Integration API

Halo Reduces Your Workload

Things you DON’T need to script with CloudPassage Halo

Managed Automatically

• Add new server to policy group

• Remove firewall policies when servers are retired

• Scan for vulnerabilities of installed software packages

• Many, many more…

Monitored Continually

• Verify firewall rules match policy

• Alert administrators of missing servers

• Monitor critical server configuration files for security posture

• Many, many more…

Adding New Server Accounts

Halo Grid

RESTful API Gateway

private datacenter

Corporate Directory

Enterprise

Provisioning

System

Security Operation

sPortal

public cloud

GhostPorts Access, Local Server Accounts

Other Cool Halo/API Tricks• Set password reset requirements for a server user account.• Find server accounts that don't have passwords (it happens)• Find those spooky root-owned setuid files.• Generate alerts if PID files go missing.• Generate an alert if someone is in a group they shouldn't be in (like wheel).• Generate massively detailed reports of server configuration status for auditors

(keep 'em busy for weeks).• Get a report of every server that a user *does not* have an account on.• Get a report of every server that a user has an account on.• Get alerted if a new cloud server gets created.• Learn what process that TCP/IP port is bound to.• Make sure that init.d startup scripts can't be tampered with by non-root users.• Make sure that services are not running with excessive privileges.• Monitor servers to detect old user accounts that should have been cleaned up,

but might have gotten missed.

Many, many more at community.cloudpassage.com

CloudPassage Halo Architecture

How It Works

Halo Grid

• Halo Daemon– Ultra light-weight software

– Installed on server image

– Automatically provisioned

• Halo Grid– Elastic compute grid

– Hosted by CloudPassage

– Does the heavy lifting for the Halo Daemons

Halo Daemon

Alerts, Reports and Trending

ComputeGrid

UserPortal

RESTful API Gateway

Policies,Commands, Reports

Getting Started

CloudPassage Halo Packages

Halo BasicFree security for initial cloud migrations

Halo NetSecFull perimeter protection and security

integration

Halo ProfessionalComprehensive security and compliance

controls

Features and PricingBasic NetSec Pro

Network Security

Host Firewall Management ✔ ✔ ✔

GhostPorts Multi-Factor Authentication ✔ ✔

Host Security

Server Exposure Monitoring ✔ ✔ ✔

Software Vulnerability Monitoring ✔ ✔ ✔

Account & Access Scanning ✔ ✔ ✔

Cloud Server Event Logging & Alerting ✔ ✔ ✔

File Integrity Monitoring ✔

Data Storage One day Two years(FW events)

Two years(All scans)

Maximum Scanning Frequency Daily Daily Hourly

Integration, Management Support

Web Management Portal ✔ ✔ ✔

RESTful API Access ✔ ✔

Technical Support Community

Professional

Servers Protected Up to 25 Unlimited Unlimited

Pricing FREE3.5¢/hour

10¢/hour

FREE 5 Minute Setup

Register at cloudpassage.com/regis

Configure security policies in Halo web

portal

Install daemons on cloud servers

Summary

Cloud deployments require a new approach to security

Halo is the only security platform purpose-built for

the cloud

All you need to secure your cloud servers

Q&A Rand Wackerrand@cloudpassage.com@randwacker

Thank You!For more information:

info@cloudpassage.com

Securing Your Cloud Servers with Halo NetSec

Technology

Securing Enterprise Securing Enterprise Securing Enterprise

contactSync 7.6 Manual - NETsec

Parasound - Halo CD1 - Audio Tuningaudiotuning.com/images/Parasound/Para-Halo-CD1-Test-stereophile... · Parasound - Halo CD1 Test „stereophile“ 07.2013 ... the Parasound Halo

Intro to NetSec

HALO Aircraft

Netsec VPN, sekuriti, jaringan

NetSec Compétence

Taglish, Glutathione, and the Halo-Halo Discourse of ...€¦ · Taglish, Glutathione, and the Halo-Halo Discourse of Billboards in Metropolitan Manila ... Introduction and Signiﬁcance

Protafolio Netsec

9 data netsec-kerberos(madsg.com)

Halo TD518278EN H36LVICAT - Cooper Industries...Halo TD518278EN H36LVICAT Author Eaton Halo Subject Halo TD518278EN H36LVICAT Keywords Halo, TD518278EN, H36LVICAT, 3 inch, insulated,

SET – A (CHEMISTRY ) CLASS -12 Halo alkanes & Halo arenes

Special Halo-halo by JVRREL's Desserts &Pastries

CSG513 NetSEc Lecture 1 Jan 09 2012

Halo 30.09.2011

11 data netsec-ip-sec(madsg.com)

New LIMB RISERS .50 CAL. AMMO CAN & BAG HALO MAGNETIC … · 2016. 4. 4. · cial P C.A.S.T (CATALYST ACTIVATED SECURING TAPE) PN Description 2734 CAST (Catalyst Activated Securing

Orthopedics Department The Halo Thoracic Brace › Orthopaedics-Site › Documents... · Introducing the halo thoracic brace What is the halo thoracic brace? The halo thoracic brace

Network Security (NetSec)netsec.net.in.tum.de/slides/01_Intro.pdf · Network Security (NetSec) IN2101 – WS19/20 Prof. Dr.-Ing. Georg Carle Dr. Holger Kinkelin Jonas Jelten Richard

Armamento Halo