Cloud-10 Multi Tenancy and Physical Security - Revision history

Vinaykbansal: /* Countermeasures */

2010-08-30T11:41:00Z

‎Countermeasures

Vinaykbansal: /* R7: Multi Tenancy and Physical Security */

2010-08-30T11:23:18Z

‎R7: Multi Tenancy and Physical Security

Vinaykbansal at 11:00, 30 August 2010

2010-08-30T11:00:59Z

Vinaykbansal: /* Countermeasures */

2010-08-29T20:01:39Z

‎Countermeasures

Vinaykbansal: /* Related Incidence */

2010-08-29T19:51:15Z

‎Related Incidence

Vinaykbansal: /* Countermeasures */

2010-08-29T19:50:32Z

‎Countermeasures

Vinaykbansal: /* Reference: */

2010-08-29T19:48:11Z

‎Reference:

Vinaykbansal: /* Security Risks */

2010-08-29T19:47:09Z

‎Security Risks

Vinaykbansal: /* Security Risks */

2010-08-29T19:42:01Z

‎Security Risks

Vinaykbansal: /* R7: Multi Tenancy and Physical Security */

2010-08-29T19:28:50Z

‎R7: Multi Tenancy and Physical Security

@@ Line 20: / Line 20: @@
 ==Countermeasures==
-# '''Tenant Isolation''' : Tenants can always negotiate or demand from the cloud provider to have their own separate physical infrastructure, databases, storage, networking gears,.. . Isolation does play a  great role in the security field.  However, it does increase the cost for tenants/clients.
+# '''Architecting for Multi-Tenancy''' :  Providers need to architect for multi-tenants, rather than making services that are not designed for multi-tenancy to work. Multi-tenancy architecture should take into account logical segregation, strengthen common services and single point of failures. Also provide more transparency to consumers/tenants [12].
 # '''Data Encryption''': For encrypting the data and keeping it separate from other tenants , strong encryption complemented by tenant-owned key management is required.  In a virtualized environment, this means that encryption can be done granularly on a per-VM basis, with key management owned by the tenant and not the service provider [1].
 # '''Controlled Change Management''' :  eployment of the changes  (especially to common shared services) should be well planned . Usage of feathered release cycles to migrate tenants to new infrastructure. For SaaS providers tenants should be progressively migrated to newer underlying infrastructure. (Providers need to plan extra resources for these activities). Providers should have a dependency mapping of tenants to underlying resources and services. So that any change in the underlying resources can be well planned.
 # '''Virtual Private Cloud (VPC)''' : It  is a private cloud existing within a shared or public cloud.   A VPC is a way to partition a public cloud (multi-tenancy) into quarantined virtual infrastructure [3] and link it back to the tenants internal resources by encrypted network links.
 # '''Third Party Assessments''': Alternate assessment options or contractual exceptions if the auditing is required as per the consumer's security posture but provider does not allow it [6].
-# '''Transparency/Audit-ability of Administrative Access''': Tenants should have knowledge on administrative access to all their resources/services. One of the way is to have audit-ability of admin access enabled at all the layers of stack (OS, networking, applications , databases) that can be auditable by the tenants. Provider may still be doing the administration but under strong   auditable environment.
+# '''Tenant Isolation''' : Tenants can always negotiate or demand from the cloud provider to have their own separate physical infrastructure, databases, storage, networking gears,.. . Isolation does play a  great role in the security field.  However, it does increase the cost for tenants/clients.
 ==Related Incidence==

@@ Line 1: / Line 1: @@
 ==R7: Multi Tenancy and Physical Security ==
-Multi-tenancy in cloud means sharing of resources and services among multiple consumers and clients (tenants). It means physical resources (such as computing, networking, storage) and services are shared, also the administrative functionality and support may also be shared. One of the big driver for providers is to reduce cost by sharing and reusing resources among tenants.
+Multi-tenancy in cloud means sharing of resources and services to run software instances serving multiple consumers and client organizations (tenants). It means physical resources (such as computing, networking, storage) and services are shared, also the administrative functionality and support may also be shared. One of the big driver for providers is to reduce cost by sharing and reusing resources among tenants.
 In a multi-tenant environment a lot more security dependence on the logical segregation (at multiple layers) rather than the physical separation of resources. Some of the cloud providers due to mult-tenancy may not allow audit and assessment by a particular tenant within their shared infrastructure.

@@ Line 12: / Line 12: @@
 # '''Uncoordinated Change Controls and Mis configurations''': When multiple tenants are sharing the underlying infrastructure all changes needs to be well coordinated and tested .
 # '''Co-mingled Tenant Data''' : To reduce cost providers may be storing the data from multiple tenants in same database table-spaces and backup tapes. Data destruction can become a challenge in multi-tenancy especially if data is stored in the shared media (databases, backups, archives).
 # '''XaaS Specific Risks'''
 ## '''SaaS''': Multiple clients (tenants) may be sharing the same application stack ( database, app/web servers, networking). That means the data from multiple tenants may get stored in the same database, may get backed up and archived together, may be moving on common networking devices (unencrypted), and managed by common application processes. This puts a heavy emphasis on logical security built within the application to separate one tenant's users from others.

@@ Line 19: / Line 19: @@
 ==Countermeasures==
-# Tenants can always negotiate or demand from the cloud provider to have their own separate physical infrastructure, databases, storage, networking gears,.. . Isolation does play a  great role in the security field.  However, it does increase the cost for tenants/clients.
+# '''Tenant Isolation''' : Tenants can always negotiate or demand from the cloud provider to have their own separate physical infrastructure, databases, storage, networking gears,.. . Isolation does play a  great role in the security field.  However, it does increase the cost for tenants/clients.
-# For encrypting the data and keeping it separate from other tenants , strong encryption complemented by tenant-owned key management is required.  In a virtualized environment, this means that encryption can be done granularly on a per-VM basis, with key management owned by the tenant and not the service provider [1].
+# '''Data Encryption''': For encrypting the data and keeping it separate from other tenants , strong encryption complemented by tenant-owned key management is required.  In a virtualized environment, this means that encryption can be done granularly on a per-VM basis, with key management owned by the tenant and not the service provider [1].
-# Tenants should have control on administrative access to all their resources running. One of the way is to have audit-ability of admin access enabled at all the layers of stack (OS, networking, applications , databases) that can be auditable by the tenants. Provider may still be doing the administration but under strong   auditable environment.
+# '''Architecting for Multi-Tenancy''' :  Providers need to architect for multi-tenants, rather than making services that are not designed for multi-tenancy to work. Multi-tenancy architecture should take into account logical segregation, strengthen common services and single point of failures. Also provide more transparency to consumers/tenants [12].
-# Virtual Private Cloud (VPC): It  is a private cloud existing within a shared or public cloud.   A VPC is a way to partition a public cloud (multi-tenancy) into quarantined virtual infrastructure [3] and link it back to the tenants internal resources by encrypted network links.
+# '''Controlled Change Management''' :  eployment of the changes  (especially to common shared services) should be well planned . Usage of feathered release cycles to migrate tenants to new infrastructure. For SaaS providers tenants should be progressively migrated to newer underlying infrastructure. (Providers need to plan extra resources for these activities). Providers should have a dependency mapping of tenants to underlying resources and services. So that any change in the underlying resources can be well planned.
-# Alternate assessment options or contractual exceptions if the auditing is required as per the consumer's security posture but provider does not allow it [6].
+# '''Virtual Private Cloud (VPC)''' : It  is a private cloud existing within a shared or public cloud.   A VPC is a way to partition a public cloud (multi-tenancy) into quarantined virtual infrastructure [3] and link it back to the tenants internal resources by encrypted network links.
+# '''Third Party Assessments''': Alternate assessment options or contractual exceptions if the auditing is required as per the consumer's security posture but provider does not allow it [6].
 ==Related Incidence==

@@ Line 29: / Line 29: @@
 #'''Wordpress Outage June 2010'''
-WordPress that houses high profile blogging sites  (such as CNN, Techcrunch), 3 data centers (1300 servers , 10 million blogs) had an outage due to config changes done by programmer (to a database field). It impacted a large set of tenants on this multitenant blogging service.
+WordPress that houses high profile blogging sites  (such as CNN, Techcrunch), 3 data centers (1300 servers , 10 million blogs) had an outage due to config changes done by programmer (to a database field). It impacted a large set of tenants on this multitenant blogging service [7,8,9].
 ==Reference:==

@@ Line 35: / Line 35: @@
 # http://people.csail.mit.edu/tromer/papers/cloudsec.pdf
 # http://www.cloudsecurityalliance.org/csaguide.pdf
 [[Category:OWASP Cloud ‐ 10 Project]]

@@ Line 11: / Line 11: @@
 # '''Shared Services can become single point of failure''': If the provider has not architected well the common services, they can easily become single point of failure due to misuse or abuse by a tenant.
 # '''Uncoordinated Change Controls and Mis configurations''': When multiple tenants are sharing the underlying infrastructure all changes needs to be well coordinated and tested .
-# '''Co-mingled Data''' : To reduce cost providers may be storing the data from multiple tenants in same database table-spaces and backup tapes. Data destruction can become a challenge in multi-tenancy especially if data is stored in the shared media (databases, backups, archives).
+# '''Co-mingled Tenant Data''' : To reduce cost providers may be storing the data from multiple tenants in same database table-spaces and backup tapes. Data destruction can become a challenge in multi-tenancy especially if data is stored in the shared media (databases, backups, archives).
+# '''XaaS Specific Risks'''
-# SaaS: Multiple clients (tenants) may be sharing the same application stack ( database, app/web servers, networking). That means the data from multiple tenants may get stored in the same database, may get backed up and archived together, may be moving on common networking devices (unencrypted), and managed by common application processes. This puts a heavy emphasis on logical security built within the application to separate one tenant's users from others.
+## '''SaaS''': Multiple clients (tenants) may be sharing the same application stack ( database, app/web servers, networking). That means the data from multiple tenants may get stored in the same database, may get backed up and archived together, may be moving on common networking devices (unencrypted), and managed by common application processes. This puts a heavy emphasis on logical security built within the application to separate one tenant's users from others.
-# PaaS: Platform stack is shared among the tenants. Vulnerability in the platform stack can allow bleeding between tenants. Shared data backups and archives.
+## '''PaaS''': Platform stack is shared among the tenants. Vulnerability in the platform stack can allow bleeding between tenants. Shared data backups and archives.
-# IaaS: Cross Virtual machine attacks. Cross network traffic listening. Co-residents with lower security posture, where they are less concerned about keeping their hosts hardened and patched [5]. Especially when these hosts gets compromised and owned by the attackers.
+## '''IaaS''': Cross Virtual machine attacks. Cross network traffic listening. Co-residents with lower security posture, where they are less concerned about keeping their hosts hardened and patched [5]. Especially when these hosts gets compromised and owned by the attackers.
 ==Countermeasures==