Cloud-10 Infrastructure Security

R9:Infrastructure Security

The security of the data hosted within an application is totally dependent upon the security of the infrastructure components that make up the platform for the application. Failure to take "best practices" into account can lead to a loss of data, reputation, or availability, and may even have regulatory/legal ramifications.

Security Risks

1. Default configurations of systems and network devices
2. All services, even active, unused ones, may contain security related bugs that potentially can be exploited.
3. Compromised services may be used as "hop-off" points to other services, unless they are contained. For example, a compromised web service may lead to a compromised backend database, if the database can be reached directly from the web tier.
4. Active network protocols, and open ports, may be exploited even if they are not used in the solution architecture
5. Administrative access may be abused, either deliberately by the administrators, or through compromised administrative accounts. Furthermore administrative access can cause disruption through accidents
6. All code (application, OS, network) will contain security related bugs, and configurations may contain configuration mistakes, that can be exploited.

Countermeasures

2. Hardening of operating systems, applications and configurations
3. Tiering of the solution architecture
4. Isolation of infrastructure components, for example through the use of network ACLs, to reduce the
   
5. Role-based administrative access, restricted administrative privileges
6. Regular vulnerability assessments

References

1. Center for Internet Security (CISecurity)