Applying the CIS Critical Security Controls to the Cloud Bart Westerink April 26, 2016

Agenda Migration to the cloud Overview of the top 20 security controls Adapting the controls to the cloud Leverage the controls to build a highly secure cloud infrastructure

Primary Motivation for Deploying Public Cloud IaaS Source: Gartner

Shared Responsibility of Security

Traditional Security Perimeter Network segmentation Strict change controls Slower rate of change Dedicated security hardware

Securing the Cloud Shared responsibility No natural perimeter No network segmentation Elastic and on-demand No dedicated security hardware

What are the Top 20 Critical Controls? A prioritized, risk-based approach to cybersecurity In 2008, the NSA led a consortium of security professionals from government and experts from the private industry, who were asked: “In practice, what works and where do you start?” The Critical Controls have become a blueprint to help CISOs deploy controls that have the greatest impact in improving risk posture Organizations should focus on securing the business first - and documenting the process to show compliance second

Five Critical Tenets used to develop the Controls Offense informs defense Prioritization Metrics Continuous monitoring Automation

Five Critical Tenets #1 - Offense informs Defense Intelligence agencies have performed thousands of investigations Controls are derived from the most common attack patterns All Rights Resevered - CloudPassage

Five Critical Tenets #2 - Prioritization Some controls have greater impact on security risk than others Should I focus on configuration monitoring or awareness training?

Five Critical Tenets #3 - Metrics How many servers are out of compliance with policy? What percentage of my servers have critical vulnerabilities?

Five Critical Tenets #4 - Continuous Monitoring Understand the state of systems at any given time Critical for rapid response A continuous feedback loop to validate your security controls is essential

Five Critical Tenets #5 - Automation Security teams need to find ways to do more with less Managing workloads in elastic cloud environments requires automation

The Top 20 Critical Controls...

#1 Inventory of Authorized and Unauthorized Devices Control Description Family CSC1-1 Deploy an automated asset discovery tool. Employ both active and passive tools System CSC1-4 Record network address, system name, purpose and asset owner. CSC1-5 Deploy network level via 802.1x to limit and control which devices can be connected to the network. Must be tied to inventory. In the public cloud, use host-based firewalls to keep unauthorized or unmanaged systems off your Ephemeral resources are still in scope for auditor inspection

#2 Inventory of Authorized and Unauthorized Software Control Description Family CSC2-1 Device a list of authorized software and use file integrity checking to validate that the software has not been modified System CSC2-2 Deploy application whitelisting technology that allows systems to run software only if it is included on the whitelist and prevents execution of all other software on the system CSC2-3 Deploy a software inventory tool. Track OS, applications, version info, patch levels CSC2-4 Virtual machines and/or air-gapped systems should be used to isolate and run applications that are required for business operations but based on higher risk... location. Maintaining a real-time inventory of software enables rapid response

#3 Secure Configurations for Hardware and Software Control Description Family CSC3-4 Perform all remote administration of servers, workstation, network devices, and similar equipment over secure channels. System CSC3-5 Utilize file integrity checking tools to ensure that critical system files (including sensitive system and application executables, libraries, and configurations) have not been altered CSC3-6 Implement and test an automated configuration monitoring system. This includes detecting new listening ports, new administrative users, changes to group and local policy objects, (where applicable), and new services running on a system. Developing initial configuration settings is a complex task and systems must be continually managed to avoid security “decay” In the cloud, control costs using lightweight security solutions which provide breadth

#4 Continuous Vulnerability Assessments and Remediation Control Description Family CSC4-1 Run automated vulnerability scanning tools against all systems on the network on a weekly (or more frequent) basis System CSC4-5 Deploy automated patch management tools and software update tools for operating system and software/applications on all systems CSC4-6 Monitor logs for unapproved scanning activity CSC4-8 Establish a process to risk-rate vulnerabilities based on the exploitability and potential impact of the vulnerability Continuous monitoring of vulnerabilities enables rapid response Host based scanners provide great visibility, efficiency and speed

#5 Controlled Use of Administrative Privileges Description Family CSC5-1 Minimize administrative privileges and only use administrative accounts when they are required. Implement focused auditing on the use of administrative privileged functions and monitor for anomalous behavior. System CSC5-3 Before deploying any new devices in a networked environment, change all default passwords for applications, operating systems, routers, firewalls, wireless access points, and other systems to have values consistent with administration-level accounts CSC5-4 Configure systems to issue a log entry and alert when an account is added to or removed from a domain administrators’ group, or when a new local administrator account is added on a system Closely monitor the creation of privileged accounts Use multifactor authentication to protect administrative accounts

#6 Monitoring and Analysis of Audit Logs Control Description Family CSC6-4 Have security personnel and/or system administrators run bi-weekly reports that identify anomalies in logs. They should then actively review the anomalies, documenting their findings. System CSC6-5 Configure network boundary devices, including firewalls, network-based IPS, and inbound and outbound proxies, to verbosely log all traffic (both allowed and blocked) arriving at the device. CSC6-6 Deploy a SIEM (Security Incident and Event Management) or log analytic tools for log aggregation and consolidation from multiple machines and for log correlation and analysis. Automate the collection and reporting of logs Human expertise and intuition are required to identify and understand attack patterns

#7 Email and Web Browser Protections Control Description Family CSC7-3 Limit the use of unnecessary scripting languages in all web browsers and email clients. This includes the use of languages such as ActiveX and JavaScript on systems where it is unnecessary to support such capabilities System CSC7-6 Enforce network based URL filters that limit a system's ability to connect to websites not approved by the organization. The organization shall subscribe to URL categorization services to ensure that they are up-to-date with the most recent website category definitions available. CSC7-8 Scan and block all e-mail attachments entering the organization's e-mail gateway if they contain malicious code or file types that are unnecessary for the organization's business. Endpoints used to manage production systems should be locked down and monitored closely Use secure jump hosts to separate endpoints from production systems

#8 Malware Defenses Control Description Family CSC8-1 Employ automated tools to continuously monitor workstations, servers, and mobile devices with anti-virus, anti-spyware, personal firewalls, and host-based IPS functionality. All malware detection events should be sent to enterprise anti-malware administration tools and event log servers. System CSC8-5 Use network-based anti-malware tools to identify executables in all network traffic and use techniques other than signature-based detection to identify and filter out malicious content.. CSC8-6 Enable DNS query logging to detect hostname lookup for known malicious C2 domains. As malware becomes more evasive, re-assess NIDS vs HIDS Monitor logs, file changes, firewall connections and policy violations

#9 Limitation and Control of Network Ports

#10 Data Recovery Capability

#11 Secure Configurations for Network Devices

#12 Boundary Defense Control Description Family CSC12-2 On DMZ networks, configure monitoring systems (which may be built into the IDS sensors or deployed as a separate technology) to record at least packet header information Network CSC12-3 Deploy network-based IDS sensors on Internet and extranet DMZ systems and networks that look for unusual attack mechanisms and detect compromise of these systems In the public cloud, use host-based firewalls to keep unauthorized or unmanaged systems off your network Standardize across public, private or hybrid cloud deployments

#12 Boundary Defense Adopt a Least Privilege strategy Eliminate “soft and chewy” networks Host based firewalls provide a greater level of micro segmentation

#13 Data Protection Control Description Family CSC13-2 Deploy approved hard drive encryption software to mobile devices and systems that hold sensitive data. Network CSC13-3 Deploy an automated tool on the network perimeter that monitors for sensitive information (e.g. PII) to discover unauthorized attempts to exfiltrate data.. In the public cloud, use use volume based encryption to protect sensitive data on shared storage. Encrypt all network communications Restrict and monitor outbound connectivity and secure remote access

#14 Controlled Access based on Need to Know

#15 Wireless Access Control

#16 Account Monitoring and Control Description Family CSC16-11 Require multi‐factor authentication for all user accounts that have access to sensitive data or systems. Multi‐factor authentication can be achieved using smart cards, certificates, One Time Password (OTP) tokens, or biometrics. Application CSC16-13 Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Implement MFA for remote access management Encrypt all network connections

#17 Security Skills Assessment and Appropriate Training Control Description Family CSC17-2 Deliver training to fill the skills gap. If possible, use more senior staff to deliver the training.. Application CSC17-3 Implement a security awareness program Security professionals must make security processes more embedded, faster and more continuous The cloud accelerates DevOps because it offers scalable environments to develop and test code

#18 Application Software Security Control Description Category CSC18-1 For all acquired application software, check that the version you are using is still supported by the vendor. If not, update to the most current version and install all relevant patches and vendor security recommendations. . Application CSC18-4 Test in-house-developed and third-party-procured web applications for common security weaknesses using automated remote web application scanners prior to deployment. Continuously monitor application libraries and packages for vulnerabilities For applications that rely on a database, use standard hardening configuration templates

#19 Incident Response and Management

#20 Penetration Tests and Red Team

Moving to the Cloud securely... Use the Top 20 Critical Security Controls to guide you Develop sound processes Continuous monitoring, automation Implement the right technology Light-weight / provides breadth Automated / scalable / API / SaaS Work across in public, hybrid and private clouds Benchmark yourself!

Thank You!