Cloud Computing-Security Threats-I

Top security threats organizations face when using cloud services

Enterprises are no longer sitting on their hands, wondering if they should risk migrating applications and data to the cloud. They're doing it -- but security remains a serious concern.

The first step in minimizing risk in the cloud is to identify the top security threats.

The shared, on-demand nature of cloud computing introduces the possibility of new security breaches that can erase any gains made by the switch to cloud technology, the CSA warned. As noted in previous CSA reports, cloud services by nature enable users to bypass organization-wide security policies and set up their own accounts in the service of shadow IT projects. New controls must be put in place.

Threat No. 1: Data breaches

Cloud environments face many of the same threats as traditional corporate networks, but due to the vast amount of data stored on cloud servers, providers become an attractive target. The severity of potential damage tends to depend on the sensitivity of the data exposed. Exposed personal financial information tends to get the headlines, but breaches involving health information, trade secrets, and intellectual property can be more devastating.

When a data breach occurs, companies may incur fines, or they may face lawsuits or criminal charges. Breach investigations and customer notifications can rack up significant costs. Indirect effects, such as brand damage and loss of business, can impact organizations for years.

Cloud providers typically deploy security controls to protect their environments, but ultimately, organizations are responsible for protecting their own data in the cloud. The CSA has recommended organizations use multifactor authentication and encryption to protect against data breaches.

Threat No. 2: Compromised credentials and broken authentication 

Data breaches and other attacks frequently result from lax authentication, weak passwords, and poor key or certificate management. Organizations often struggle with identity management as they try to allocate permissions appropriate to the user’s job role. More important, they sometimes forget to remove user access when a job function changes or a user leaves the organization.

Multifactor authentication systems such as one-time passwords, phone-based authentication, and smartcards protect cloud services because they make it harder for attackers to log in with stolen passwords. The Anthem breach, which exposed more than 80 million customer records, was the result of stolen user credentials. Anthem had failed to deploy multifactor authentication, so once the attackers obtained the credentials, it was game over.

Many developers make the mistake of embedding credentials and cryptographic keys in source code and leaving them in public-facing repositories such as GitHub. Keys need to be appropriately protected, and a well-secured public key infrastructure is necessary, the CSA said. They also need to be rotated periodically to make it harder for attackers to use keys they’ve obtained without authorization.

Organizations planning to federate identity with a cloud provider need to understand the security measures the provider uses to protect the identity platform. Centralizing identity into a single repository has its risks. Organizations need to weigh the trade-off of the convenience of centralizing identity against the risk of having that repository become an extremely high-value target for attackers.

Threat No. 3: Hacked interfaces and APIs

Practically every cloud service and application now offers APIs. IT teams use interfaces and APIs to manage and interact with cloud services, including those that offer cloud provisioning, management, orchestration, and monitoring.

The security and availability of cloud services -- from authentication and access control to encryption and activity monitoring -- depend on the security of the API. Risk increases with third parties that rely on APIs and build on these interfaces, as organizations may need to expose more services and credentials, the CSA warned. Weak interfaces and APIs expose organizations to security issues related to confidentiality, integrity, availability, and accountability.

APIs and interfaces tend to be the most exposed part of a system because they're usually accessible from the open Internet. The CSA recommends adequate controls as the “first line of defense and detection.” Threat modeling applications and systems, including data flows and architecture/design, become important parts of the development lifecycle. The CSA also recommends security-focused code reviews and rigorous penetration testing.

Cloud Computing

Cloud computing is the delivery of computing services—servers, storage, databases, networking, software, analytics and more—over the Internet (“the cloud”). Companies offering these computing services are called cloud providers and typically charge for cloud computing services based on usage, similar to how you are billed for water or electricity at home. 

Uses of cloud computing

You are probably using cloud computing right now, even if you don’t realise it. If you use an online service to send email, edit documents, watch movies or TV, listen to music, play games or store pictures and other files, it is likely that cloud computing is making it all possible behind the scenes. The first cloud computing services are barely a decade old, but already a variety of organisations—from tiny startups to global corporations, government agencies to non-profits—are embracing the technology for all sorts of reasons. Here are a few of the things you can do with the cloud:

• Create new apps and services
• Store, back up and recover data
• Host websites and blogs
• Stream audio and video
• Deliver software on demand
• Analyse data for patterns and make predictio

Active Directory Overview and its Components

ACTIVE DIRECTORY (OVERVIEW)

Keeping track of everything on your network is a time-consuming task. Even on small networks, users tend to have difficulty finding network file and printer shares. Without some kind of network directory, medium and large networks are impossible to manage, and users will often have a difficult time finding resources on the network.

Previous versions of Microsoft Windows included services to help users and administrators find network resources. Network Neighborhood is useful in many environments, but users often complain about the clumsy interface, and its unpredictability baffles many administrators. The WINS Manager and Server Manager could be used to view a list of systems on the network, but they were not readily available to end users. Administrators utilized User Manager to add and delete users, an entirely different type of network object. These applications got the job done, but proved to be inefficient—especially in large networks.

All of these objects resided in a common container: the Microsoft Windows NT domain. Windows NT domains worked best in small-sized and medium-sized environments. Administrators of large environments were forced to partition their network into multiple domains interconnected with trusts. Microsoft Windows 2000 Server introduces Active Directory to replace domain functionality. Active Directory will continue to get the job done, but in a much more efficient way. Active Directory can be replicated between multiple domain controllers, so no single system is critical. In this way, the crucial data stored within Active Directory is both redundant and load-balanced.

A directory, in the most generic sense, is a comprehensive listing of objects. A phone book is a type of directory that stores information about people, businesses, and government organizations. Phone books typically record names, addresses, and phone numbers. Active Directory is similar to a phone book in several ways, and it is far more flexible. Active Directory will store information about organizations, sites, systems, users, shares, and just about any other network object that you can imagine. Not all objects are as similar to each other as those stored in the phone book, so Active Directory includes the ability to record different types of information about different objects. This chapter will teach you

• What Active Directory is
• How standard protocols like DNS dynamic update protocol and Lightweight Directory Access Protocol (LDAP) are used
• How to plan for migrating to Active Directory
• What objects, schema, object classes, and attributes are
• How replication and partitioning work
• What the global catalog is useful for and how to use it.

Active Directory Components

As I mentioned in the introduction, Active Directory stores information about network components. It allows clients to find objects within its namespace. The term namespace (also known as console tree) refers to the area in which a network component can be located. For example, the table of contents of this book forms a namespace in which chapters can be resolved to page numbers. DNS is a namespace that resolves host names to IP addresses. Telephone books provide a namespace for resolving names to telephone numbers. Active Directory provides a namespace for resolving the names of network objects to the objects themselves. Active Directory can resolve a wide range of objects, including users, systems, and services on a network.

Everything that Active Directory tracks is considered an object. An object is any user, system, resource, or service tracked within Active Directory. The generic term object is used because Active Directory is capable of tracking a variety of items, and many objects can share common attributes.

Attributes describe objects in Active Directory. For example, all User objects share attributes to store a user name, full name, and description. Systems are also objects, but they have a separate set of attributes that include a host name, an IP address, and a location.

The set of attributes available for any particular object type is called a schema. The schema makes object classes different from each other. Schema information is actually stored within Active Directory, which allows administrators to add attributes to object classes and have them distributed across the network to all corners of the domain, without restarting any domain controllers.

A container is a special type of object used to organize Active Directory. It does not represent anything physical, like a user or a system. Instead, it is used to group other objects. Container objects can be nested within other containers.

Each object in an Active Directory has a name. These are not the names that you are accustomed to, like "Tony" or "Eric." They are LDAP distinguished names. LDAP distinguished names are complicated, but they allow any object within a directory to be identified uniquely regardless of its type. 

The term tree is used to describe a set of objects within Active Directory. When containers and objects are combined hierarchically, they tend to form branches—hence the term. A related term is contiguous subtree, which refers to an unbroken branch of the tree.

Continuing the tree metaphor, the term forest describes trees that are not part of the same namespace but that share a common schema, configuration, and global catalog. Trees in a forest all trust each other, so objects in these trees are available to all users if the security allows it. Organizations that are divided into multiple domains should group the trees into a single forest.

A site is a geographical location, as defined within Active Directory. Sites correspond to logical IP subnets, and as such, they can be used by applications to locate the closest server on a network. Using site information from Active Directory can profoundly reduce the traffic on wide area networks.

SNMP Management Systems and Agent

SNMP Management Systems and Agents

SNMP locates the network management component on one or more computers and locates the managed component on multiple managed devices:

• SNMP manager. An SNMP manager, also known as an SNMP management system or a management console, is any computer that sends queries for IP-related information to a managed computer, known as an SNMP agent. In some cases, the SNMP manager can send a request to an SNMP agent to change a configuration value.
• SNMP agent. An SNMP agent is any computer or other network device that monitors and responds to queries from SNMP managers. The agent can also send a trap message to the manager when specified events, such as a system reboot or illegal access, occur.

A computer on which you install SNMP management software is an SNMP manager, and a computer on which you install agent software, such as the Microsoft SNMP agent included with Windows Server 2003, is an SNMP agent. The SNMP manager displays the information it receives in a user-friendly graphical user interface. You configure SNMP options, including traps, on the SNMP agent, but the SNMP agent does not display the managed information that it sends to an SNMP manager. For more information about SNMP requests and trap messages, see “SNMP Messages” later in this section.

To enable SNMP communications between an SNMP manager and SNMP agents, you configure the SNMP manager and the SNMP agents that it manages as members of an SNMP community. The community name functions like a password to authenticate communications between the SNMP manager and agent. The SNMP community is an SNMP-defined group, not a group defined in the Active Directory directory service. For more information about SNMP communities, see “SNMP Communities” later in this section.

An SNMP manager can request the following types of information from the SNMP agents that it monitors:

• Network protocol identification and statistics
• Dynamic identification (discovery) of devices attached to the network
• Hardware and software configuration data
• Device performance and usage statistics
• Device error and event messages
• Program and application usage statistics

If you assign the SNMP manager write permission for the SNMP agent, the SNMP manager can also send a configuration request to the agent (using a Set message) to change a local parameter. However, Set requests are limited to a small set of client parameters that have read-write access defined. Most client parameters allow only read-only access.

Understanding the Management Information Base (MIB)

When an SNMP manager requests information from an SNMP agent, the SNMP agent retrieves the current value of the requested information from the Management Information Base (MIB). The MIB defines the managed objects that an SNMP manager monitors (or sometimes configures) on an SNMP agent.

Each system in a network (workstation, server, router, bridge, and so forth) maintains a MIB that reflects the status of the managed resources on that system, such as the version of the software running on the device, the IP address assigned to a port or interface, the amount of free hard drive space, or the number of open files. The MIB does not contain static data, but is instead an object-oriented, dynamic database that provides a logical collection of managed object definitions. The MIB defines the data type of each managed object and describes the object.

The MIB Tree

The SNMP-related branches of the MIB tree are located in the internet branch, which contains two main types of branches:

• Public branches (mgmt=2), which are defined by the Internet Engineering Task Force (IETF) RFCs, are the same for all SNMP-managed devices.
• Private branches (private=4), which are assigned by the Internet Assigned Numbers Authority (IANA), are defined by the companies and organizations to which these branches are assigned.

The following figure shows the structure of the SNMP MIB tree. There are no limits on the width and depth of the MIB tree.

Immediately beneath the root of the MIB tree, International Organization for Standardization (iso), is the Organization (org) branch, followed by Department of Defense (dod), and then Internet (internet). Management (mgmt), the main public branch, defines network management parameters common to devices from all vendors. Underneath the Management branch is MIB-II (mib-2), and beneath this are branches for common management functions such as system management, printers, host resources, and interfaces.

The private branch of the MIB tree contains branches for large organizations, organized under the enterprises branch. Each organization has a root branch node under this object. Each organization creates its own subset of MIB branches and objects, which must comply with a common definition of SNMP information known as Structure of Management Information (SMI). SMI defines the allowed data types for MIB objects.

MIB Objects

At the programmatic level, the definition of each MIB object that an SNMP agent manages includes the following elements:

• The object name and object identifier (also known as an OID).
• A text description of the object.
• The object’s data-type definition (such as counter, string, gauge, or address).
• The index for objects that are assigned complex data types. The index specifies the key field for the table — that is, the field that can be used to identify a row.
  
  The only complex SNMP data type that is allowed is a table, and tables cannot be nested. Examples include the list of a system’s network interfaces, a routing table, or the Address Resolution Protocol (ARP) table.
• The level of access to the object (such as read or read/write) that is allowed.
• Size restrictions.
• Range information.

SNMP references each MIB variable by using its unique object identifier, which identifies the location of a given managed object within the MIB namespace. The object identifier reflects the object’s position within the hierarchy of the MIB tree, containing a sequence of subidentifiers that begin at the root of the MIB tree and end at the object (leaf node). Subidentifiers are separated with a period.

To reference a MIB object, you can use either numeric or text subidentifiers. For example, the following text-based object identifier is interchangeable with its numeric counterpart, shown beneath it. The value of this object identifier, in either format, identifies the current operational state of a network adapter.

Interacting with MIB Objects

To understand how SNMP interacts with MIB objects, you must first understand that the SNMP agent consists of a master agent and one or more subagents, also known as extension agents, which are the dynamic link libraries (DLLs) that SNMP uses to process a request received from an SNMP manager.

When the SNMP service starts, it loads each SNMP extension agent that is listed in the registry. When the master agent receives a request from the SNMP manager, it passes the request to an extension agent, which accesses the appropriate MIB and returns the current value of the relevant MIB object to the SNMP master agent. The SNMP agent then returns the information to the SNMP manager. An SNMP agent can also send unsolicited MIB information to the SNMP manager in response to an event that has been defined as an SNMP trap (unexpected event). In some cases, the SNMP agent changes (or sets) the value of the MIB object.

For example, in order to assess the network load at a particular point in your network, you can use SNMP to retrieve the value of a counter that tracks the number of packets sent over a link to the SNMP agent. Or you might use SNMP to retrieve the value that represents the amount of disk space available for storage. Although SNMP is used less commonly to set the value of a MIB object, to ensure that a link is not used, you might use SNMP to set the link state value of a MIB object to a disabled state.

Compiling a New or Updated MIB File by Using Mibcc.exe

As explained earlier, the SNMP-related branches of the MIB tree are located in the internet branch of the tree. The internet branch contains public branches that are defined by the IETF and private branches that are defined by large organizations. When an organization creates its own subset of MIB branches and objects, or updates an existing MIB file, the new or updated MIB file must be created in compliance with SMI-prescribed data types.

If your organization adds or updates a new MIB file, use the Mibcc.exe tool to compile the MIB file so that the SNMP Management API (Mgmtapi.dll) can use the MIB objects in the new or updated MIB file. After you compile the MIB file, you can reference objects by their text object identifiers instead of their numeric object identifiers. The ASN.1 language is used to define the formats of the protocol data units (PDUs) that are exchanged by SNMP entities and to define the objects that are managed through SNMP. Mibcc.exe converts the ASN.1 MIB description into the binary Mib.bin file, which the Management API then uses to map text-based object names to numeric object identifiers.

You can find Mibcc.exe in the C:\Program Files\Resource Kit folder when you install the Windows Server 2003 Resource Kit companion CD. The Mib.bin file is located in systemroot on Windows Server 2003

SNMP And its Working

Simple Network Management Protocol

Use Simple Network Management Protocol (SNMP) management software to monitor any network device configured with SNMP agent software. The SNMP agent, which is an optional component of Windows Server 2003, interacts with third-party SNMP management software to enable the flow of network status information between monitored devices and applications and the management systems that monitor them.

You can use SNMP in environments that include large networks with hundreds or thousands of nodes that would otherwise be difficult and costly to monitor. SNMP allows monitoring of network devices such as servers, workstations, printers, routers, bridges, and hubs, as well as services such as Dynamic Host Configuration Protocol (DHCP) or Windows Internet Name Service (WINS).

SNMP Architecture

To perform its monitoring services, SNMP uses a distributed architecture of management systems and agents and several related components. Windows Server 2003 provides an SNMP agent that is designed to be capable of interacting with any SNMP manager. The following components are the building blocks of SNMP and the Windows Server 2003 SNMP agent:

• SNMP management systems and agents
• Management Information Base (MIB)
• SNMP Messages
• SNMP Communities
• The communication process between SNMP managers and agents 
• 

The internal architecture of the Windows Server 2003 implementation of SNMP is divided into management and agent functions, which, in some cases, overlap. The following figure illustrates how the Windows Server 2003 SNMP structure fits into the layers of the underlying TCP/IP protocol architecture.

Where is Proxy Server used??

Where is a Proxy server used?

Proxy servers are used for several purposes. If it is used as a caching web proxy, it can dramatically improve performance of a web response. When a request is made by a client, a caching proxy returns response directly from its cache if the document already exists. Otherwise, it makes the request to the real server, returns the result, and save it in its cache for later use.

Proxy servers are also used as "web proxies" to filter web page contents. An organization or company may use a proxy server to block offensive web contents from viewed by the users. Considering the growing need within organizations to prevent employees from accessing specific websites, such as facebook.com, proxy servers are being deployed across the computers connected to the intranet. Some web proxies are able to reformat web pages to suit a specific set of audience, or cater certain organizational or personal internet usage purposes. Further, web proxies can be used to prevent the attack of computer viruses and malware, as well as other hostile content transferred across the internet web pages. However, users can also use web proxy servers to access those blocked sites indirectly. These web proxies are built with PHP or CGI to implement the proxying functionality, and provide web access to those sites blocked by corporation and school proxies. Moreover, Internet Service providers (ISPs) may also use proxies to block computer viruses and other offensive contents.

There are several advantages of Proxy servers. We intend to provide some of the most basic uses of proxy servers.

Performance Improvement:

Proxy servers also contribute to improved web performance since the results of the user requests are saved in cache memory for a set period of time. This is achieved with the help of a caching proxy server, which could save a large amount of time while catering to the requests from a vast user load. A caching proxy server maintains a local copy of frequently requested web content. Hence, it can accelerate service requests by retrieving content from the cache memory, if it had already been requested by another client on the same network. This feature contributes to a significant reduction in upstream bandwidth usage and costs for large organizations with thousands of employees.

Monitoring and Filtering User Requests:

As discussed earlier, web proxies can be used to filter user requests, and block certain content or web pages from being accessed. This can be achieved with the help of a content-filtering web proxy server that differentiates the users’ level of control over the content, based on the user type - Guest or Administrator.

Content-filtering proxies are generally used in organizations and educational institutions with strict internet-usage policies. Blocking certain websites, and restricting access to specific key words and censoring undesirable content are some of the basic features provided by content-filtering or web-filtering proxies. However, there are certain web proxies that are used to bypass geo-restrictions and censorship regulations by using certain advanced services that help access resources from blacklisted web locations.

Anonymous Browsing:

An anonymous proxy server is another type of web proxy that anonymizes users' online activities. This type of proxy server directs the user requests to a destination server, which ultimately has no knowledge of the source of the request. Only the proxy is aware of the source of the request, including the user IP address and location.

Advertisements targeting specific geographical regions Web Proxies can also be used to validate and verify geo-targeted advertisements. Servers of such ads validate the source IP address of the user request, and determine the geographic location of the request with the help of a geo-IP database. The user requests are responded via proxy servers that are located within the respective geographical location, to ensure that advertisements displayed are purely relevant to the users’ location.

Translation:

Considering the global audiences, translation proxies have been developed to localize/translate the content of a source website into a local language of the client computer. Responses for requests sent by local users are replaced with translated content from the source website, and passed back through the proxy server. Some translation proxies also provide additional services such as excluding source content or substituting source content with original local content.

Conclusion

The most popular proxy server used today is a Web Proxy, and it is used to filter contents and allow anonymous browsing. Being able to unblock geo-restricted content is also a wide used application for using public web proxies. Although proxies provide anonymous browsing and content filtering, they are mostly limited to web browsing and also lack security. For secure and encrypted communication with privacy protection, we recommend VPN solution.

Proxy Server and its uses

A proxy or proxy server is basically another computer which serves as a hub through which internet requests are processed. By connecting through one of these servers, your computer sends your requests to the proxy server which then processes your request and returns what you were wanting. In this way it serves as an intermediary between your home machine and the rest of the computers on the internet. Proxies are used for a number of reasons such as to filter web content, to go around restrictions such as parental blocks, to screen downloads and uploads and to provide anonymity when surfing the internet.

Why Use a Proxy?

If you are wanting to surf the web anonymously then proxies can provide you with a means to hide your home IP address from the rest of the world. By connecting to the internet through proxies, the home IP address of your machine will not be shown but rather the IP of the proxy server will be shown. This can provide you with more privacy then if you were simply connecting directly to the internet. There are number of proxies that can provide you with service. You can find a list of these simply by typing "Proxy List" into any search engine. There are some proxies which are free and some which charge money, the choice is up to you but we have found that the paid proxies are more reliable, faster and more secure.

What is a proxy server?

Proxy server is a computer that sits between a client computer and the Internet, and provide indirect network services to a client. It may reside on the user's local computer, or at various points between the user's computer and destination servers on the Internet. A proxy server intercepts all client requests, and provide responses from its cache or forwards the request to the real server. A client computer is connected to the proxy server, which acknowledges client requests by providing the requested resource/data from either a specified server or the local cache memory. Client requests include files or any other resources available on various servers.

Types of Proxy Servers

Proxy servers are classified into several types based on purpose and functionality. Some of the most common types and their uses can be described as below:

Web Proxy is the most common type of proxy application, which responds to the user requests by accessing resources from cached web pages and files available on remote web servers. This facilitates quick and reliable access to data for local network clients. If the requested resource is not found in the cache, then a web proxy fetches the file from the remote server, and saves a copy in the cache before returning it to the client.

Transparent Proxy is mostly used for caching websites and overcoming simple IP bans. However, such proxies do not provide any user anonymity since user’s original IP address is exposed. Transparent proxies are not specifically configured on the client computers.

Anonymous proxies do not hide the original IP address of the user; however, they provide adequate anonymity to most users. Anonymous proxies are easily detectable.

A distorting proxy, identifies itself as a proxy server, and modify the HTTP headers to disguise the original IP address.

Tunneling proxies are capable of passing client requests and return responses without making any modifications. These are also referred to as gateway proxies.

A forward proxy responds to client requests by retrieving data from a wide range of sources on the internet. It is also referred to as an Internet-facing proxy.

Open proxies belong to the category of forwarding proxy servers, which are accessible by any internet user since they can receive and return requests from any client computer. Meanwhile, anonymous open proxies are used for user anonymity to conceal the IP address.

Reverse proxies, also known as surrogates, usually receive requests from the Internet and forward them to internal network servers. A reverse proxy server forwards requests to one or more proxy servers, whose response is returned to the client computer, the user of which has no knowledge on the origin of the response.