Let's take a look at some of the things that make a
secure and reliable application.
The ISO 27034 defines something we know as the Organizational
Normative Framework. In this way, it sets a standard for application
security that says here are all of the security principles that we
should follow in our organization.
It's a library of good controls, and the Organizational
Normative Framework then is this the framework which must be
the norm within our organization?
So all applications we build must incorporate these standards, these norms.
So it becomes then the library of security controls used in this organization.
Now when we write an individual application,
we then have to use what's called the Application Normative Framework,
which quite simply is the subset of those security controls we are
going to use in this application. In this way,
it sets out how we have followed the organizational
normative framework, which is one document,
but we have for each one of our applications that subset,
which is then called the Application Normative Framework.
In order to have cloud security, we must, of course, have network security.
The cloud is heavily reliant on network communications,
both between different systems, as well as out to end users.
It's important that we have network firewalls. In many cases,
this is managed by the cloud service provider,
especially in a Software as a Service,
but it could also be managed by the cloud consumer as well.
We put frameworks and firewalls,
not just at the perimeter or outside edge of our networks,
but we build it into an architectural framework within the network as well.
So we have the ability to separate or segment
different parts of our network internally.
And that way we control traffic going from one
location or network segment into another.
We also have the web application firewalls, which are designed specifically
to examine traffic that's going to our web applications.
It's important we deploy the concept of layered defense or defense in depth.
We don't just rely on one control.
We quite often will have one firewall protecting at our demilitarized zone.
We'll have another one then maybe in behind that at the application. We can
have network‑based intrusion prevention and detection systems in behind the
firewalls as well and, of course, network segmentation.
The cloud security components include these ideas of both network and
host‑based intrusion detection and intrusion prevention systems.
In the case of network‑based, they are monitoring and logging
network traffic. And in the case of host‑based, they would detect
any changes or any requested change to be made on a host. They can
signal us and alert us to any type of suspicious traffic or
potentially unauthorized change.
If it's an IDS, it can be an alert. If it's an IPS, it could
actually block that suspicious activity.
We continue with API gateways.
These monitor and manage traffic at the API level. They log
the traffic. They can perform proxy services to try to hide
or isolate different components.
They can limit bandwidth utilization to make sure that one
process is not hogging all the network resources.
They also support access control at the API level. Almost all of the data of
most organizations today is kept in a series of different databases, and
databases really are the keys to the kingdom, the gold of the kingdom is
there. And our applications will frequently call to a database to check the
status of an order, for example.
And this is where we should have database activity monitoring as well.
Database activity monitoring monitors the traffic going
to that database and can help manage.
Is one process consuming a tremendous amount of, should we say, network
bandwidth? Is there an excessive number of requests or an excessive volume
of traffic related to some type of database call? That could be a symptom
of some type of a security breach.
We also have load balancing,
the ability to divide our load across a number of different channels to
assist with availability and improve our response time.
We all know how it's a lot easier when you have several roads
that go across a city than if there's just one.
And so, even if there's a problem on one,
there's other routes for the traffic to take. The
traffic can balance across each of those.
And of course, these can adjust to any type of network or equipment
failure as well to ensure that we still have some availability even
if there's a failure on one part of the network. This comes into the
area today of breaking that hardware‑based architecture we had for
so many years.
Everything was based on what piece of hardware were you connected to? But
today, we've put an interface on top of our hardware, and that, of course,
allows us to manage the use of those underlying physical components through
some type of virtual management system.
We can do software‑defined storage,
software‑defined networking, and all of these allow us now to manage multiple
channels at a management and software level and be far more flexible than we
ever could be when we just had a hard wired connection, for example. We also
use a lot of edge computing and content distribution networks, so we can
connect people to local servers rather than transmitting all of our data all
over the world. When it comes to hardware, we've talked about this is one of
the attack vectors that has been a problem. Meltdown and Spectre were good
examples of this where there wasn't proper isolation on the actual chips
themselves.
And when I'm dealing with a cloud environment,
which is based on multitenancy,
I want to have proper isolation, that a person is not going to be able to
get access to my data from some other type of process.
We also want to make sure we have a secure supply chain. Can we get the
equipment we need that is then correctly configured, has the elements we require
so it is secure and reliable? But we also want to make sure at end of life, our
equipment is properly disposed of so we don't end up leaking data from old
equipment, which has been just discarded.
One of the things that we, of course, have benefited from over the years,
not just in the cloud, but very much in the cloud is the use of
virtual machines, the idea of sandboxing, being able to isolate one
process from another. Have it run in a virtual machine environment,
which is a type of a logical separation,
not a physical separation.
We can run things in containers, and if there's a problem, it's easy enough to
restart that VM or reestablish that container, and we don't have to turn
around and rebuild everything at a hardware level.
We want to make sure these are properly patched and securely configured as well.
We saw with the OWASP Top 10 that the number two problem
today relates to cryptography. And when we are putting
cryptography into our systems,
it's often good to use the cryptographic features that are already
available in many of our databases and use algorithms that are already
freely available rather than try to create our own.
It's good to follow good practices when it comes to things like key
management, that the keys would not be visible to someone who's
watching the network traffic, for example.
So, the use of cryptography requires some very careful thought and
consideration, maybe through even the use of something like a FIPS 140‑2
or 140‑3 standard and the testing of it. When it comes to key management,
maybe I keep the keys in an isolated non‑network location such as, for
example, a hardware security module, though, of course, many of our HSMs
today are even software.
But the question is, who has the key? In Software as a Service,
the cloud service provider controls all the keys, and they
could be using two different types of keys,
one for traffic out to the end user and a different
cryptographic key for then the storage of data.
The question is whether or not they're using the same key for the
storage of the data for multiple customers or it is all of my data
stored with a different key than the data being stored for one of
my competitors, for example.
So it's good to take a look at who has the key.
What are the good key practices that are being followed to try to
preserve the confidentiality and integrity of my data? One of the
biggest advantages of the cloud, of course, is orchestration,
the ability to schedule and manage all these pieces that run seamlessly and, of
course, to ensure that when there are dependencies, we don't have one program
that runs before another one properly completed.
This is something, of course, we'll look at again in operations.
The key points review. The security of applications is dependent, not
just on the security of the application itself,
but also on the security of the infrastructure and the
networks the application runs and relies on.
It is also integral here that we ensure that we have
knowledgeable staff that are managing, designing,
implementing, operating, and maintaining our security controls.