SaaS as a Security Hazard The Google Apps example

Transcription

1 SaaS as a Security Hazard The Google Apps example Ofer Shezaf, ofer@shezaf.com

2 About Myself I live in Kibbutz Yiftah, Israel I create security products I am an application security veteran I really try to learn what information security is Currently, Product Manager for Security Solutions at HP ArcSight Prior to that did security research and product management at Breach Security & at Fortify OWASP leader and founder of the OWASP Israeli chapter Leads the Web Application Firewall Evaluation Criteria project Wrote the ModSecurity Core Rule Set Read my blog at Be ready to some philosophy of science and cognitive psychology

3 What are Google Apps? Gmail, Calendar, Docs, Sites & Groups Google alternative to Exchange, SharePoint, Outlook and to a lesser extent to Office. Better at sharing and in a way familiar to users Bottom up push to adapt.

4 If It Was Only Cloud

5 Google Apps Role in the IT Environment Hybrid Delivery Traditional Private Cloud Managed Cloud Public Cloud 1 SAAS Non-critical business services will move to SaaS providers who provide some level of security 2 SAAS Some critical business services will be deployed in private clouds with customized security controls 3 4 SAAS Some work-loads will move to public clouds with security components provisioned in image Security will be componentized and automatically deployed with work-loads, based on sensitivity of assets customization required automated provisioning Note: future availability of hybrid capabilities 5

6 No, it is not about SQL injection Google is better than your programmers in weeding out SQL injections So what is it about?

7 Ownership

8 Cloud Entrance Exam: Question 1 Who Owns The Data? You? Google? Your Employee? Google s Employee?

9 Cloud Entrance Exam: Question 2 Do You Compete With Google? No (are you serious?) We do, but not me I don t know Yes (You Bet!)

10 Cloud Entrance Exam: Question 3 Who Authorized Access to the Data? Me Google Google, but only if the court asks Google, but only if the Chinese ask

11 Cloud Entrance Exam: Question 4 What About Illegal Material? I never store such data! apart from competitive marketing and stolen images in presentations but Google would not interfere with my data Or would they?

12 Regulations

13 It s All About Geography Privacy National laws Limitation of transfer of data Compliance PCI, SOX, SAS 70, ISO 27K So where is the data? And who is responsible for it? Ownership Google or I?

14 Back To Basics

15 Where and What do we Manage? Hybrid Delivery Authentication Traditional Private Cloud Managed Cloud Public Cloud SAAS Authorization SAAS SAAS Audit Note: future availability of hybrid capabilities 15

16 Authentication & User Management Password strength is of extreme importance in web based services. Complexity, length, lifetime Two factor authentication is preferred. Avoid requiring users to have multiple complex passwords Sticky note passwords Need to make sure users are created, terminated and transferred on all services. SaaS MUST tie in to enterprise directory.

17 Users Permissions & Authorization Tools both for SaaS and self hosted are not mature. Always a hazard in knowledge sharing applications. Unique to SaaS solutions is the option to share externally. Both permissions management and permissions audit are crucial

18 Audit Public Cloud HP ArcSight On/Off-Premise Data Center remote workers

19 For Further Consideration

20 Did You Consider? Encryption: Administrator Access Control Administration Capabilities Backup and Restore SSL Disks Two factor authentication? Only from within the organization? Can your administrators access users data if needed? Service Level Agreement (SLA) Service for Accidental Deletes Disaster Recovery Way out

21 For Further Questions Contact: Ofer Shezaf