Cloud Security Tools Which Are Worth It

How can you be protected on the cloud? Cloud computing brings reduced costs, scalability, and increased mobility to businesses along with security concerns. Many organizations are migrating their data and software on to the cloud due to its increased popularity. However, where cloud computing is proving to be beneficial, it is also facing security concerns. Here are some cloud security tools, which are worth it to be secure on the cloud:

BITGLASS

Currently in beta, Bitglass provides protection to business data. It is usable on mobile devices as well as computers. It improves the visibility of data and reduces the risk of data loss. Bitglass gives a combination of security types in one package. For cloud security services specifically, it gives the ability to detect usage of cloud applications, track business data on the internet, and encrypt data, which is uploaded on the cloud. By tracking data on the internet, it allows visibility for file sharing even when employees upload data onto personal file sharing services. Bitglass allows to wipe data on mobile device without using additional software. It provides specific builds for commonly used cloud apps such as Gmail or Salesforce, but variants are also available to configure with any cloud-based applications your business might use.

CIPHERCLOUD

Ciphercloud encrypts data directly at the business gateway. It aims to ensure data security, which is contained within the cloud system. It encrypts data during uploading and decrypts it during downloading. Since the encryption keys remain within the business network, unauthorized users are unable to view data; they will only see indecipherable text.

SKYHIGH NETWORKS

Skyhigh networks allow you to discover and secure the usage of your cloud applications. It provides you with a cloud application risk assessment of all cloud apps being used by your employees, by tracking logs from existing proxies and firewalls. The analysis tools it provides are able to detect inconsistencies in security policies and potential data leaks.

OKTA

Okta aims to provide secure single sign on for all on-premise and mobile cloud applications used in the business. It provides among other features, automated user management, multifactor authentication, support for mobile devices and flexible security policies. It enables you to trace user access to cloud through audit logs and allows setting access policies from a centralized position.

All these security applications provide ample security solutions to tackle threats on cloud computing, but app suitability for your business will depend on your business security needs and problems.

WordPress security risks assessment

WordPress is now one of the most popular blogging platforms in the internet. It is an open source platform and a large number of plugins and additional themes and features are available from different developers and companies. The software can be easily customised and new features, such as contact forms, ecommerce, surveys, membership areas can be added to the web site.

It is not a surprise that hackers target WordPress web sites. There are about 60 million WordPress web sites in the internet, and if a new vulnerability is discovered in the platform, all these sites will become vulnerable and can be compromised.

There are two most common ways how the hackers compromise the WordPress web site:

• Exploiting the well-known or new vulnerability in a plugin or a theme. As mentioned earlier, there is a huge number of plugins available for the WordPress and some of them are written by unskilled developers. According to http://www.cvedetails.com/ WordPress contains about 163 well-known security issues, some of them allow remote code execution.

• Discovering the admin password to the management interface. By default, /wp-admin/ directory is not protected by SSL encryption. This means that if an administration is logging in to the web site from insecure network, for example, WiFi Hotspot, his credentials can be easily intercepted. Also, if the password is not strong, the external hackers can easily brute force the password.

So how to secure your WordPress web site? The internet contains a number of articles on this topic. The official security guide can found on wordpress.com web site: http://codex.wordpress.org/Hardening_WordPress

To summarise some key points:

• Keep your wordpress blog and all the plugins up-to-date. Regularly check the WordPress platform for the updates and apply them as soon as possible. Install updates for the plugins as soon as they are available (obviously you need to test the new versions first and make sure they won’t break your web site). Subscribe to the latest news from the security web sites and monitor the vulnerabilities applicable to your plugins and the version of WordPress you are running.

• Configure the strong password policy for your admin account. The passwords should be at least 8 characters long and should be changes regularly. Also configure your web site to temporary block the admin account after 5 unsuccessful login attempts. Make sure that SSL is implemented to secure the admin credentials: SSL provides the encryption of the username and password so it will be very challenging for the hackers to intercept them.

• Limit the number of users with admin privileges to your web site. Review the user accounts on the regular basis and delete the accounts that were not used for a long time. Keeping the large number of users with admin privileges will increase your risk of being compromised. Even if you use SSL encryption for your web site, your users may use weak passwords or reuse the same passwords for different services.

The risks described above are just some of the risks the business owners inherit when they use the WordPress platform for their web sites. Although most of the risks can be remediated by implementing the appropriate control, the business owners need to be aware of them.

Lean Security can help to secure the WordPress web site. Lean Security is focusing on securing all your “Cloud” application and can monitor multiple Worpress web sites from single console. Our security consultants will perform the full security assessment of your environment and import critical parameters into the tool for constant security monitoring and compliance. Contact Lean Security for more information.

Amazon AWS Security Risks

Amazon AWS provides a great opportunity for the companies to reduce the costs in their IT infrastructure and increase the speed they can release their products to the market. Amazon AWS contains a large number of resources, such as Infrastructure-as-a-Service (called EC2), file storage (S3 buckets), Database-as-a-service (RDS) and many others. The number is growing every day and the value increases significantly. Almost all startups and companies now consider Amazon AWS to host their IT infrastructure.

To make an appropriate decision to use Amazon AWS cloud or not the companies need to fully understand the risks introduced by using this technology. The risks landscape is very different from traditional IT infrastructure, when all the critical system and applications are located behind the corporate firewall in internal network. Now the infrastructure located in the Cloud and requires different protection.

Below are the common risks introduced by the adopting Amazon AWS Cloud:

1. Unauthorised access to the Cloud Management Console.

   Description: The administrator or Amazon AWS Account owner has full control over the cloud resources. He or she can delete all the servers just by clicking the button. If the administrator is not fully understand the technical background, he or she can open the firewall rules to allow all the traffic going in and out of Amazon AWS account. The hackers can potentially brute force / guess/ steal the password and connect to the console. If a hacker gets control over the account, the availability and integrity of the systems can be affected.

   Risk: High
   Likelihood: High (by default the account is protected by only password)
   Impact: High (all the servers can be affected)

   Mitigation controls: Amazon AWS can provide additional protection for an Amazon AWS account: two factor authentication. The administrator can use their mobile phone with Google Authenticator installed to increase the security of the account. Two factor authentication is not enabled by default and requires additional configuration.

2. Poor access management process.

   Description: The Amazon AWS Management console is available from anywhere in the world. Obviously it provide a great flexibility for the users, but also presents a huge risk. If a company doesn’t have strong access management process, the terminated employee will probably still have access to the console. He or she will be able to connect from home, internet café or even competitor. Many companies have Identity and Access Management (IAM) system implemented for their internal systems, but Amazon AWS console not always integrated with it.

   Risk: High
   Likelihood: Almost certain (if a company has a large number of users)
   Impact: High (terminated users may cause significant damage)

   Mitigation controls: The companies need to review the users on the regular basis. It may be difficult the one company has multiple Amazon AWS accounts as Amazon doesn’t provide centralised console at this stage. Another option is to integrate Amazon AWS with IAM system or Active Directory, but it requires significant investment.

3. Weak firewall rules.

   Description: By default, when you create an Amazon EC2 instance the Amazon will propose the default firewall rules (Amazon calls them the “security groups”) to access the instance. For Linus based instances it will be port 22 (secure shell) and probably ports 80 and 443 for the web server. For Windows instances they will be port 3389 (Remote Desktop) and ports 80 and 443 for the web application. By default, all internet will have access to this ports (source is 0.0.0.0/0). The hackers will probably try to brute force the password for SSH or RDP or use known exploit to get in.

   Risk: Medium
   Likelihood: Almost certain (not many people change the default rule set)
   Impact: Medium (the SSH access by default is configured to use private/public key and Windows password is relatively strong)

   Mitigation controls: The administrators or security professionals need to constantly audit the firewall rules to make sure the remote access is configured for particular source IP addresses. The IP restriction will reduce the risk of compromise significantly.

The above risks are just an example of what the companies should look at when adopting Amazon AWS cloud. The internal security department or systems administrators should perform the comprehensive security assessment of the environment before putting critical application into the cloud. If a company doesn’t have necessary skills to do it “in-house”, Cloud Guardian will help. Cloud Guardian staff will perform the risks assessment of your environment, propose the best mitigation controls and integrate them with our monitoring system to make sure your environment is safe. Moreover, we’ll help you to secure all your Amazon AWS accounts from single interface. Contact us for more details.

Enjoy AWS Security like Never Before

If you want to secure your Amazon AWS accounts, Cloud Guarding is where your search ends. As a unique tool performing Amazon AWS risks assessment, Cloud guardian not only monitors changes across multiple Amazon AWS accounts but also manages multiple Amazon AWS accounts.
This way Cloud Guardian allows users to have absolute control over who is granted or denied access to their Amazon AWS accounts. Cloud Guardian also facilitates the security groups by ensuring that they are configured properly and ensures that all instances of a cloud are well protected.

Another SSL/TLS Vulnerability

Secure Sockets Layer or SSL pertains to the standard security technology utilized mainly for establishing an encrypted link between a browser and a server. This link makes sure that all essential data are transferred between browsers and web servers in an integral and private manner. SSL is a widely known digital networking protocol managing client authentication, server authentication and the encrypted communication between clients and servers.

The Transport Layer Security or TLS, on the other hand, pertains to the protocol that completely ensures privacy between exclusive communication applications and their respective users online. When a client and a server interact or communicate, this technology makes sure that there is no third-party tampering or eavesdropping with the messages. The Transport Layer Security is said to be the successor of Secure Sockets Layer of SSL.

Freak-Analyzed and Defined

Freak attacks take advantage of RSA Export major clippers that are designed to be weaker on purpose so that they will fit in the borders of US Encryption controls of export of previous years. The deconstruction of attack is composed of three steps which are outlined below:

• Create a Man at the Midst of the Scenario

This is as simple as going to a public Wi-Fi area and setting up the proxy. Modify the traffic of clients to request the main Export RSA key.

• Factor 512-Bit RSA Export Key Quickly In Order To Decrypt The Main Secret

There are reliable services specifically for this pursuit. One of these is using the online services of Amazon which only takes about 7 to 12 hours for one hundred dollars. Modify or monitor the traffic that is going between the unconfirmed server and vulnerable client in plain text.

You might have caught caution in the third step which is unconfirmed server and vulnerable client. The server must be willing to negotiate the weaker export key or must host the susceptible third-party software like the Facebook JavaScript SDK, sites that include Facebook’s login button and like button or Apache’s Open SSL and mod_SSL versions. Some susceptible devices and clients can include the Safari on any Apple device.

What You Need to Do to Ensure Ultimate Personal Protection

Freak attacks are getting widespread more than you previously thought. Browsers using OpenSSL are susceptible and this includes Android browsers and perhaps Samsung-derived browsers called “Internet.” Similarly, Apple’s exclusive implementation of TLS, known as Secure Transport, puts OS X and also Safari at risk.

The best thing that needs to be done now is to ensure your protection against this vulnerability. However, you need to make sure that you have clear ideas on how to configure this for your usual privacy. If you truly want to protect yourself, this can be done in simple steps.

If you are running a web server, you need to disable support for all the export suites, but you also need to check and ensure that you are not utilizing any known unsecure ciphers. Enabling support also needs to be done to forward exclusivity or secrecy.  

Magento Vulnerability - Check your web sites now

Magento platform is a popular eCommerce framework used by the organisation all over the world to create the Online shops.

The researchers from Check Point discovered the critical security issues, which could potently allow the remote compromise of a Magento based web site and gaining unauthorized access to the customer and credit card information. See the full post here: http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/ . The vulnerability is currently affecting thousands of online stores. 

Technical Details

Three vulnerabilities were discovered by the Check Point team:

CVE-2015-1398 - An authentication bypass vulnerability was reported in Magento component. The vulnerability is due to a user controlled parameter affecting the login mechanism. A remote attacker can exploit this issue by sending a specially crafted HTTP request to a vulnerable system. Successful exploitation may allow the attacker to gain access to a target system.

CVE-2015-1397 - An SQL injection vulnerability has been reported in Magento component. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.

CVE-2015-1399 - A remote file inclusion vulnerability has been reported in Magento component. The vulnerability is due to lack of sanitization for user-supplied data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.

What should you do

Check your Magento implementation using our Trial Web Site Assessment Service  and see if you are vulnerable. If yes, apply the designated patch SUPEE-5344 released by Magento as soon as possible.