Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
SlideShare a Scribd company logo

Open Source Private Cloud Management with OpenStack and Security Evaluation with Intrusion Detection/ Prevention Systems

•Download as PPTX, PDF•
•
XHANI TRUNGU
XHANI TRUNGU

Nowadays, we hear about terms like, cloud computing, cloud architectures, virtualization technologies, cloud management systems, clustering and cloud security systems. By a first glance these terms are a bit vague, and questions arise about what is a cloud, what is virtualization and finally what is clustering.

1 of 19
Open Source Private Cloud Management with OpenStack and Security Evaluation with Intrusion Detection/Prevention Systems Penetration Testing for Evaluation of Cloud’s Security 05/07/2016 1
Taking a sneak peek on cloud computing definition • Key technology for sharing resources • Web as a space where computing has been preinstalled and exists as a service Data centres, storage, operating systems, applications and processing power ALL shared on the web. 05/07/2016 2
Virtualization in Cloud Systems • Almost complete simulation of the actual Hardware to allow Software to run unmodified • Example: We have a desktop computer with Ubuntu OS and with virtualization technology we can run another Ubuntu OS, inside the Host machine, as a complete fully functional second desktop computer inside ours 05/07/2016 3
How is cloud connected to virtualization? • Easy to understand. Cloud Computing provides: on-demand resources and dynamically Virtualization provides : on-demand resources (you can create a virtual machine whenever you need or delete one) and dynamically (change your resources as you like, example 1) CPU, 2) CPUs, 3) CPUs 05/07/2016 4
Our Project’s Goal ! • Create a Cloud using virtualization Hardware • Specifically Using OpenStack Cloud Management System • Secure our Cloud System with Security software and tools 05/07/2016 5
Architecture of our Cloud System(1) • Initial plan • 3 virtualized OpenStack nodes • 1 OSSEC server monitoring the physical network and servers, plus the virtualized network and servers • Deployment of Fortification/security measures on the physical and virtualized Servers • Testing by means of offense 05/07/2016 6
• OpenStack Networking (Neutron) Architecture • OSSEC server-client architecture 05/07/2016 7
Architecture of our Cloud Systems(2) • Final plan: • 1 virtualized OpenStack node • 1virtualized OSSEC server • Deployment of Fortification/security measures on the physical and virtualized Servers • Testing by means of offense 05/07/2016 8
• DevStack OpenStack Cloud Management Architecture • OSSEC server-client architecture 05/07/2016 9
OSSEC Features • File integrity checking • Log Monitoring • Rootkit Detection • Active Response 05/07/2016 10
OSSEC Compliance Requirements • Detect + Alerts Reasons : • Unauthorized filesystem modifications • Malicious behaviour in log files 05/07/2016 11
Fortification/security measures of servers • SSH configurations for high security • Firewall rules modifications for inbound traffic • Iptables rules modifications • Apache server security hardening with Mod Security • Logwatch for the operating systems • Rkhunter rootkit scanner 05/07/2016 12
Attacking Scenario No.1 • Sqlmap toolset. • This tool focuses primarily on exploiting an SQL database. • The Goal of this test was to check if our Cloud has any vulnerabilities against SQL attack methods, like SQL injections. • Example attack command: • python sqlmap.py -u "http://www.site.com/section.php?id=51" 05/07/2016 13
• The next method of attack is by sqlmap again trying to reach any database entries from the Dashboard (Horizon) • The example command is: • Sqlmap –u “http://192.168.100.50” --db 05/07/2016 14
Attacking Scenario No.2 • THC Hydra toolset • This tool focuses on cracking login information • It supports quite plenty of protocols, such as HTTP, HTTPS, SFTP, SSH (v1 and v2) SSHKEY, POSTGRE and etc. • A first method of attack is by trying to attempt logging in as a root user on an SSH server. • #hydra –l root –P /usr/share/wordlists/metasploit/unix_passwor ds.txt –t 6 ssh://192.168.100.50 05/07/2016 15
Security Evaluation of our Cloud • It endured any attack from the two scenarios. • This means the fortification is quite satisfying • Unfortunately there were not more attacking methods in order to cover a larger area of security issues. The result is : Our Private DevStack Cloud has achieved to stand against threats. GOALS ACHIEVED! 05/07/2016 16
Conclusions • There is no “Best Security Strategy” for a Cloud System. • To secure a Cloud we shall: Be open-minded, adopt and other security products, methods used by others. Fuse our strategy with other existing effective strategies. Bear in mind, one wooden stick can be broken, 20 wooden sticks, will never be broken, or even worse, bend. 05/07/2016 17
Conclusions • Securing the Cloud’s infrastructure is sensible. • Securing the probable Servers hosting Cloud’s components is sensible. • INSENSIBLE would be if only securing one of these two. • Nevertheless, our project scope was to deploy security measures on the Servers of the Cloud. • However, future work, shall be to research, design and deploy the security technologies on the Cloud’s platform. 05/07/2016 18
Conclusions • Final step : Deploy and implement complementary security technologies on the Cloud too. At last, after a lot of effort, it shall be ready for migration to real environment. 05/07/2016 19

More Related Content

Open Source Private Cloud Management with OpenStack and Security Evaluation with Intrusion Detection/ Prevention Systems

  • 1. Open Source Private Cloud Management with OpenStack and Security Evaluation with Intrusion Detection/Prevention Systems Penetration Testing for Evaluation of Cloud’s Security 05/07/2016 1
  • 2. Taking a sneak peek on cloud computing definition • Key technology for sharing resources • Web as a space where computing has been preinstalled and exists as a service Data centres, storage, operating systems, applications and processing power ALL shared on the web. 05/07/2016 2
  • 3. Virtualization in Cloud Systems • Almost complete simulation of the actual Hardware to allow Software to run unmodified • Example: We have a desktop computer with Ubuntu OS and with virtualization technology we can run another Ubuntu OS, inside the Host machine, as a complete fully functional second desktop computer inside ours 05/07/2016 3
  • 4. How is cloud connected to virtualization? • Easy to understand. Cloud Computing provides: on-demand resources and dynamically Virtualization provides : on-demand resources (you can create a virtual machine whenever you need or delete one) and dynamically (change your resources as you like, example 1) CPU, 2) CPUs, 3) CPUs 05/07/2016 4
  • 5. Our Project’s Goal ! • Create a Cloud using virtualization Hardware • Specifically Using OpenStack Cloud Management System • Secure our Cloud System with Security software and tools 05/07/2016 5
  • 6. Architecture of our Cloud System(1) • Initial plan • 3 virtualized OpenStack nodes • 1 OSSEC server monitoring the physical network and servers, plus the virtualized network and servers • Deployment of Fortification/security measures on the physical and virtualized Servers • Testing by means of offense 05/07/2016 6
  • 7. • OpenStack Networking (Neutron) Architecture • OSSEC server-client architecture 05/07/2016 7
  • 8. Architecture of our Cloud Systems(2) • Final plan: • 1 virtualized OpenStack node • 1virtualized OSSEC server • Deployment of Fortification/security measures on the physical and virtualized Servers • Testing by means of offense 05/07/2016 8
  • 9. • DevStack OpenStack Cloud Management Architecture • OSSEC server-client architecture 05/07/2016 9
  • 10. OSSEC Features • File integrity checking • Log Monitoring • Rootkit Detection • Active Response 05/07/2016 10
  • 11. OSSEC Compliance Requirements • Detect + Alerts Reasons : • Unauthorized filesystem modifications • Malicious behaviour in log files 05/07/2016 11
  • 12. Fortification/security measures of servers • SSH configurations for high security • Firewall rules modifications for inbound traffic • Iptables rules modifications • Apache server security hardening with Mod Security • Logwatch for the operating systems • Rkhunter rootkit scanner 05/07/2016 12
  • 13. Attacking Scenario No.1 • Sqlmap toolset. • This tool focuses primarily on exploiting an SQL database. • The Goal of this test was to check if our Cloud has any vulnerabilities against SQL attack methods, like SQL injections. • Example attack command: • python sqlmap.py -u "http://www.site.com/section.php?id=51" 05/07/2016 13
  • 14. • The next method of attack is by sqlmap again trying to reach any database entries from the Dashboard (Horizon) • The example command is: • Sqlmap –u “http://192.168.100.50” --db 05/07/2016 14
  • 15. Attacking Scenario No.2 • THC Hydra toolset • This tool focuses on cracking login information • It supports quite plenty of protocols, such as HTTP, HTTPS, SFTP, SSH (v1 and v2) SSHKEY, POSTGRE and etc. • A first method of attack is by trying to attempt logging in as a root user on an SSH server. • #hydra –l root –P /usr/share/wordlists/metasploit/unix_passwor ds.txt –t 6 ssh://192.168.100.50 05/07/2016 15
  • 16. Security Evaluation of our Cloud • It endured any attack from the two scenarios. • This means the fortification is quite satisfying • Unfortunately there were not more attacking methods in order to cover a larger area of security issues. The result is : Our Private DevStack Cloud has achieved to stand against threats. GOALS ACHIEVED! 05/07/2016 16
  • 17. Conclusions • There is no “Best Security Strategy” for a Cloud System. • To secure a Cloud we shall: Be open-minded, adopt and other security products, methods used by others. Fuse our strategy with other existing effective strategies. Bear in mind, one wooden stick can be broken, 20 wooden sticks, will never be broken, or even worse, bend. 05/07/2016 17
  • 18. Conclusions • Securing the Cloud’s infrastructure is sensible. • Securing the probable Servers hosting Cloud’s components is sensible. • INSENSIBLE would be if only securing one of these two. • Nevertheless, our project scope was to deploy security measures on the Servers of the Cloud. • However, future work, shall be to research, design and deploy the security technologies on the Cloud’s platform. 05/07/2016 18
  • 19. Conclusions • Final step : Deploy and implement complementary security technologies on the Cloud too. At last, after a lot of effort, it shall be ready for migration to real environment. 05/07/2016 19