Securing the Virtual Environment, w. DVD-ROM - How to Defend the Enterprise Against Attack

A step-by-step guide to identifying and defending against attacks on the virtual environment

As more and more data is moved into virtual environments the need to secure them becomes increasingly important. Useful for service providers as well as enterprise and small business IT professionals the book offers a broad look across virtualization used in various industries as well as a narrow view of vulnerabilities unique to virtual environments. A companion DVD is included with recipes and testing scripts.
Examines the difference in a virtual model versus traditional computing models and the appropriate technology and procedures to defend it from attack
Dissects and exposes attacks targeted at the virtual environment and the steps necessary for defense
Covers information security in virtual environments: building a virtual attack lab, finding leaks, getting a side-channel, denying or compromising services, abusing the hypervisor, forcing an interception, and spreading infestations
Accompanying DVD includes hands-on examples and code

This how-to guide arms IT managers, vendors, and architects of virtual environments with the tools they need to protect against common threats.

List of contents

Introduction xxi

Chapter 1 Virtualized Environment Attacks 1

A Brief Introduction to the Cloud 1

Flavors of "Cloud" 3

Powering the Cloud 3

Why the Cloud Is Here to Stay 4

Managing Cloud Security 5

Principles of Information Security 6

Information Assets 7

Potential Threats 8

Potential Vulnerabilities 8

Potential Consequences 8

Incremental Risk Mitigation 9

Deny by Default 9

Never Trust Input; Assume the Worst 11

Confidentiality, Integrity, and Availability 12

The Human Factor 13

Managing Cloud Risks 14

Asset Management 20

Vulnerability Assessment 22

Communication 22

Authentication and Authorization 23

Software 25

Managing Cloud Compliance 31

Defining Compliance and Security 33

Making Use of Warnings 34

Cloud and the PKI 35

Summary 36

Chapter 2 Attacking from the Outside 41

Who Is an Outsider? 41

HR Policies and Procedures 42

Contracting and Outsourcing Talent 44

Friends and Family Discount 45

Configuring Cloud Audit Logs 46

Keeping Tabs on Accounts 50

Extending and Trusting Communication 50

Delegating and Spreading Roles in Order to Scale 62

Novice Users Empowered by Cloud Environments 62

Outsourced and Offshored Resources 62

SaaS Software Development at "Cloud Speed" 63

The Needs of Bespoke Solutions 63

Ensuring Continuity 64

Underspecialization 65

How to Piggyback on Fixes 66

Sudo and Shell Logging 70

Spoofi ng a Certifi cate 73

Summary 74

Chapter 3 Making the Complex Simple 77

Looking Around Without Getting Caught 78

Checking to See If Anyone Is Watching 78

Checking for Gaps in Awareness 79

Checking for Responsiveness 80

Complexity and the Cloud 81

Choosing a Spot with a View 83

The Hypervisor 83

The Director/Orchestrator/Manager 88

Assessing the Risk from Assessors 93

Slicing and Dicing Data 94

Detecting Layers of Virtualization Technology 94

Identifying and Targeting Assets 96

Versions 102

Supporting Infrastructure 103

Mail Servers 103

Web Servers 103

Domain Name Service 104

Databases and Directory Services 104

Timing an Attack 104

Long-versus Short-Term Objectives 104

How Long before You Are Ready to Attack? 104

How Long before You Can Attack Again? 105

Summary 106

Chapter 4 Denial of Service 109

Finding Signal in Noise 109

Improving Denial 111

Distributing Denial 112

Defi ning Success 113

Finding Service Vulnerabilities 115

Scanning and Validating Service Levels 115

Abstracting and Overcommitting 115

Validating Complexity 118

Limits of Penetration Testing 120

Denial of Testing 120

Testing for Denial 121

Abusing Proximity of Services: Step Attacks and Speed Attacks 125

Exploiting Service Vulnerabilities 127

Breaking Connections Between Services 127

Exhausting Resources 130

CPU 130

Memory 130

Disk Space and IOPS 131

The Dangers of Overcommitment 132

Locking Out Others 132

Summary 137

Chapter 5 Abusing the Hypervisor 141

Replacing Hardware Layers with Software 142

Relating Physical to Virtual 142

Displays 143

Memory 144

Disk 145

Network 147

Compromising the Kernel 147

Low-Level Interception 148

Real-World Example: Duqu 148

Classification and Defense 150

Breaking Out of KVM 151

Attacking Virtual CPU and Memory 161

The Cup Is Half Secure 162

Taking Plato's Shadow Pill 162

Demonstrating the Risks 163

Qualifying Fear and Uncertainty 164

Measuring Failure Rates 165

Focusing on the Shortcomings of New Technology 166

Finding the Different Yet Old Attack Surfaces 167

Network 168

Systems 171

Databases 172

Escaping Jails, Sandboxes, and Buffers 174

What Is the Purpose of Root, Anyway? 176

Breaking Away from Identifi ers 177

Every Door Is the Front Door 178

Summary 180

Chapter 6 Finding Leaks and Obtaining a Side Channel 185

Peeping Toms 186

Working Around Layer 2 and Laye

Product details

• Authors: Davi Ottenheimer, Matthew Wallace
• Publisher: Wiley & Sons
• Languages: English
• Product format: Paperback / Softback
• Released: 15.05.2012
• EAN: 9781118155486
• ISBN: 978-1-118-15548-6
• No. of pages: 432
• Dimensions: 186 mm x 233 mm x 25 mm
• Weight: 700 g