Magellan Final Report - Office of Science - U.S. Department of Energy

Magellan Final Report
Firewalls are a natural tool to protect sensitive infrastructure components from intrusion from unwanted
address space. One of the first things done was to isolate the cloud, cluster, and node controller instances
from the address space used by the virtual instances to protect infrastructure from everything except a small
address space. It is also necessary to prevent spoofing of infrastructure address space from the set of user
initiated images, since the VM instances can create arbitrarily addressed network traffic.
Another simple test is to scan public facing address space for unexpected ssh ports as well as exceptionally
susceptible accounts (such as password-less root accounts). Mandating a full system scan before releasing a
VM for public access was discussed and a method was proposed, but this method was not implemented on
the Magellan deployment.
Taking a closer look at user activities—both in terms of site security policy as well as machine readable
logging—was another step in making the cloud systems more equivalent to our current batch systems.
Enforcing local computer security policy on dynamic user-run virtual machine systems (such as Eucalyptus
or EC2) is not something that traditional intrusion detection systems excel at, since they tend to be designed
with fairly rigid notions of the mappings between systems, users, and addresses. To resolve this problem,
we used data from two locations. First we used the EC2 branch of the Python Boto package (via euca2ools)
to query the Cloud Controller for information about registered instances, IP addresses, users, and instance
groups firewall rules. This provided a clean interface and data source for actively querying the Cloud
Controller. The second source takes advantage of the Eucalyptus network architecture since all ingress/egress
as well as intra-instance network traffic passes through a choke point on the cloud controller. The data for
both cases was then processed by an instance of the Bro intrusion detection system. As already suggested,
this provides two principal benefits. The first is the ability to express local site security policy by configuring
a set of scripts we created for this purpose. The data from Bro helps track successful and failed logins, VM
instantiation, inter-cluster scan detection, and rules about system firewall configurations. Once the local
policy is defined, activities which violate that policy can be quickly identified and acted on. In addition, all
activity was logged in a well defined format.
8.2 Challenges Meeting Assessment and Authorization Standards
While the technical aspects of computer security tend to gather the most attention, significant work is
required to ensure that any large scale technology can be placed in the context of the current language found
in Security Controls and Security Assessment and Authorization (A&A). Since any detailed interpretation
of these documents is far outside the scope of this project, we will only discuss a few key points. Current
best documentation involving cloud resources and security guidance is the FedRAMP [27] document, which
covers three main areas:
• List of baseline security controls for low and moderate impact cloud systems. NIST Special Publication
800-53R3 provides the foundation for the development of these security controls.
• Processes in which authorized cloud computing systems will be monitored continuously. This draft
defines continuous monitoring deliverables, reporting frequency, and responsibility for cloud service
provider compliance with the Federal Information Security Management Act.
• Proposed operational approaches for assessment and authorization for cloud computing systems that reflect
on all aspects of an authorization, including sponsorship, leveraging, maintenance, and continuous
monitoring, a joint authorization process, and roles and responsibilities for federal agencies and cloud
service providers. This is detailed under the risk management framework in NIST Special Publication
800-37R1.
Since a traditional HPC site will have covered a reasonable number of these controls in their regular
A&A work, we will focus on a small number of unique issues presented by providers of cloud computing
infrastructure.
41