Magellan Final Report - Office of Science - U.S. Department of Energy

Magellan Final Report
Aside from legal questions, a survey of existing forensic tools for virtual systems should be made, and any
gaps identified and plans made to address them. There may be some benefit to building forensic capture and
analysis capabilities directly into the cloud software. This could speed response time during an incident and
also provide vendors in the computer forensic space a way to integrate their tools with the cloud software.
Improved Logging and Auditing Capabilities. A definite challenge the teams experienced while running
the cloud testbeds was the lack of sufficiently detailed logs that could be used for auditing and reporting
purposes. Calculating individual and project usage was difficult and required development of specialized tools
to gather data from disparate sources and attempt to combine it to generate usage reports. This disjointed
logging can also hamper security analysis and audits by needlessly complicating the required effort to review
a system’s usage. It is our recommendation that some effort be made to consolidate and focus the log records
of cloud systems to ensure they provide the necessary detail needed for not only troubleshooting but also
regular auditing activities.
Improved User Authentication and Role-Based Access Control. Depending on the software used
to implement a cloud system, there are varying degrees of role-based access control available. Eucalyptus
had very limited options for user roles and resource allocation. OpenStack options for role-based access
controls were more advanced, and there was even basic resource management available to prevent a small
number of users from utilizing too many resources. In order to meet DOE requirements, these features
would need to be greatly expanded and enhanced beyond their current state. The ability to define roles and
even delegate role assignment to project leads could allow more flexibility for the system users while making
sure that security policies were being met. By formalizing roles and building them into the cloud system,
auditing users and access would be greatly simplified. The addition of a “billing system” that tracked usage
of resources among different users and projects accurately and automatically could allow for more advanced
scheduling of resources beyond the current simplistic model, where resources are either available immediately
or not at all.
User authentication also needs improvement. The current model of authenticating users via certificate
is usable, but is inflexible, for instance, it does not provide a way to incorporate two-factor authentication.
There are workarounds that can address this issue for systems that might require it today, but more integrated
options should be explored in this space. Perhaps storing the cloud authentication certificates on smart cards
could be a possible solution. The software would need to be modified to make use of alternative authentication
methods, and testing would show which methods are most effective and flexible for end users.
Assessment of Public Cloud Infrastructures. As we have mentioned earlier, our work centered on
evaluating operating a cloud computing infrastructure for scientific workloads. Our assumptions and conclusions
should be considered in this context. While we did discuss public cloud infrastructures and how
they compared to the Magellan cloud testbed, serious evaluation of those systems was not undertaken. Even
though assessment of public cloud infrastructures was not in the scope of this project, we believe they should
be evaluated and compared to privately run cloud systems to better understand the costs and challenges
associated with those types of systems.
8.4 Summary
Securing a cloud system has many parallels to securing large multi-user clusters. Of course there are some
unique challenges, but our experiences suggest that these could be met if significant effort were spent on
the system design, enhancing the existing tools, and building some key capabilities that do not exist today.
Our work indicates that the risks of allowing users full reign over their virtual machines is not as onerous a
problem as it first appears. Much of the risk involves user error, which might be mitigated by introducing
a high-quality user interface that simplifies management tasks. Overall, the cloud systems we worked with
did not reveal any security hurdles that were considered intractable.
43