Download - Cloud Security Alliance

CLOUD SECURITY ALLIANCE SecaaS Implementation Guidance, Category 6: Intrusion ManagementOne approach is to work on the physical memory of your cloud environment and extract data from thehypervisor memory, define data sets, generate hash values (for data sets that should stay static), compile hashesinto an inspection engine and scan your container (for any unknown code running).Hypervisors should be monitored and protected as follows:• Monitor hypervisor login failures and successes• Perform real-time monitoring of hypervisor files and configuration settings• Identify and alert when administrators connect to the virtualization system• Protect against insider abuse and external attacks using granular policy-based controls. Forexample:o Perform intrusion detection and log inspection across management componentso Restrict inbound and outbound port access to trusted programso Deescalate user privileges to prevent tampering of virtual hosts or virtual machines4.1.5 Client-Based DetectionIf detection and filtering are done within the guest OS (either kernel modules of the OS vendor, or third-partymodules using an OS API), try to identify and prevent an intrusion by inspecting and filtering certain events,(function calls, packets, write/read to memory, etc.).Advantages:Figure 5: IM within the Guest OSEasy deploymentInterception of VM-VM communication© Copyright 2012, Cloud Security Alliance. All rights reserved. 27