trademark

4.0
Endpoint Input Validation/Filtering
Users should ensure that the source of data is not malicious and—if it is—should filter
malicious input materials generated by that source. This challenge becomes more
severe with the utilization of the “bring your own device” (BYOD) model. The following are
recommended practices to achieve the best-possible input validation/filtering results.
4.1 Use trusted certificates
4.1.1 Why?
To ensure trust in communication and prevent Sybil attacks (i.e. a single entity
masquerading as multiple identities).
4.1.2 How?
The digital certificate certifies the ownership of a public key by the named subject of
the certificate. This allows others (relying parties) to trust that signatures or assertions
made by the private key (that correspond to the public key) are certified. In this model,
a certificate authority (CA) is a trusted third party that is trusted by both the subject
(owner) of the certificate and the party relying upon the certificate. CAs are characteristic
of many public key infrastructure (PKI) schemes. There exist several open-source
implementations of certificate authority software. Common to all is that they provide the
necessary services to issue, revoke and manage digital certificates. Some open-source
implementations are DogTag, EJBCA, gnoMint, OpenCA, OpenSSL, r509, and XCA. Validity
of certificates must be verified before usage based on a periodically issued certificate
revocation list (CRL) or via OCSP (Online Certificate Status Protocol). If a central authority
ensures that a unique certificate is assigned to each entity in a system, then an attacker
cannot fake multiple identities. A trusted certificate is the only reliable method to defend
against Sybil attacks.
4.2 Do resource testing
4.2.1 Why?
To avoid the drawback of managing certificates in a large enterprise but still achieve a
minimal defense against Sybil attacks instead of preventing them.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
22