...
- Some Science Cloud customers allow new users to “self-register” to gain access to JupyterHub environments
- Representative data items shall be collected at time of self-registration to allow for proper vetting, to include:
- Demographics (project name, user name, country)
- Affiliation (government funding, NASA affiliation, university status, etc.)
- Rationale (reason for request, justification)
- A NASA-approved warning banner shall be shown at the outset of all user registrations
...
Auto-
...
Remediation Recommendations for WebApps with Self-Registration
- Risk-Based Decision Process: The team developed a Risk-Based Decision (RBD) framework allowing self-registration services with proper mitigating controls, turning security incidents into learning opportunities rather than blanket restrictions.
- Monitor CloudWatch events and GuardDuty notifications to determine if nefarious activities are occurring, such as:
- Communication with known cryptominer-affiliated URLs
- Presence of cryptominer binaries in the JupyterHub container
- Implement automated remediation processing to detect and stop all suspected incidents of nefarious/unapproved activity within provisioned JupyterHub environments, to include
- Disable affected JupyterHub user accounts
- Snapshot the Pod Physical Volume and Physical Volume Claim
- Terminate the pod and the active user session
- Email alert to the project sysadmin and security team
- Coordinate with Science Cloud’s security team to confirm stoppage of nefarious activity
...