Versions Compared

Old Version 2

changes.mady.by.user Jay Ellis

Saved on

compared with

New Version Current

changes.mady.by.user Audrey McQuagge

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Topics

  • Acronyms
  • Roles and Responsibilities
  • User Agreements and Training Requirements
  • Shared Security Responsibility Model
  • Secure Science Cloud Website Hosting Guidelines
  • Continuous Vulnerability Scanning with AWS Inspector
  • Vulnerability Remediation
  • AWS Inspector Console Features
  • Effective Vulnerability Management in Science Cloud
  • Automated Patching using AWS Patch Manager


Acronyms

ACG

A Cloud Guru


IAM

Identity and Access Management

AMI

Amazon Machine Image


ISSO

Information Systems Security Officer

API

Application Programming Interface


ISSE

Information Systems Security Engineer

ATC

AWS Training and Certification


ITAR

International Traffic in Arms Regulations

AVM

Azure Virtual Machine


MAR

Mitigation Action Requirement

AWS

Amazon Web Services


MFA

Multi-Factor Authentication

CIS

Center for Internet Security


NIST

National Institutes of Standards and Technology

CUI

Controlled Unclassified Information


PI

Principal Investigator

CVE

Common Vulnerabilities and Exposures


RHEL

Red Hat Enterprise Linux

CSET

Cyber Security Engineering Team


S3

Simple Storage Service

DHS

Daily Health Status


SA

Systems Administrator

EC2

Elastic Compute Cloud


SCRM

Supply Chain Risk Management

ECR

Elastic Container Registry


SLES

SUSE Linux Enterprise Server

FISMA

Federal Information Management Security Act


SOC

Security Operations Center

KEV

Known Exploited Vulnerabilities


SSM

Systems Manager


User Agreements and Training Requirements

Agreement or Training Module

Who Should Take This

Time Frame

User Agreement

All console users

Annually

General Security Training

All console users

Annually

Elevated Privileges Security Training

PIAdmin, Project SysAdmins, CloudAdmins

Annually

  • Training is designed to help users understand current NASA security requirements and how they impact the operation of the Science Cloud
  • All Users will need to work together with the Science Cloud CloudAdmin Team to implement good security practices
  • Security is everyone’s responsibility!


Shared Security Responsibility Model

Layer

Science Cloud

 CloudAdmins

Support Team

Project System Administrators

Application Layer

•Monitor application authentication
  • Monitor tenant applications for security compliance and provide recommendations for remediation
•Install
  • Install/configure applications in a secure fashion
•Create
  • Create and update passwords to meet NASA guidelines

Container Layer

•Implement
  • Implement Container Registry for storage of approved Containers
•Store
  • Update Infrastructure Containers to resolve identified vulnerabilities
  • Store approved Containers in approved Container registries
•Update
  • Update Containers to resolve identified vulnerabilities

O/S Layer

•Monitor instances
  • Monitor resources for security compliance and provide notifications for required patches
•Read
  • Read and understand vulnerabilities from weekly vulnerability reports
•Configure
  • Configure secure instances and implement patches as required

Cloud Layer

•Ensure
  • Ensure SSM usage, monitor ports, and ensure Password / API key age compliance
•Coordinate
  • Coordinate with the
ISSO
  • Operations to ensure
attestation
  • completion of User Agreement
prior to the creation of AWS/Azure users
  • and Security Training as part of onboarding process

Physical Layer

•AWS
  • AWS and Azure provide secure facilities, hardware, and other capabilities


Secure Science Cloud Web Hosting Guidelines

All public-facing websites/webapps within the Science Cloud accreditation boundary must comply with the following security guidelines and best practices:

  • Use registered URLs with a valid DNS name (IP addresses not allowed)
  • Encrypt communications using HTTPS and port 443 (port 80 not allowed except to redirect to an HTTPS port)
  • All user input used in web applications must be properly validated, and any user input output by web applications must be properly encoded
  • Websites must return a generic 404 “page not found” when a user navigates to a non-existent page
  • All publicly accessible data (including operational items such as error/warning messages) should not reveal information that can be used by an attacker
  • Host Headers shall not be used in server-side code

  • All public-facing websites/webapps within the Science Cloud accreditation boundary must comply with the following security guidelines and best practices:

    • Username enumeration shall be restricted, as discovery of this information can be used to identify valid usernames and gain unauthorized access

    • Never store passwords or other sensitive information in cleartext within Wiki, GitHub, or any other services that include browsable web pages

    • Prohibit access to browsable web directories or application code

    • Prior to hosting a WebApp, projects must apply for and receive approval via completion of the Science Cloud WebHosting Guidelines Agreement


Continuous Vulnerability Scanning in Science Cloud

  • The Science Cloud leverages the continuous scanning model being employed by AWS Inspector to identify vulnerabilities related to the NIST Common Vulnerability Enumeration (CVE) specifications
  • Vulnerabilities in Inspector are stored in an AWS repository that is updated continuously based on the following events:
    • EC2 instance new package installation
    • EC2 instance package update
    • EC2 instance stop, start, or restart
    • CVE update/release including Known Exploitable Vulnerabilities (KEV)
    • Changes to CIS Benchmarks  
  • The Science Cloud SecOps team will notify Project SysAdmins weekly concerning vulnerable EC2 instances
  • Note: To facilitate this communication, PIs must ensure any change to the Project SysAdmin(s) for their project is communicated to the Science Cloud team


Systems Manager Monitoring

  • All non-ephemeral EC2 instances must be configured with the AWS Systems Manager (SSM) agent
  • To enable SSM, instances must be configured with a custom IAM Role which includes the following required AWS permissions policies:
    • AmazonSSMManagedInstanceCore
    • CloudWatchAgentServerPolicy
    • AmazonSSMFullAccess (Optional - Includes all possible permissions. Not recommended for least privilege.)
  • Appropriate installation and configuration of the SSM agent enables the Science Cloud to complete automated vulnerability scanning for all instances


Vulnerability Remediation

  • PIAdmins and Project SysAdmins are responsible for remediating all vulnerabilities within the following timeframes:
    • Expedited (SOC MAR): 7 Calendar Days
    • Critical: 15 calendar days
    • High: 30 calendar days
    • Medium: 30 calendar days
    • Low: 60 calendar days
  • Systems not patched within the above timeframes will result in weekly notifications being sent to Project SysAdmins until they become compliant
  • PIAdmins and Project SysAdmins shall use Inspector and SecurityHub and collaborate with the Science Cloud Security Team to ensure patches are applied in a timely manner


Using Inspector for Science Cloud Security Notifications 

  • Displays vulnerabilities for all active EC2 instances in a given region
  • Highlights critical findings across multiple attack vectors, to include risks related to network availability/reachability
  • Includes information about Known Exploited Vulnerabilities (KEV),  which are CVEs that are currently being exploited by one or more bad actors
  • Inspector dashboard/console provides streamlined vulnerability management capabilities:
    • Facilitates drill-down to determine specific CVE information
    • Shows updated compliance information to assist with remediation efforts
    • Inspector may take 1 hour or more to reflect patches that have been applied

...