View Source

Topics

Acronyms
Roles and Responsibilities
User Agreements and Training Requirements
Shared Security Responsibility Model
Secure Science Cloud Website Hosting Guidelines
Continuous Vulnerability Scanning with AWS Inspector
Vulnerability Remediation
AWS Inspector Console Features
Effective Vulnerability Management in Science Cloud
Automated Patching using AWS Patch Manager

Acronyms

ACG	A Cloud Guru	IAM	Identity and Access Management
AMI	Amazon Machine Image	ISSO	Information Systems Security Officer
API	Application Programming Interface	ISSE	Information Systems Security Engineer
ATC	AWS Training and Certification	ITAR	International Traffic in Arms Regulations
AVM	Azure Virtual Machine	MAR	Mitigation Action Requirement
AWS	Amazon Web Services	MFA	Multi-Factor Authentication
CIS	Center for Internet Security	NIST	National Institutes of Standards and Technology
CUI	Controlled Unclassified Information	PI	Principal Investigator
CVE	Common Vulnerabilities and Exposures	RHEL	Red Hat Enterprise Linux
CSET	Cyber Security Engineering Team	S3	Simple Storage Service
DHS	Daily Health Status	SA	Systems Administrator
EC2	Elastic Compute Cloud	SCRM	Supply Chain Risk Management
ECR	Elastic Container Registry	SLES	SUSE Linux Enterprise Server
FISMA	Federal Information Management Security Act	SOC	Security Operations Center
KEV	Known Exploited Vulnerabilities	SSM	Systems Manager

User Agreements and Training Requirements

Agreement or Training Module	Who Should Take This	Time Frame
User Agreement	All console users	Annually
General Security Training	All console users	Annually
Elevated Privileges Security Training	PIAdmin, Project SysAdmins, CloudAdmins	Annually

Training is designed to help users understand current NASA security requirements and how they impact the operation of the Science Cloud
All Users will need to work together with the Science Cloud CloudAdmin Team to implement good security practices
Security is everyone’s responsibility!

Shared Security Responsibility Model

Layer	Science Cloud CloudAdmins	Project System Administrators
Application Layer	•Monitor application authentication for security compliance and provide recommendations for remediation	•Install/configure applications in a secure fashion •Create and update passwords to meet NASA guidelines
Container Layer	•Implement Container Registry for storage of approved Containers	•Store approved Containers in approved Container registries •Update Containers to resolve identified vulnerabilities
O/S Layer	•Monitor instances for security compliance and provide notifications for required patches	•Read and understand vulnerabilities from weekly vulnerability reports •Configure secure instances and implement patches as required
Cloud Layer	•Ensure SSM usage, monitor ports, and ensure Password / API key age compliance	•Coordinate with the ISSO to ensure attestation of User Agreement prior to the creation of AWS/Azure users
Physical Layer	•AWS and Azure provide secure facilities, hardware, and other capabilities

Secure Science Cloud Web Hosting Guidelines

All public-facing websites/webapps within the Science Cloud accreditation boundary must comply with the following security guidelines and best practices:

Use registered URLs with a valid DNS name (IP addresses not allowed)
Encrypt communications using HTTPS and port 443 (port 80 not allowed except to redirect to an HTTPS port)
All user input used in web applications must be properly validated, and any user input output by web applications must be properly encoded
Websites must return a generic 404 “page not found” when a user navigates to a non-existent page
All publicly accessible data (including operational items such as error/warning messages) should not reveal information that can be used by an attacker
Host Headers shall not be used in server-side code
All public-facing websites/webapps within the Science Cloud accreditation boundary must comply with the following security guidelines and best practices:
- Username enumeration shall be restricted, as discovery of this information can be used to identify valid usernames and gain unauthorized access
- Never store passwords or other sensitive information in cleartext within Wiki, GitHub, or any other services that include browsable web pages
- Prohibit access to browsable web directories or application code
- Prior to hosting a WebApp, projects must apply for and receive approval via completion of the Science Cloud WebHosting Guidelines Agreement

Continuous Vulnerability Scanning in Science Cloud

The Science Cloud leverages the continuous scanning model being employed by AWS Inspector to identify vulnerabilities related to the NIST Common Vulnerability Enumeration (CVE) specifications
Vulnerabilities in Inspector are stored in an AWS repository that is updated continuously based on the following events:
- EC2 instance new package installation
- EC2 instance package update
- EC2 instance stop, start, or restart
- CVE update/release including Known Exploitable Vulnerabilities (KEV)
- Changes to CIS Benchmarks
The Science Cloud SecOps team will notify Project SysAdmins weekly concerning vulnerable EC2 instances
Note: To facilitate this communication, PIs must ensure any change to the Project SysAdmin(s) for their project is communicated to the Science Cloud team

Systems Manager Monitoring

All non-ephemeral EC2 instances must be configured with the AWS Systems Manager (SSM) agent
To enable SSM, instances must be configured with a custom IAM Role which includes the following required AWS permissions policies:
- AmazonSSMManagedInstanceCore
- CloudWatchAgentServerPolicy
- AmazonSSMFullAccess (Optional - Includes all possible permissions. Not recommended for least privilege.)
Appropriate installation and configuration of the SSM agent enables the Science Cloud to complete automated vulnerability scanning for all instances

Vulnerability Remediation

PIAdmins and Project SysAdmins are responsible for remediating all vulnerabilities within the following timeframes:
- Expedited (SOC MAR): 7 Calendar Days
- Critical: 15 calendar days
- High: 30 calendar days
- Medium: 30 calendar days
- Low: 60 calendar days

Systems not patched within the above timeframes will result in weekly notifications being sent to Project SysAdmins until they become compliant
PIAdmins and Project SysAdmins shall use Inspector and SecurityHub and collaborate with the Science Cloud Security Team to ensure patches are applied in a timely manner

Using Inspector for Science Cloud Security Notifications

Displays vulnerabilities for all active EC2 instances in a given region
Highlights critical findings across multiple attack vectors, to include risks related to network availability/reachability
Includes information about Known Exploited Vulnerabilities (KEV), which are CVEs that are currently being exploited by one or more bad actors
Inspector dashboard/console provides streamlined vulnerability management capabilities:
- Facilitates drill-down to determine specific CVE information
- Shows updated compliance information to assist with remediation efforts
- Inspector may take 1 hour or more to reflect patches that have been applied