de invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud...
TRANSCRIPT
![Page 1: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/1.jpg)
De invloed van “cloud” op het dreigingslandschap…
Frank Breedijk – ISACA RISK event 2019
Legitimate a CC NC ND image by Seth Anderson
https://www.flickr.com/photos/44124372363@N01/7830947420/
![Page 2: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/2.jpg)
![Page 3: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/3.jpg)
o Frank Breedijk
o CISO Schuberg Philis
o Cloud and open source enthousiast
o Ik woon in een stal uit 1751
3
> whoami
![Page 4: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/4.jpg)
Opa verteld…o Shared hosting vs decated hosting
o Intrede van virtualisatie
o Private / Community cloud
o Public cloud
5
![Page 5: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/5.jpg)
1998 - 2012 6
![Page 6: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/6.jpg)
Shared of ‘dedicated’ hosting
71924 Ford Model T Coupe '772U’ 1 a CC ND image by Jack Snell
https://www.flickr.com/photos/59972430@N00/23467122488/
![Page 7: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/7.jpg)
o Met wie deel je je servers
o Nadruk op:
o Fysieke beveiliging
o Netwerk Segmentatie
o Scheiding van kritiek en niet kritiek
o Oorzaak van de meeste incidenten
o Malware
o Niet patchen
8
The fort ‘Datacenter’
IMG_20140829_140731 a CC image by Robert
https://www.flickr.com/photos/12967790@N00/14885417370/
![Page 8: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/8.jpg)
Virtualisatie
o Nieuwe dreigingen:
o Delen van dezelfde hardware
o Verschillende machines delendezelfde kernel
o ”Opgeloste” dreigingen
o Software wordt niet meer op software nivo gedeeld
9Install XenServer on VMware Player - Select Installation Source a CC image by xmodulo.com
https://www.flickr.com/photos/91795203@N02/9228236784/
![Page 9: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/9.jpg)
Virtualisatie
o Nadruk op:
o Fysieke beveiliging
o Hardware / kernel segmentatie
o Hypervisor escape
o Oorzaak van de meeste incidenten
o Malware
o Niet patchen
o DDoS (2013)
10Install XenServer on VMware Player - Select Installation Source a CC image by xmodulo.com
https://www.flickr.com/photos/91795203@N02/9228236784/
![Page 10: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/10.jpg)
2012 - 2015 11
![Page 11: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/11.jpg)
2015 12
MCC
![Page 12: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/12.jpg)
NKNK
Private / “Community” cloud
13FARM:shop private hire party a CC NC image by Laura Billings
https://www.flickr.com/photos/14784969@N08/6225824429/
![Page 13: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/13.jpg)
o T.o.v. virtualisatie
o Hardware/kernel nu gedeeld met ”anderen”
o Orchestratie laag met een API
o T.o.v. public cloud
o Beperkte groep medehuurders
o Physieke locatie bekend
o Mogelijkheid tot audit
14
Wat is er anders…
FARM:shop private hire party a CC NC image by Laura Billings
https://www.flickr.com/photos/14784969@N08/6225824429/
![Page 14: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/14.jpg)
o Nadruk op:
o Hypervisor escape
o Hardward / kernel segmentatie
o Fysieke beveiliging
o Oorzaak van de meeste incidenten
o Malware
o Niet patchen
o Applicatie security
15
Security
FARM:shop private hire party a CC NC image by Laura Billings
https://www.flickr.com/photos/14784969@N08/6225824429/
![Page 15: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/15.jpg)
2019 16
MCC
AWS
Azure
GCP
Office 365
Okta
Slack
![Page 16: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/16.jpg)
Public cloud
17Holi. a CC NC ND image by ¡arturii!
https://www.flickr.com/photos/7617410@N02/16805986366/
![Page 17: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/17.jpg)
o Je weet niet precies met wie je de ruimte deelt
o Je weet niet precies waar je data staat
o Grote cloud partijen kunnen niet iedere klant latenauditen
o Buitenlandse partijen
18
Wat is er anders…
Holi. a CC NC ND image by ¡arturii!
https://www.flickr.com/photos/7617410@N02/16805986366/
![Page 18: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/18.jpg)
o Nadruk op:
o Compliance
o Lock in
o Fysieke locatie
o Oorzaak van de meeste incidenten
o Malware
o Niet patchen
o Niet juist inrichten van rechten
o Applicatie fouten
19
Security…
Holi. a CC NC ND image by ¡arturii!
https://www.flickr.com/photos/7617410@N02/16805986366/
![Page 19: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/19.jpg)
Help?
20Sunny with a chance of meatballs
Sony Pictures Animation 2009
![Page 20: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/20.jpg)
o Veel gevallen met kleine impact op para-virtualisatie
o Paravirtualisatie niet populair meer
o Meltdown + Spectre
o Cloud vendors waren de eersten
21
Hypervisor escape
![Page 21: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/21.jpg)
Incidenten?
o Niet patchen
o Gebrekkige access control
o Onbedoeld bloodstellen van gevoelige services
o Ransomware
o Applicatiefouten
22
![Page 22: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/22.jpg)
o It’s just someone else’s computer?
o Als dat zo is, waarom wil ”men” het dan zo graag?
o Is dit wel de juiste blik?
23
There is no cloud…
Laptop van een college, foto door Frank Breedijk
![Page 23: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/23.jpg)
Moderne cloud infrastructuren…
24Golden gate bridge, San Fransisco USA - Original image from Carol M. Highsmith’s America, Library of Congress collection. Digitally enhanced by rawpixel. A CC image by rawpixel
https://www.flickr.com/photos/153584064@N07/46201778672/
![Page 24: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/24.jpg)
Beschikbaarheid
o Niet alleen meer uptime
o Beschikbaarheid van informatie is functionaliteit
o Functionaliteit die de eind-gebruiker niet bereikt is geen functionalitiet
o Bedrijven moeten ‘agile’ zijn om te overleven
o Geen hele serverparken meer nodig om b.v. A.I. te doen
25
Beschikbaar
IntegerVertrouwelijk
![Page 25: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/25.jpg)
Agility?
o Met zo min mogelijk operations mensen net zoveel operations doen als nodig is
o Ontwikkelaars in staat stellen zo veel mogelijk functionaliteit zo snel mogelijk bij de eind-gebruikers te krijgen
26150725-F-YW474-128 a CC NC image by U.S. Pacific Fleet
https://www.flickr.com/photos/compacflt/20009404191/
![Page 26: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/26.jpg)
Hoe dan?
o Commodity / uitontwikkeld
o Services ipv servers
o IT voor IT
o Services, PaaS ipv servers
o “Onderscheidende” applicaties
o Cloud native of containers
27150725-F-YW474-128 a CC NC image by U.S. Pacific Fleet
https://www.flickr.com/photos/compacflt/20009404191/
![Page 27: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/27.jpg)
AWS I choose you
28
https://www.youtube.com/watch?v=zyP-pfij86s
![Page 28: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/28.jpg)
Snoepwinkel
o De mogelijkheden / functionaliteiten van een moderne cloud provider zijn (bijna) eindeloos
29Ren Ren Le Bao’an Boulevard Shenzhen a CC NC image by Chris
https://www.flickr.com/photos/76224602@N00/4348333928/
![Page 29: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/29.jpg)
30
Moderne cloud vs. IaaS
Ren Ren Le Bao’an Boulevard Shenzhen a CC NC image by Chris
https://www.flickr.com/photos/76224602@N00/4348333928/
Colorful Gum Tabs a CC image by Marco Verch
https://www.flickr.com/photos/30478819@N08/45917981931/
![Page 30: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/30.jpg)
Cloud security IaaS security
31Colorful Gum Tabs a CC image by Marco Verch
https://www.flickr.com/photos/30478819@N08/45917981931/
![Page 31: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/31.jpg)
Iedereen wil security…
32Werner Vogels tijdens AWS Summit 2018 in Den Haag
Door Frank Breedijk
![Page 32: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/32.jpg)
SaaS kan helpen
o Als IT geen core business is
o Als IT wel je core business is, maar de applicatie niet “spannend” is
o Als de applicatie niet “onderscheidend” is
33
![Page 33: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/33.jpg)
De kracht van de API
34
![Page 34: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/34.jpg)
o Een altijd up to date overzicht krijgen van alles in je landschap
o Weten waar je data staat
o Weten dat je data versleuteld is
o Verkeerde configuraties detecteren
o én oplossen
35
Via de API kun je…
She thinks my json's sexy... Said no one ever a CC ND iamge by Matthew Ragan
https://www.flickr.com/photos/45199237@N04/21131398981/
![Page 35: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/35.jpg)
Consolidatie
o Veel van de oplossingen nu nog zelf bouw
o Derden zijn in dit gat gestapt
o Security is de dominante non-functional voor clouds
o Verwacht dat cloud providers dit gaan aanbieden
362983e2 P900 Wide-eyed wonder of Christmas a CC NC ND image by Jenny Pansing
https://www.flickr.com/photos/25171569@N02/23876843182/
![Page 36: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/36.jpg)
Niet het einde van de wereld
37Sunny with a chance of meatballs
Sony Pictures Animation 2009
![Page 37: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/37.jpg)
Cloud craftsmenship manifesto…
38The blacksmith a CC NC ND image by psaRas
https://www.flickr.com/photos/148231543@N08/36198187330/
![Page 38: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/38.jpg)
I am a craftsman and I use cloud technologies, because I apply my craftmanship to cloud technologies, I am a Cloud Craftsman.
I recognize that cloud technologies, if applied correctly, offer great benefits in terms of availability, reliability, scalability and agility.
I recognize that, like any other technology, cloud technology is not a silver bullet.
39
Cloud craftsmenship
manifesto…
The blacksmith a CC NC ND image by psaRas
https://www.flickr.com/photos/148231543@N08/36198187330/
![Page 39: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/39.jpg)
I recognize that not all cloud solutions are created equally. I will do my best to select the solution that best fits my specific situation.
I recognize that, in the cloud, I will have to trust and rely on the abilities of the provider. I will do my best to validate this trust.
I recognize that effective, efficient and secure usage of cloud technologies is a responsibility that is shared between the user and the provider.
40
Cloud craftsmenship
manifesto…
The blacksmith a CC NC ND image by psaRas
https://www.flickr.com/photos/148231543@N08/36198187330/
![Page 40: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/40.jpg)
I recognize that effective, efficient and secure uadge of cloud technologies is in both the interest of the user and provider.
I intend to read, understand and/or use the best practices and tooling recommended by the provider to the greatest extend possible in my situation.
I intend to stand on the shoulders of giants. May before us have developed tools and practices for the effective, efficient and secure usage of cloud technologies. I will adopt their work as much as I can.
41
Cloud craftsmenship
manifesto…
The blacksmith a CC NC ND image by psaRas
https://www.flickr.com/photos/148231543@N08/36198187330/
![Page 41: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/41.jpg)
I recognize that cloud technologies are repaidly evolving, this means I will have to keep up with the current state of the cloud technologies I intend to use and are available to me. After all, a fool with a tool is still a fool.
I recognize that automation is the key to reliability, reproducability and recoverability. I will embrace automation of my work as the way forward.
42
Cloud craftsmenship
manifesto…
The blacksmith a CC NC ND image by psaRas
https://www.flickr.com/photos/148231543@N08/36198187330/
![Page 42: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/42.jpg)
I recognize that, in the cloud, I cannot just rely on others to provide security for me.
I am a Cloud Craftsman, not because it is easy, but because it is necessary and I am up for the challenge.
43
Cloud craftsmenship
manifesto…
The blacksmith a CC NC ND image by psaRas
https://www.flickr.com/photos/148231543@N08/36198187330/
![Page 43: De invloed van “cloud” op het dreigingslandschap… · apply my craftmanship to cloud technologies, I am a Cloud Craftsman. I recognize that cloud technologies, if applied correctly,](https://reader036.vdocument.in/reader036/viewer/2022071018/5fd19acf1876b9405a48014b/html5/thumbnails/43.jpg)
http://craftsmanship.cloud
44The blacksmith a CC NC ND image by psaRas
https://www.flickr.com/photos/148231543@N08/36198187330/