Securing NoSQL Clusters

Presents

Securing NoSQL Clusters

Adrian Lane, CTO

[email protected] Twitter: @AdrianLane

David Mortman

[email protected] Twitter: @

About Securosis

• _{Independent analysts with backgrounds on}

both the user and vendor side.

• _{Focused on deep technical and industry}

expertise.

• _{We like pragmatic.}

The Research

How does big data help with security

analytics?

…

and

…

Encyclopedic

Hutton and the Big

Management: “Get it done!”

• _{More data of more types}

• _{Need forensics}

• _{Need to determine risk}

• _{Need to detect fraud}

• _{Need to detect intrusions}

• _{Need to protect this data}

Shock/Denial

• _{Security analytics not working!}

• _{My systems won’t do the}

forensics

• _{Bolt-ons not working with my}

SIEM or data management systems

• _{Won’t collect the data types I}

Why Doesn't my

SIEM do this?

Isn’t that what I

Not really ...

• _{Most SIEM’s can’t handle the volume of}

data

• _{Most SIEMs can’t process all data types}

• _{Many based upon RDBMS}

No problem!

• _{I’ll buy a security analytics}

platform

• _{Feed event data in}

• _{Correlate across my SIEM and}

data warehouse

• _{Use my existing policies and}

reports!

Anger

SIEM Mashup

An#$Fraud*&* 3rd_{*Party*Analy#cs*}

General*Purpose* Analy#cs* DIY*“Big*Data”*

MSP*&*3rd_*Party*

Monitoring*

Threat*Intelligence*

SIEM%

Advanced*Malware* Protec#on*

Security Analytics Platforms

• _{Each deals with one use case - customers have}

several

• _{Companies need structured, unstructured and}

semi-structured data analysis

• _{Use different platforms internally, some}

piggy-back on select SIEM, some are standalone

• _{Real time _or_ forensic, not both}

• _{Vendors offer one or two analysis approach}

Bargaining

The Inevitable Questions:

• _{Bunch of previously acquired technologies - how}

do we fit them together?

• _{What is the rest of the industry doing?}

• _{Where are the enterprise grade analytics tools?}

• _{Who handles fraud and risk and security}

intelligence and threat analytics?

Encyclopedia Hutton Asks

Friends For Advice

DIY Security Analytics!

• _{Use ‘Big Data’ - it scales}

• _{It handles many types of data}

• _{You can customize as you see}

fit

• _{It’s designed to support}

Hadoop let’s you do all this and more - virtually free

analytics tools on commodity hardware!

Big Data Will

Save The

Day!

How does big data help?

• _Performance

• _Scalability

• _{Data volume}

• _{Data types}

• _{Fast lookup or fast analysis}

Depression

• _{Build everything from scratch?}

• _{Do you know how much this}

will cost?

• _{All new software}

• _{All new systems}

• _{Data architect, statisticians}

and security pro’s

Big Data is Supposed to

Address My Problems

Getting control is not easy

• _{I don’t know what I don’t know!}

• _{What pieces do I need?}

• _{How do I organize data?}

• _{How will I manage something this}

complex?

• _{How do I secure this critical}

It’s all new

…

• _{Pig? Hive? Flume?}

What does it mean?

• _{What exactly is a}

data architect?

• _{It’s not SQL?}

• _{Can I run queries}

across databases?

• _{How does it scale?}

• _{Key data on what}

values?

NoSQL Cluster Architecture

Talent Gap

http://flic.kr/p/efqfy9

• _{Early days for big data}

• _{No in-house data scientist}

• _{Programmers needed}

• _{Just figuring out what we can}

do with NoSQL

• _{DIY Analytics}

• _{Today vendors don’t know}

Integration Issues

• _{APIs inconsistent/unavailable}

• _{Log Management & data collection}

Acceptance

• _{Taking on the task that is}

security analytics with big data.

• _{Realizing that platforms like}

Hadoop are first step

• _{Cluster Security can be done}

• _{With the right skills, that can}

Applied Big Data

• _{Start with Metrics}

• _{Build a model (aka have a theory)}

• _{Test it!}

GQM

• _Goal

• _Question

Example - NIST CSF

ID.AM: The data, personnel, devices,

systems, and facilities that enable the

organization to achieve business

purposes are identified and managed

consistent with their relative

importance to business objectives

and the organization’s risk strategy.

Example - NIST CSF

Are network ingress points documented?

Are network egress points mapped?

Example - NIST CSF

# Undocumented egress points # of Undocumented Data Flows

% business units/business processes/etc. without data flow diagrams

SIRA - NIST CSF

Different Flavors of NoSQL

•  Hadoop - Universal M-R for huge data sets.

Great for search, log analysis, ad-hoc queries.

•  Cassandra - Columnar store. Indexed. Best for

writing lots of data quickly, few lookups. Highly distributable.

•  CouchDB - General purpose analytics database.

Fast insert/few changes. Pre-defined queries.

•  RIAK - Super-fast data lookup - like Dynamo -

but with data management and scalability. Control system logs and fast devices.

Operational Issues

Data at Rest Admin Access

Config. Management Monitoring

Node & App Validation

Big Data Security

Architectures

Model 1: Walled Garden

• _{Think Mainframe security silo}

• _{Basically hide the cluster behind firewall}

• _{User passwords}

Beyond the Status Quo

Model 2: App Protected

• _{Authenticate Applications}

• _{Authenticate Users}

• _{Authorize data access (roles)}

• _{Filter API requests}

Model 3: Data Centric Approach

Securosis Data Breach

Triangle

Data

Expl

oi

t

Eg

_res

Model 3: Data Centric Approach

• _{Protect data before it’s put into cluster}

• _{Can’t steal what’s not there}

• _{Removal: Masking}

• _{Removal: Tokenization}

Model 4: Deploy in ‘The

Cloud’

Given general knowledge of

Cloud & NoSQL security,

some of you are thinking this

does not end well

…

Reality is different

u _{Security Zones} u _{Data Encryption} u _{Built-in SSL}

u _{Authentication}

u _{Hyper-segregation} u _{Logging, monitoring}

Model 4: Leverage Cloud Security

• _{Data encryption (SSL, encrypted storage)}

• _{Key management services}

• _{Security zones}

• _{Authentication services}

• _{Server management (config, patch)}

Easy? No.

• _{Big Data Security is not easy}

- _{Complex environments} - _{No clear definition}

- _{Lots of new research} - _{Pragmatic approach} - _{Many more issues}

Adrian Lane

Securosis, L.L.C.

David Mortman