A New Paradigm to Address Threats for Virtualized Services

Abstract

With the uptaking of virtualization technologies and the growing usage of public cloud infrastructures, an ever larger number of applications run outside of the traditional enterprise's perimeter, and require new security paradigms that fit the typical agility and elasticity of cloud models in service creation and management. Though some recent proposals have integrated security appliances in the logical application topology, we argue that this approach is sub-optimal. Indeed, we believe that embedding security agents in virtualization containers and delegating the control logic to the software orchestrator provides a much more effective, flexible, and scalable solution to the problem. In this paper, we motivate our mindset and outline a novel framework for assessing cyber-threats of virtualized applications and services. We also review existing technologies that build the foundation of our proposal, which we are going to develop in the context of a joint research project.

An abstraction layer for cybersecurity context

“…Remote collection of logs is already a well established practice, with many frameworks available for this purpose: Scribe 1 , Flume 2 , Heka 3 , Logstash 4 , Chukwa 5 , fluentd 6 , nsq 7 and Kafka 8 . There are two ways to collect logs from applications: either forcing applications to directly write to these sources through specific APIs (as happens for Scribe, nsq and Kafka) or parsing their own log files (this option is available for Logstash, Heka, fluentd and Flume).…”

“…Recently, we have outlined the general architecture of a novel framework for AddreSsing ThReats for virtualIzeD services (ASTRID) [7]. The underlying concept is the decoupling of inspection tasks (to be integrated into the different forms of virtualization boxes, as Virtual Machines or containers) from a (logically) centralized ans shared detection logic (to be kept outside the graph), as schematically shown in Fig 1b. In this paper, we describe our on-going work about the definition of an abstraction layer to provide the detection logic with uniform and "bi-directional" access to heterogeneous security context of virtualized services.…”

Programmable Data Gathering for Detecting Stegomalware

“…The use of virtualization to support security-related duties and the mitigation of attacks targeting virtual services have been already partially investigated in the literature. For instance, the approaches proposed in [7], [8] take advantage of an orchestrator for controlling pervasive and lightweight security hooks embedded in the virtual layers at the basis of cloud applications. The work in [9] discusses a mechanism to enhance a network hypervisor with new functions for implementing a flexible monitoring service.…”

Data Log Management for Cyber-Security Programmability of Cloud Services and Applications

“…The general architecture of a novel framework proposed for AddreSsing ThReats for virtualIzeD services (ASTRID) [6] shifts security appliances away from service graph design. In ASTRID, security properties of each graph component as well as the whole service are defined by proper models and policies, which are then used at deployment time to properly configure the execution environment.…”

“…ASTRID leverages data plane technologies for fast and efficient monitoring and inspection of packets and software, removing the need for deploying many overwhelming virtual security appliances throughout the service graph; and iv) Portability of the security logic. Every orchestration engine has its own graph models and packaging format (e.g., OpenBaton, 2 TeNOR, 3 Arcadia, 4 Juju, 5 OpenStack Heat 6 ). If applications are deployed inside the service graphs, different versions must be built and maintained, which complicates the distribution of updates and security patches.…”