Single sign-on (SSO) is an important aspect of access management. It is an authentication method that enables users to securely authenticate with multiple applications and websites by using just one set of credentials – for example, a username and password coupled with multi factor authentication (MFA). This makes life easier for end users since they don’t have to remember multiple passwords. This also provides administrators a centralized way to manage all accounts and govern which users have access to them.
SSO works based upon a trust relationship set up between an application, known as the service provider, and an identity provider. This trust relationship is often based upon a certificate that is exchanged between the identity provider and the service provider. This certificate can be used to sign identity information that is being sent from the identity provider to the service provider so that the service provider knows it is coming from a trusted source. In SSO, this identity data takes the form of tokens which contain identifying bits of information about the user like a user’s username.
Advantages of SSO include the following:
Users need to remember and manage fewer passwords and usernames for each application.
The process of signing on and using applications is streamlined — no need to reenter passwords.
Fewer complaints or trouble about passwords for IT helpdesks.
Disadvantages of SSO include the following:
An attacker who gains control over a user’s SSO credentials is granted access to every application the user has rights to, increasing the amount of potential damage.
It does not address certain levels of security each application sign-on may need.
If availability is lost, users are locked out of all systems connected to SSO.
An application programming interface, or API, enables companies to open up their applications’ data and functionality to external third-party developers and business partners, or to departments within their companies. This allows services and products to communicate with each other and leverage each other’s data and functionality through a documented interface.
What is API Security?
Digital transformation is driving API adoption. APIs are the core of service-oriented and microservices architectures. They power mobile, web applications, SaaS and IoT devices. They can be found in customer-facing, partner-facing and internal applications. APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) to business partners and customers. Because of this, APIs have increasingly become a target for attackers.
API Security focuses on strategies and solutions to understand and mitigate the unique vulnerabilities and security risks of Application Programming Interfaces (APIs).
What are the OWASP API Security Top 10?
Here are the 2019 API Security top 10 and their mitigations:
API1:2019 Broken Object Level Authorization APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface Level Access Control issue. Object level authorization checks should be considered in every function that accesses a data source using an input from the user. Read more.
API2:2019 Broken User Authentication Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user’s identities temporarily or permanently. Compromising a system’s ability to identify the client/user, compromises API security overall. Read more.
API3:2019 Excessive Data Exposure Looking forward to generic implementations, developers tend to expose all object properties without considering their individual sensitivity, relying on clients to perform the data filtering before displaying it to the user. Read more.
API4:2019 Lack of Resources & Rate Limiting Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the client/user. Not only can this impact the API server performance, leading to Denial of Service (DoS), but also leaves the door open to authentication flaws such as brute force. Read more.
API5:2019 Broken Function Level AuthorizationComplex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws. By exploiting these issues, attackers gain access to other users’ resources and/or administrative functions. Read more.
API6:2019 Mass Assignment Binding client provided data (e.g., JSON) to data models, without proper properties filtering based on an allowlist, usually leads to Mass Assignment. Either guessing objects properties, exploring other API endpoints, reading the documentation, or providing additional object properties in request payloads, allows attackers to modify object properties they are not supposed to. Read more.
API7:2019 Security Misconfiguration Security misconfiguration is commonly a result of unsecure default configurations, incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS), and verbose error messages containing sensitive information. Read more.
API8:2019 Injection Injection flaws, such as SQL, NoSQL, Command Injection, etc., occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s malicious data can trick the interpreter into executing unintended commands or accessing data without proper authorization. Read more.
API9:2019 Improper Assets Management APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important. Proper hosts and deployed API versions inventory also play an important role to mitigate issues such as deprecated API versions and exposed debug endpoints. Read more.
API10:2019 Insufficient Logging & Monitoring Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems to tamper with, extract, or destroy data. Most breach studies demonstrate the time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring. Read more.
Majority of ramsomware and cyberattacks stem from phishing, social engineering, unpatched software and weak passwords. Mitigating these cover more than 80% of your cybersecurity defenses. Here are the three top defenses that you should prioritize right away to minimize your cybersecurity risk:
Mitigate Social Engineering
Educate your users about cybersecurity on a regular basis. Use creative ways for them to get engaged
Codify security policies and make sure to enforce them.
Common Vulnerabilities and Exposures (CVE), is a list of publicly disclosed computer security flaws. When someone refers to a CVE, they mean a security flaw that’s been assigned a CVE ID number.
The goal of CVE is to make it easier to share information about known vulnerabilities so that cybersecurity strategies can be updated with the latest security flaws and security issue. CVEs help vendors, developers, security and IT professionals coordinate their efforts to prioritize and address these vulnerabilities to make computer systems more secure.
CVE was launched in 1999 by the MITRE corporation to identify and categorize vulnerabilities in software and firmware. CVE provides a free dictionary for organizations to improve their cybersecurity. MITRE is a nonprofit that operates federally funded research and development.
A CVE entry describes a known vulnerability or exposure. Each CVE entry contains a standard identifier number with status indicator (i.e. “CVE-1999-0067”, “CVE-2014-12345”, “CVE-2016-7654321”), a brief description and references related vulnerability reports and advisories.
Each CVE ID is formatted as CVE-YYYY-NNNNN. The YYYY portion is the year the CVE ID was assigned or the year the vulnerability was made public.
Unlike vulnerability databases, CVE entries do not include risk, impact fix or other technical information.
Cyber resiliency engineering intends to architect, design, develop, implement, maintain, and sustain the trustworthiness of systems with the capability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises that use or are enabled by cyber resources. From a risk management perspective, cyber resiliency is intended to help reduce the mission, business, organizational, enterprise, or sector risk of depending on cyber resources.
NIST has published Special Publication (SP) 800-160 Volume 2, Revision 1, Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. It presents a cyber resiliency engineering framework to aid in understanding and applying cyber resiliency, a concept of use for the framework, and the engineering considerations for implementing cyber resiliency in the system life cycle. The framework constructs include goals, objectives, techniques, implementation approaches, and design principles. Organizations can select, adapt, and use some or all of the cyber resiliency constructs in this publication and apply the constructs to the technical, operational, and threat environments for which systems need to be engineered.
The guidance helps organizations anticipate, withstand, recover from, and adapt to adverse conditions, stresses, and compromises on systems – including hostile and increasingly destructive cyber-attacks from nation-states, criminal gangs, and disgruntled individuals.
Quantum computing, the next generation of computing, has been in development for the past several years and most likely will reach its full potential in the next several years.
Quantum computing harnesses the laws of quantum mechanics to solve problems too complex for today’s computers. It uses qubits (CUE-bits) to run multidimensional quantum algorithms. It is capable of solving certain computational problems substantially faster than today’s computer, such as integer factorization, which is the underlying technology of RSA encryption.
RSA encryption, alongside elliptic-curve cryptography are widely used today to encrypt our financial transactions on the web and keep intellectual property, military, and medical data secret. When quantum computers become available, these defenses will fail and data will be exposed. It will only take several hours for quantum computers to decrypt the current RSA encryption standard.
To this end, computer scientist have been working hard towards creating a “post-quantum cryptography” (PQC) encryption protocols that should outpace the capability of quantum computers. The National Institute of Standards and Technology (NIST) researchers have been working for years and recently have given their stamp of approval to some mathematical equations that quantum computers would struggle to hack. In 2016 it launched a competition to find algorithm for PQC, receiving 82 submissions from 25 countries. After three rounds of sifting and analysis, four winning techniques and four backup approaches have emerged.
NIST recommends two primary algorithms to be implemented for most use cases: CRYSTALS-KYBER (key-establishment) for general encryption and CRYSTALS-Dilithium for digital signatures. In addition, the signature schemes FALCON and SPHINCS+ will also be standardized.
More information on these PQC algorithms can be found on NIST website:
Zero Trust security is an IT security framework that requires all users and devices, whether in or outside the organization’s network perimeter, to be authenticated, authorized, and continuously validated before being granted or keeping access to applications and data. In a traditional IT network, it is hard to obtain access from outside the network, but once inside the network, everyone is trusted by default whereas a Zero Trust model trusts no one and nothing. The problem with traditional IT network is that once an attacker gains access to the network, they have free rein over everything inside.
The main principle of Zero Trust security are the following:
Least privilege access. Give users only only the bare minimum level of access necessary to perform job-specific tasks. This will minimize each user’s exposure to sensitive parts of the network.
Continuous monitoring and validation. Verify users and devices identity and privileges continuously and time out logins and connections periodically once established.
Device access control. Ensure that every device in the network is authorized, and assess all devices to make sure they have not been compromised.
Terminate every connection. Allow an inline proxy architecture to inspect all traffic, including encrypted traffic, in real time — before it reaches its destination — to prevent ransomware and malware.
Microsegmentation. Break up security perimeters into small zones to maintain separate access for separate parts of the network.
Multi factor authentication (MFA). Require users at least 2 sources of evidence to identify themselves. For example, in addition to entering a password, users must also enter a code sent to another device, such as a mobile phone, thus providing two pieces of evidence that they are who they claim to be.
Prevent lateral movement. “Lateral movement” is when an attacker moves within a network after gaining access to that network. Zero Trust is designed to contain attackers so that they cannot move laterally. Once the attacker’s presence is detected, the compromised device or user account can be quarantined and cut off from further access.
These principles will reduce the organization’s security risk by minimizing or even eliminating the attack surface.
A green data center is a “service facility which utilizes energy-efficient technologies. They do not contain obsolete systems (such as inactive or underused servers), and take advantage of newer, more efficient technologies.” All the components of a green data center including mechanical, lighting, electrical and computer systems are designed to maximize energy efficiency and minimize environmental impact.
Some technologies and strategies used in green data center include:
Low-power servers. They are more energy-efficient than conventional servers in data centers. They use the technology of smartphone computing, which tries to balance performance with energy consumption.
Modular data center. It is a portable data center which can be placed anywhere data capacity is needed. Compared with traditional data centers, they are designed for rapid deployment, energy efficiency and high density.
E-waste recycling. Re-use servers and components.
Free air cooling systems uses outdoor air instead of traditional data-center computer room air conditioner (CRAC) units.
Hot and cold aisle containment
Reusing waste heat.
Minimized building footprint
Low-emission building materials, carpets and paints
Alternative energy, such as photovoltaic technology, heat pumps, ultrasonic humidification, and evaporative cooling technology
With the exponential growth and usage of the Internet, power consumption in data centers has increased significantly resulting in huge environmental impact. The creation of green data centers has become essential to mitigate climate change.
AWS has 20+ security tools and services that you can use to secure your data and applications in AWS cloud. These tools and services cover your data protection needs, identity and access management, network and application protection, threat detection and monitoring, and compliance and data privacy.
The following ten security tools are the most useful services that you should start using to improve your security posture:
AWS Security Hub is a cloud security posture management service that performs security best practice checks, aggregates alerts, and enables automated remediation. It quickly assesses your high-priority security alerts and security posture across AWS accounts in one comprehensive view.
AWS Identity and Access Management (IAM) provides fine-grained access control across all of AWS. With IAM, you can specify who can access which services and resources, and under which conditions. With IAM policies, you manage permissions to your workforce and systems to ensure least-privilege permissions. AWS IAM also has multi-factor authentication and supports single sign-on (SSO) access to further secure and centralize user access.
AWS GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.
AWS Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS. Macie automatically provides an inventory of Amazon S3 buckets including a list of unencrypted buckets, publicly accessible buckets, and buckets shared with AWS accounts, then it applies machine learning and pattern matching techniques to the buckets you select to identify and alert you to sensitive data, such as personally identifiable information (PII).
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, change management, and operational troubleshooting.
AWS CloudTrail monitors and records account activity across your AWS infrastructure, giving you control over storage, analysis, and remediation actions. You can view and search these events to identify unexpected or unusual requests in your AWS environment.
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency.
Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. These assessments include network access, common vulnerabilities and exposures (CVEs), Center for Internet Security (CIS) benchmarks, and common best practices such as disabling root login for SSH and validating system directory permissions on your EC2 instances.
AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits and bots that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that control bot traffic and block common attack patterns, such as SQL injection or cross-site scripting. You can also customize rules that filter out specific traffic patterns.
AWS Audit Manager helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards. Audit Manager automates evidence collection to reduce the “all hands on deck” manual effort that often happens for audits and enable you to scale your audit capability in the cloud as your business grows.
A cybersecurity framework is a system of standards, guidelines, and best practices to manage cyber risks. The three most popular cybersecurity framework are:
The US National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (NIST CSF)
The Center for Internet Security Critical Security Controls (CIS)
The International Standards Organization (ISO) frameworks ISO/IEC 27001 and 27002.
NIST cybersecurity framework is intended to be used to protect any organization’s infrastructure from cyberattacks. The framework’s core is a list of cybersecurity functions that follow the basic pattern of cyber defense: identify, protect, detect, respond, and recover. The framework provides an organized mechanism for identifying risks and assets that require protection.
Identify
The Identify Function assists in developing an organizational understanding to managing cybersecurity risk to systems, people, assets, data, and capabilities. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs. Examples of outcome Categories within this Function include:
Identifying physical and software assets within the organization to establish the basis of an Asset Management program
Identifying the Business Environment the organization supports including the organization’s role in the supply chain, and the organizations place in the critical infrastructure sector
Identifying cybersecurity policies established within the organization to define the Governance program as well as identifying legal and regulatory requirements regarding the cybersecurity capabilities of the organization
Identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities as a basis for the organizations Risk Assessment
Identifying a Risk Management Strategy for the organization including establishing risk tolerances
Identifying a Supply Chain Risk Management strategy including priorities, constraints, risk tolerances, and assumptions used to support risk decisions associated with managing supply chain risks
Protect
The Protect Function outlines appropriate safeguards to ensure delivery of critical infrastructure services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include:
Protections for Identity Management and Access Control within the organization including physical and remote access
Empowering staff within the organization through Awareness and Training including role based and privileged user training
Establishing Data Security protection consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information
Implementing Information Protection Processes and Procedures to maintain and manage the protections of information systems and assets
Protecting organizational resources through Maintenance, including remote maintenance, activities
Managing Protective Technology to ensure the security and resilience of systems and assets are consistent with organizational policies, procedures, and agreements
Detect
The Detect Function defines the appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables timely discovery of cybersecurity events. Examples of outcome Categories within this Function include:
Ensuring Anomalies and Events are detected, and their potential impact is understood
Implementing Security Continuous Monitoring capabilities to monitor cybersecurity events and verify the effectiveness of protective measures including network and physical activities
Maintaining Detection Processes to provide awareness of anomalous events
Respond
The Respond Function includes appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident. Examples of outcome Categories within this Function include:
Ensuring Response Planning process are executed during and after an incident
Managing Communications during and after an event with stakeholders, law enforcement, external stakeholders as appropriate
Analysis is conducted to ensure effective response and support recovery activities including forensic analysis, and determining the impact of incidents
Mitigation activities are performed to prevent expansion of an event and to resolve the incident
The organization implements Improvements by incorporating lessons learned from current and previous detection / response activities
Recover
The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a cybersecurity incident. Examples of outcome Categories within this Function include:
Ensuring the organization implements Recovery Planning processes and procedures to restore systems and/or assets affected by cybersecurity incidents
Implementing Improvements based on lessons learned and reviews of existing strategies
Internal and external Communications are coordinated during and following the recovery from a cybersecurity incident
