Questions tagged [cloud-computing]

Cloud computing is about hardware-based services involving computing, network and storage capacities. These services are provided on-demand, hosted by the cloud provider and can easily scale up and down.

Filter by
Sorted by
Tagged with
0
votes
0answers
41 views

Question about jobs regarding Datacenter Security / Cloud Security [closed]

first post here! I had a question in regards to pursuing a career related to Datacenter Security (Iron Mountain type company or Data Integrity type company) or Cloud Security where I am not tied to ...
1
vote
0answers
54 views

Is a VPN + Firewall + Authorization Redundant?

I am creating a simple application so a distributed team can access sensitive data. This application will have a database that will be inaccessible to the public internet inside a VPC with my cloud ...
0
votes
1answer
70 views

Use of HTTP functions in GCP Cloud Functions Is Not Secure. Why they are still available?

As Google mentions itself in the documentation, the HTTP functions in Cloud Functions have no authentication and are not secure. HTTP functions are unprotected and will respond to any HTTP request,...
0
votes
0answers
32 views

Terraform Openstack Security Review

We’re a small company and I’m the so called designated “security guy” whiles we try to hire a security consultant. Our developers are creating a solution with terraform and openstack. Apart from ...
0
votes
1answer
124 views

How to make it harder for a VPS provider to access my data?

I know it is impossible to completely prevent a host from accessing the data of a virtual machine (as noted here, here and here), but I think there is value in making it harder to do so. Bare metal ...
44
votes
9answers
8k views

I have just 4 hours a month to security check a cloud based application - How to use my time?

I've been tasked with looking after an application deployed to azure. I have been allocated 4 hours a month. I essentially have half a workday to secure this application / keep it secure. What is an ...
0
votes
0answers
80 views

What is the best practice to run Openvas on Azure?

I have created a Kali VM on Azure to use for my pentesting engagement. I was able to access Openvas GM from my desktop, however I could not log in the GM even though I reset my GM password again and ...
3
votes
1answer
168 views

Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?

Why can any application or user on your server type an insecure URL like these to get server information about that instance? http://instance-data.us-east-1.compute.internal/latest/meta-data/ http://...
5
votes
1answer
161 views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
0
votes
0answers
32 views

Fundamental difference in security research in Cloud platform VM and normal machine

I am trying to study the effects of various network based attacks in an Openstack Cloud environment that I have setup with few machines. However, what would be the fundamental difference between a VM ...
1
vote
1answer
70 views

Is encryption/decryption done in the cloud when using CMK keys?

I am trying to understand how AWS KMS works, and there is one thing I am still not completely sure of: when using CMKs, so no Data Keys, no envelop encryption, does the encryption take place in the ...
2
votes
1answer
51 views

content disposition headers vs cloud and inspection

Quoting from McAfee MVISION CASB Many cloud services use custom content disposition headers in an effort to improve the performance of their applications. These custom headers have the ...
2
votes
2answers
111 views

How to protect a server against Cloud Hopper?

Almost everyone is using cloud service providers for their computing needs these days, including myself. I am getting increasingly paranoid about a Cloud Hopper threat recently described in this ...
2
votes
3answers
139 views

What are the techniques to know if VPS cloud hosting provider is accessing my data?

Immutable laws of security: https://fossbytes.com/10-immutable-laws-security-microsoft/ If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. I understand ...
1
vote
0answers
52 views

What are some common AWS Lamdba (specific) Security Pitfalls, Auditing Tools, and Methods of Mitigation?

I am writing a research paper detailing the security vulnerabilities of serverless AWS lambda applications, and how to prevent them. I am also compiling a list of security auditing tools that are ...
1
vote
0answers
105 views

Instance metadata on IBM Cloud [closed]

Is there any way to get instance metadata on IMB Cloud (a.k.a Bluemix) K8s cluster, from a compromised pod? Something like doing curl to http://metadata.google.internal/computeMetadata/v1/instance/......
2
votes
1answer
101 views

Is a good idea to have security logs stored in the cloud?

I was discussing with my friend the topic of the importance of log analytics/correlation and real-time response for an organization. Then, he mentioned that some people consider sending logs (...
2
votes
4answers
569 views

What are the benefits of using IP whitelists to secure cloud servers/resources?

Consider the following scenario: There is a "server" (e.g. database, API, etc) that is "in the cloud" (i.e. hosted on physical hardware that is physically distant from the clients and reachable only ...
1
vote
1answer
27 views

Wifi Cloud Storage

If you move files from an infected machine to a Wi-Fi Cloud storage, then move the same files from the Wi-Fi storage to a non infected machine, could you infect your new non infected machine?
1
vote
0answers
49 views

Secure API access with mobile apps in restricted environments

In our current project, IT rules prohibit anything that is not PROD to be publicly accessible from the Internet. Access to development and review environments must be severely restricted. That said, ...
4
votes
1answer
72 views

Is there any harm to writing a short plain-text string to authorized_keys?

I have a CFN template where I'm seeding an authorized key for testing via paramaters, through a build server. If this value is not provided by the build job, it defaults to a short, plain text string, ...
1
vote
0answers
59 views

Hybrid cloud access controls

In a hybrid cloud setup, where we have a cloud component which writes data into an on premise component, is it necessary to have separate access controls between the cloud and on premise? Our ...
2
votes
2answers
402 views

AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation

I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture. We are using components such as AWS Lambda, AWS ...
0
votes
1answer
55 views

The main things a cloud data center could inject into its hardware

So some cloud service providers like Amazon use custom hardware to improve different characteristics of their servers. This also means they can control the security better, because there is nothing ...
1
vote
0answers
62 views

What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?

When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2. I have gone ...
1
vote
1answer
601 views

do we need VPN for SaaS cloud applications?

If we need to connect to the corporate network from home, we need to have the VPN connection. However, what if for accessing SaaS applications like Google Doc, Salesforce, etc, do we need still need ...
0
votes
0answers
94 views

Meltdown checker says AWS and Rackspace is vulnerable - Why?

Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with 7 of 8 variants OK (the failed one is apparently ...
1
vote
1answer
1k views

Is it safe to keep my KeePassX database on my server or cloud with encryption? [duplicate]

My KeePassX file has a long and strong password. I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus ...
2
votes
1answer
591 views

Amazon EC2 Abuse Report

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance. The email states: We observed machines under your control ...
2
votes
1answer
114 views

What are some attacks to consider in a cloud deployment? [duplicate]

I want to discuss the following scenario: I use a cloud provider like Amazon where every instance of the OS is a VM. The hypervisor launches the VMs as needed. So let's assume there are two VMs ...
1
vote
1answer
176 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
4
votes
5answers
995 views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
4
votes
3answers
693 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
0
votes
3answers
128 views

Security risks of exposing a VM to single IP address on the Internet

I have a small office network with about 10 workstations and a single physical domain controller. I want to move it to the cloud. For that, I deployed a Windows VM on Azure, which I'm going to promote ...
0
votes
2answers
131 views

Privacy of client's virtual machine in cloud computing

As we know clients can create and run their virtual machines (VM)in the cloud computing. My question is about the confidentiality of data stored in the client's VM. Question 1: Does data stored in a ...
1
vote
1answer
34 views

Safely connect to remote site from cloud based code

I am connecting my computer located at my home to a remote server. To communicate with the server, I use a config file that contains my private and public keys and a passphrase. My code reads the ...
3
votes
1answer
74 views

How does security work in a cloud-to-cloud backup scenario?

I'm thinking of using Spinbackup which is a cloud-to-cloud backup of gmail, but I was resistant to the idea of telling Spinbackup my gmail password for obvious reasons. However, on the Spinbackup ...
1
vote
1answer
202 views

Penetration Testing of IaaS/PaaS environment - CVSS Score

How can I measure the effectiveness of a Penetration Testing carried out in a Cloud Environment (IaaS/PaaS) by a third Party Vendor ? Should I ask for a CVSS score or something else ? Any advise will ...
0
votes
1answer
280 views

How does the TPM provide security for the cloud?

The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended". ~Wiki I'm learning more about how the TPM performs integrity covering ...
0
votes
1answer
35 views

Do I need to trust my Paas provider?

I am currently entering the world of deploying my web application to the cloud. While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The ...
7
votes
3answers
280 views

What are the privacy conerns with cloud based submission in antivirus?

It seems like many antivirus programs use the cloud to scan files for malware. Isn't this a privacy concern if local files are being uploaded to the cloud? For example with Automatic Sample Submission ...
0
votes
1answer
762 views

Detect and Scan Open Ports

I am trying to understand two questions - I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
-1
votes
1answer
152 views

How can I protect my cloud processing from everyone … even those with root access?

How can I run my top secret code and data on any cloud hosting provider such that everyone even the hosting vendor with root is denied access ? ... a research proposal What is the current state of ...
2
votes
0answers
353 views

HIPAA compliant chat app with 3rd party provider without signing a BAA?

Short: If the data (PHI) I send to a third party is already encrypted, do I still need to sign a Business Associate Agreement (BAA) with them to stay HIPAA compliant? Long: To be specific, I was ...
3
votes
2answers
124 views

How do companies manage resources shared with 3rd parties on cloud platforms?

Over the years people at my company have shared resources on cloud platforms with 3rd many parties. This can be files on Google Drive, articles on Confluence, repositories on Github, slack channels, ...
9
votes
1answer
445 views

What does Spectre mean for public cloud computing?

From a tweetstorm by security journalist Nicole Perlroth: The most visceral attack scenario is an attacker who rents 5 minutes of time from an Amazon/Google/Microsoft cloud server and steals data ...
4
votes
1answer
218 views

AWS Tenant Restrictions

I'm a sysadmin of a medium sized chain of Italian restaurants. While I'm not dealing with patient health records or financial information I am still security focused. I'm trying to achieve tenant ...
5
votes
1answer
161 views

Using SSL (e.g. storing private keys) in SAAS / managed applications

How does one evaluate the risk of storing a private key (secret) on services like the AWS elastic load balancer, or for the purpose of my question: any service non-self managed service that could ...
2
votes
1answer
200 views

Office 365 “ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken”

I've detected a number of illegitimate logins to Office 365 (based on Client IP). In the audit log, the operation is listed as "ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken." I'm not ...
0
votes
1answer
76 views

A term for a policy that forbids employees storing intellectualy property (e.g. Source Code) on hosted third parties services

To be honest, I was not sure if this belongs to this board or Law Stack Exchange. I am searching for a specific term that describes a policy that a company does not allow itself to share its ...