Keys to secure cloud migration

Matthew McKenna is chief commercial officer at SSH Communications Security.

With a mandate for cost efficiency, the federal government is embarking on a massive initiative to migrate selected new and legacy functions to commercial cloud services without disruption. To do so safely, federal IT architects need to follow defined security requirements for the federal use of cloud services. The Federal Risk and Authorization Management Program (FedRAMP) is a governance framework based on National Institute of Standards and Technology (NIST) 800-53 controls and is aimed at supporting the federal cloud initiative without compromising security.

The difficulty of effectively implementing a security framework is making sure there are no major gaps between the framework and the technical and administrative controls used. One of the most common areas of disconnect between security intent and implementation is in the realm of privileged, encrypted access.

Broadly used for security across the Internet and mobile networks—including the cloud—the Secure Shell protocol uses key-based authentication to access critical information. Keys are easy to create and are basically simple text files. Associated with each key is an identity: either a person or machine that grants access to data and performs specific tasks. Secure Shell keys provide access to some of the most critical information within an organization. In cloud environments, these authorizations can extend into the hypervisor and orchestration layer.

Here’s the problem: system administrators and application developers will often deploy keys in order to quickly access systems they are working on. These keys grant a fairly high level of privilege and are often used across multiple systems, creating a one-to-many relationship. In many cases, employees or contractors who are terminated – or even simply reassigned – continue to carry Secure Shell key access. Terminating the account is no enough with Secure Shell keys; they must also be removed, or the access remains in place.

Another issue is that administrators can use unmonitored Secure Shell keys to undermine privileged access management systems (PAMs). Many PAM systems use a gateway or jump host that administrators log into to access network assets. PAM solutions connect with user directories to assign privilege, monitor user actions and record which actions have taken place. This would work perfectly, except that administrators can easily log into the gateway, deploy a key and then log in using key authentication – a clever way to work around PAM safeguards.

Conventional PAM solutions, which use gateways and focus on interactive users only, are designed to monitor administrator activities. But again, they are fairly easy to work around. Additionally, encryption blinds attackers the same way it blinds security operations and forensics teams. For this reason, encrypted traffic is rarely monitored and is allowed to flow freely in and out of the network environment to allow these blind spots to exist. This creates obvious risks and negates security intelligence capabilities to a large degree. In order to eliminate this risk, the organization must decrypt and inspect the traffic.

This Secure Shell Traffic needs to be decrypted without interfering with the network, so federal IT admins would need to use an inline proxy with access to the private keys – essentially a friendly man-in-the-middle. When this method is successfully deployed, 100 percent of encrypted traffic for both interactive users and M2M identities can be monitored. Also, because this is done at the network level, it is not subject to attack by host-based malware. With this method, federal agencies can proactively detect suspicious or out-of-policy traffic and eliminate network traffic blind spots. This is called encrypted channel monitoring and represents the next generation in the evolution of PAM.

For federal IT admins, FedRAMP means having a level of visibility into these encrypted communications that wasn’t required before and is now central to the security needs of cloud services. Using encrypted channel monitoring lets federal agencies move past the gateway approach to PAM, instead enabling them to monitor and control encrypted sessions based on policy and context.

To successfully and safely migrate data to the cloud, federal IT administrators should keep in mind not only the access controls in context needed for privileged users but also for privileged processes, because there is a higher degree of automation in a cloud services environment. Automated processes are now taking over more and more privileged functions, creating a need to monitor those as well.

Federal agencies are bound by both the critical nature of their digital assets and by frameworks such as FedRAMP to inspect their encrypted networks and those of their cloud service providers to ensure that they are being proactively and continuously monitored. A comprehensive security strategy that includes this crucial element will help protect government data and give federal IT admins greater peace of mind as they oversee cloud migration projects.