Technical Report on Deploying a highly secured OpenStack Cloud Infrastructure using BradStack as a Case Study

Cloud computing has emerged as a popular paradigm and an attractive model for providing a reliable distributed computing model.it is increasing attracting huge attention both in academic research and industrial initiatives. Cloud deployments are paramount for institution and organizations of all scales. The availability of a flexible, free open source cloud platform designed with no propriety software and the ability of its integration with legacy systems and third-party applications are fundamental. Open stack is a free and opensource software released under the terms of Apache license with a fragmented and distributed architecture making it highly flexible. This project was initiated and aimed at designing a secured cloud infrastructure called BradStack, which is built on OpenStack in the Computing Laboratory at the University of Bradford. In this report, we present and discuss the steps required in deploying a secured BradStack Multi-node cloud infrastructure and conducting Penetration testing on OpenStack Services to validate the effectiveness of the security controls on the BradStack platform. This report serves as a practical guideline, focusing on security and practical infrastructure related issues. It also serves as a reference for institutions looking at the possibilities of implementing a secured cloud solution.Comment: 38 pages, 19 figures

Ensuring system integrity and security on limited environment systems

Cyber security threats have rapidly developed in recent years and should also be considered when building or implementing systems that traditionally have not been connected to networks. More and more these systems are getting networked and controlled remotely, which widens their attack surface and lays them open to cyber threats. This means the systems should be able to detect and block malware threats without letting the controls affect daily operations. File integrity monitoring and protection could be one way to protect systems from emerging threats. The use case for this study is a computer system, that controls medical device. This kind of system does not necessarily have an internet connection and is not connected to a LAN network by default. Ensuring integrity on the system is critical as if the system would be infected by a malware, it could affect to the test results. This thesis studies what are the feasible ways to ensure system integrity on limited environment systems. Firstly these methods and tools are listed through a literature review. All of the tools are studied how they protect the system integrity. The literature review aims to select methods for further testing through a deductive reasoning. After selecting methods for testing, their implementations are installed to the testing environment. The methods are first tested for performance and then their detection and blocking capability is tested against real life threats. Finally, this thesis proposes a method which could be implemented to the presented use case. The proposal at the end is based on the conducted tests

The impact of cybersecurity on industrial processes. Understand the risks and how to mitigate the consequences

La ciberseguretat s'està convertint en un tema cada dia més important que les empreses no poden ignorar, sobretot perquè actualment la majoria d'atacs han evolucionat fins al punt de fer que l'antivirus i el tallafocs siguin insuficients per garantir la protecció de la pròpia organització, estimulant els responsables en la ciberseguretat a invertir. cada cop més per estar al dia amb les amenaces cada cop més complexes. S'ha arribat a un punt en què els atacants, donada la creixent dificultat per dur a terme ciberatacs a les xarxes informàtiques, han començat a plantejar-se la possibilitat d'orientar-se envers empreses manufactureres en els entorns on són més vulnerables, maquinària i xarxes industrials. Actualment aquestes han perdut la protecció per la segregació que tenien en els darrers anys, degut a la introducció massiva de l'IoT i als nous paradigmes de la indústria 4.0 que estan imposant l'obertura cap a sistemes externs com el núvol i una estreta integració amb els sistemes empresarials. Això és molt perillós perquè fins i tot s'ha exposat maquinària fràgil que podria perdre la disponibilitat fins i tot amb atacs simples o accions aparentment inofensives, basades en versions obsoletes de programari i sistemes operatius, que es comuniquen entre entre sí amb protocols de comunicació clars, sense autenticació, ni criptografia. Aquest projecte es posiciona en aquesta àrea i tracta de la seguretat d'una línia de panells de recent compra que s'ha d'inserir en una de les instal·lacions de producció de Fincantieri, respectant totes les polítiques de ciberseguretat corporativa, bones pràctiques, limitant l'augment al mínim de la superfície d'atac després de la seva inserció. Les activitats s'han centrat en l'anàlisi dels riscos potencials als quals podria estar exposat aquest sistema i la definició dels correctius. Tenint en compte l'entorn en el qual operem, no sempre és possible actuar sobre l'origen del problema i sovint s'han de trobar mesures alternatives.La ciberseguridad se está convirtiendo día a día en un tema cada vez más importante que las empresas no pueden ignorar, sobre todo porque hoy en día la mayoría de los ataques han evolucionado hasta el punto de hacer que los antivirus y firewall sean insuficientes para garantizar la protección de la propia organización, estimulando a los responsables en la ciberseguridad a invertir más y más para mantenerse al día con las amenazas cada vez más complejas. Se ha llegado a un punto en el que los atacantes, ante la creciente dificultad para realizar ciberataques en redes IT, han comenzado a apuntar las empresas manufactureras en los entornos donde son más vulnerables, maquinaria y redes industriales. Hoy en día estas redes han perdido la protección por la segregación que tenían en los últimos años, debido a la introducción masiva de IoT y los nuevos paradigmas de Industria 4.0 que están imponiendo la apertura hacia sistemas externos como la nube y una estrecha integración con los sistemas de negocios. Esto es muy peligroso porque incluso se ha expuesto maquinaria frágil que podría perder disponibilidad también con simples ataques o acciones aparentemente inofensivas, basadas en versiones obsoletas de software y sistemas operativos, que se comunican entre sí con protocolos de comunicación claros, sin autenticación ni criptografía. Este proyecto se posiciona en esta área y trata de la seguridad de una línea de paneles recientemente comprada que debe insertarse en uno de los sitios de producción de Fincantieri, respetando todas las políticas corporativas de ciberseguridad, las mejores prácticas, limitando al mínimo el aumento de la superficie de ataque para la empresa tras su inserción. Las actividades se centraron en el análisis de los riesgos a los que podría estar expuesto dicho sistema y la definición de remediación. Teniendo en cuenta el entorno en el que operamos, no siempre es posible actuar sobre el origen del problema y muchas veces se deben encontrar alternativas.Cybersecurity is becoming an increasingly important topic day after day that cannot be ignored anymore by companies, especially since nowadays most attacks have evolved to the point of making antivirus and firewalls insufficient to guarantee the protection of organizations, pushing who is deputed to cybersecurity to invest more and more to keep up with the increasingly complex threats. Security has reached a level that attackers, given the increasing difficulty in carrying out cyber-attacks in IT networks, have begun to consider the possibility of targeting manufacturing companies in environments where they are most vulnerable: industrial systems and networks. Nowadays these networks have lost the protection due to segregation they had in the past years because of the massive introduction of IoT and the new paradigms of Industry 4.0 that are imposing the opening towards external systems such as the cloud and a tight integration with the corporate systems. This is very dangerous because even fragile machinery that could lose availability even with simple attacks or apparently harmless actions has been exposed. These assets are often based on obsolete versions of software and operating systems that communicate each other with clear text communication protocols, without any authentication or cryptography. This project is positioned in this area and deals with securing a recently purchased panel line that has been inserted in one of Fincantieri's production sites, respecting all corporate cybersecurity policies, best practices, limiting the increase of the attack surface due to its insertion in the company to the minimum. The activities focused on the analysis of the potential risks to which this system could be exposed and the definition of remediation. Considering the environment in which it has been operated, it is not always possible to act on the source of the problem and alternative measures must often be found that limit the criticalities highlighted

The Challenges of Network Security Remediation at a Regional University.

This thesis describes challenges encountered during a year-long effort to improve the security of the 3,300 node administrative computer network at East Tennessee State University. The key remediation strategies used included employing the vulnerability scanner Nessus to profile the network, analyzing the scan results, and attempting to remove the most critical vulnerabilities found. The project succeeded in decreasing known “high” criticality vulnerabilities on campus by 26.1%, and confirmed four standard observations about the challenges of network administration: Vulnerability scanning is a lengthy task best performed in parallel and supported by automated data analysis.Securing a network is like trying to hit a moving target, due to an ever-increasing proliferation of networked hosts, services enabled by default install and lists of vulnerabilities to address.Failures of common sense are still among the primary threats to network security.Failing to retain management support for the security hardening process can jeopardize the project

Design of an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS) for the EIU Cybersecurity Laboratory

Cyber Security will always be a subject of discussion for a long time to come. Research has shown that there is massive growth of cyber-crime and the currently available number of Cyber Security experts to counter this is limited. Although there are multiple resources discussing Cyber Security, but access to training in practical applications is limited. As an institution, Eastern Illinois University (EIU) is set to start Masters of Science in Cyber Security in Fall 2017. Then the challenge is how EIU will expose students to the practical reality of Cyber Security where they can learn different detection, prevention and incidence analysis techniques of cyber-attacks. In addition, students should have the opportunity to learn cyber-attacks legally. This research proposes a solution for these needs by focusing on the design of firewall architecture with an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) for the EIU Cyber Security Laboratory. This thesis explores different up to date techniques and methods for detection and prevention of cyber-attacks. The overall outcome of this research is to design a public testing site that invites hackers to attack for the purpose of detection, prevention and security incidence analysis. This public firewall might empower students and instructors with practical cyber-attacks, detection techniques, prevention techniques, and forensics analysis tools. It may also provide the knowledge required for further research in the field of Cyber Security

Integrated cybersecurity for metaverse systems operating with artificial intelligence, blockchains, and cloud computing

In the ever-evolving realm of cybersecurity, the increasing integration of Metaverse systems with cutting-edge technologies such as Artificial Intelligence (AI), Blockchain, and Cloud Computing presents a host of new opportunities alongside significant challenges. This article employs a methodological approach that combines an extensive literature review with focused case study analyses to examine the changing cybersecurity landscape within these intersecting domains. The emphasis is particularly on the Metaverse, exploring its current state of cybersecurity, potential future developments, and the influential roles of AI, blockchain, and cloud technologies. Our thorough investigation assesses a range of cybersecurity standards and frameworks to determine their effectiveness in managing the risks associated with these emerging technologies. Special focus is directed towards the rapidly evolving digital economy of the Metaverse, investigating how AI and blockchain can enhance its cybersecurity infrastructure whilst acknowledging the complexities introduced by cloud computing. The results highlight significant gaps in existing standards and a clear necessity for regulatory advancements, particularly concerning blockchain’s capability for self-governance and the early-stage development of the Metaverse. The article underscores the need for proactive regulatory involvement, stressing the importance of cybersecurity experts and policymakers adapting and preparing for the swift advancement of these technologies. Ultimately, this study offers a comprehensive overview of the current scenario, foresees future challenges, and suggests strategic directions for integrated cybersecurity within Metaverse systems utilising AI, blockchain, and cloud computing

Network Security Intelligence for Small and Medium Scale Industry 4.0: Design and Implementation

The development of Internet of Things (IOT) technology became one of the proponents in the industrial revolution 4.0. Digital transformation began to be applied to the entire manufacturing industry, services, transportation and education which have slowly shifted utilizing IOT technology. The industrial revolution 4.0 has an impact on digital transformation and becomes a necessity that can change business patterns such as the ease of data interaction services between industries to customers that are also supported by ease of access and speed of decision making. However, in its development, stakeholders tend to focus on infrastructure and information systems, while the security of information systems is still a comfort zone for industries in the transformation to industry 4.0. The issue of information system security will be a challenge for the industry with open access to information systems, otherwise focus will hamper the business process of the industry. In this research will be discussed about the modeling and implementation of information system security with a combination of web-based security methods with port knocking firewall model and short message service gateway as a security medium with the concept of ease of access with safe and comfortable. The result of this research has been testing penetration testing using network tools

Moving target defense for securing smart grid communications: Architectural design, implementation and evaluation

Supervisory Control And Data Acquisition (SCADA) communications are often subjected to various kinds of sophisticated cyber-attacks which can have a serious impact on the Critical Infrastructure such as the power grid. Most of the time, the success of the attack is based on the static characteristics of the system, thereby enabling an easier profiling of the target system(s) by the adversary and consequently exploiting their limited resources. In this thesis, a novel approach to mitigate such static vulnerabilities is proposed by implementing a Moving Target Defense (MTD) strategy in a power grid SCADA environment, which leverages the existing communication network with an end-to-end IP Hopping technique among the trusted peer devices. This offers a proactive L3 layer network defense, minimizing IP-specific threats and thwarting worm propagation, APTs, etc., which utilize the cyber kill chain for attacking the system through the SCADA network. The main contribution of this thesis is to show how MTD concepts provide proactive defense against targeted cyber-attacks, and a dynamic attack surface to adversaries without compromising the availability of a SCADA system. Specifically, the thesis presents a brief overview of the different type of MTD designs, the proposed MTD architecture and its implementation with IP hopping technique over a Control Center–Substation network link along with a 3-way handshake protocol for synchronization on the Iowa State’s Power Cyber testbed. The thesis further investigates the delay and throughput characteristics of the entire system with and without the MTD to choose the best hopping rate for the given link. It also includes additional contributions for making the testbed scenarios more realistic to real world scenarios with multi-hop, multi-path WAN. Using that and studying a specific attack model, the thesis analyses the best ranges of IP address for different hopping rate and different number of interfaces. Finally, the thesis describes two case studies to explore and identify potential weaknesses of the proposed mechanism, and also experimentally validate the proposed mitigation alterations to resolve the discovered vulnerabilities. As part of future work, we plan to extend this work by optimizing the MTD algorithm to be more resilient by incorporating other techniques like network port mutation to further increase the attack complexity and cost

IPv6: a new security challenge

Tese de mestrado em Segurança Informática, apresentada à Universidade de Lisboa, através da Faculdade de Ciências, 2011O Protocolo de Internet versão 6 (IPv6) foi desenvolvido com o intuito de resolver alguns dos problemas não endereçados pelo seu antecessor, o Protocolo de Internet versão 4 (IPv4), nomeadamente questões relacionadas com segurança e com o espaço de endereçamento disponível. São muitos os que na última década têm desenvolvido estudos sobre os investimentos necessários à sua adoção e sobre qual o momento certo para que o mesmo seja adotado por todos os players no mercado. Recentemente, o problema da extinção de endereçamentos públicos a ser disponibilizado pelas diversas Region Internet registry – RIRs - despertou o conjunto de entidades envolvidas para que se agilizasse o processo de migração do IPv4 para o IPv6. Ao contrário do IPv4, esta nova versão considera a segurança como um objetivo fundamental na sua implementação, nesse sentido é recomendado o uso do protocolo IPsec ao nível da camada de rede. No entanto, e devido à imaturidade do protocolo e à complexidade que este período de transição comporta, existem inúmeras implicações de segurança que devem ser consideradas neste período de migração. O objetivo principal deste trabalho é definir um conjunto de boas práticas no âmbito da segurança na implementação do IPv6 que possa ser utilizado pelos administradores de redes de dados e pelas equipas de segurança dos diversos players no mercado. Nesta fase de transição, é de todo útil e conveniente contribuir de forma eficiente na interpretação dos pontos fortes deste novo protocolo assim como nas vulnerabilidades a ele associadas.IPv6 was developed to address the exhaustion of IPv4 addresses, but has not yet seen global deployment. Recent trends are now finally changing this picture and IPv6 is expected to take off soon. Contrary to the original, this new version of the Internet Protocol has security as a design goal, for example with its mandatory support for network layer security. However, due to the immaturity of the protocol and the complexity of the transition period, there are several security implications that have to be considered when deploying IPv6. In this project, our goal is to define a set of best practices for IPv6 Security that could be used by IT staff and network administrators within an Internet Service Provider. To this end, an assessment of some of the available security techniques for IPv6 will be made by means of a set of laboratory experiments using real equipment from an Internet Service Provider in Portugal. As the transition for IPv6 seems inevitable this work can help ISPs in understanding the threats that exist in IPv6 networks and some of the prophylactic measures available, by offering recommendations to protect internal as well as customers’ networks

Application Adaptive Bandwidth Management Using Real-Time Network Monitoring.

Application adaptive bandwidth management is a strategy for ensuring secure and reliable network operation in the presence of undesirable applications competing for a network’s crucial bandwidth, covert channels of communication via non-standard traffic on well-known ports, and coordinated Denial of Service attacks. The study undertaken here explored the classification, analysis and management of the network traffic on the basis of ports and protocols used, type of applications, traffic direction and flow rates on the East Tennessee State University’s campus-wide network. Bandwidth measurements over a nine-month period indicated bandwidth abuse of less than 0.0001% of total network bandwidth. The conclusion suggests the use of the defense-in-depth approach in conjunction with the KHYATI (Knowledge, Host hardening, Yauld monitoring, Analysis, Tools and Implementation) paradigm to ensure effective information assurance