System hardening guidelines for Amazon EC2

One of the biggest questions we get from Clients is “Is Amazon EC2 secure” . That is like saying is my Vanilla network secure. Like anything you can take some steps to make the environment as secure as you can, such as:

– First read the Amazon Security Whitepaper and the Amazon discussion of Security processes

– Ensure the system key is encrypted at start-up

– Ensure you plan for load balancing in case an instance goes down. Ensure you understand all the security implications of this and harden any other instances.

– Test or emulate the performance of applications deployed to the cloud in all geographies where you plan to deploy them. The latency could vary greatly for each.

– Never ever allow password base authentication for shell access.

– Encrypt all network traffic always.

– Always encrypt everything stored on S3

– Encrypt file systems for Block devices

– Open only the minimum required ports

– Include no authentication information in any AMI images

– Think about how your system can be hardened and what is out there such as SELinux, PAX,  ExecShield etc

– Don’t allows any decryption keys into the cloud – understand the perils of keys and security

– Install host based intrusion detection system such as OSSEC

– Regularly backup Amazon instances and store them securely. 

– Use Security Groups. With EC2 security groups, you can completely isolate every tier, even internally to the EC2 cloud.

– Design in a way you can issue security patches to AMI instances

The nightmare scenario that you cannot cater for is is that Xen has unforeseen security issues which would allow inter-VM communication and which in essence would enable instance spying. Amazons doomsday scenario…..

Be Sociable, Share!

5 thoughts on “System hardening guidelines for Amazon EC2

  1. Pingback: Cloud Computing Links April 24, 2009 at Cloud Curious

  2. I agree the filesystem should be encryption. However I would like to see some pointers to info on how to properly manage the key/password for an encrypted filesystem on EC2. If you’re not supposed to store your password in the image (I agree) then how do you make sure your filesystems are mounted properly at boot time?

  3. Pingback: Security and moving your private data into the public Cloud | jamieschuts

  4. Do you know of any kind of full root/system block-level volume encryption solution exists for Windows which would work well with EC2 EBS volumes?

    It would be nice to have an option to send a key file to each virtual guest during the Start command to cover any authentication. So far, solutions like TrueCrypt require entry of a passphrase during boot. Well, on EC2, you don’t get a console and would prefer to have an automated solution anyway when stopping and starting hundreds of instances.

Leave a Reply

Your email address will not be published. Required fields are marked *