Skip to content

RaaS Security Assessment

Potentially outdated

This page was last updated 44 months ago (on 2022-07-26). Verify the information is still accurate before relying on it.

Sypnopsis

The Rhapsody product has previously operating as an on-prem offering, as such, the emphasis on security tooling has been in most part been directed at the customer to define which tooling should be implementing to protect, monitor and log all activity tracked against it.

The current implementation of RaaS should use Best-of-breed security technology to aid in it’s ability in defending itself against varying forms of attack, this should also be accompanied by maintaining an audit trail of event logs.
By upgrading, replacing and filling the gaps in the securing of RaaS we can determine by which vector, tool and attack type potential perpetrators may use.

Security Tools

In this document I will be focusing on the following areas; SIEM, AV and Intrusion Detection. I will be establishing the current tooling that is available to the RaaS product and verifying its suitability to the product.

SIEM

RaaS does not currently log any informational or security type event to a SIEM, although it does track most service related logs into DataDog.
DataDog is currently set to ingest all log types, from informational to error based, directly from the Linux OS (CentOS). These types of events are mostly an insight into how a service is operating and whether there has been a service related issue, such as restart.

DataDog offers the ability to act as a SIEM and can ingest logs from both Cloud estate and from within the VM/Container running the RaaS workloads.

A link to this setup can be found here.
Now ultimately this would be the more natural fit for RaaS, as the team managing the service utilise DataDog for logging events and monitoring server/application resources, however Lyniate rely on support of IT to help in the management of software, tooling and in some cases authentication.

DataDog

  • Features

    • DataDog offers full service, application and server logging

    • By installing an agent onto the VM, metrics from datapoints are collected and managed within a centralised management dashboard.

    • DataDog offers SIEM functionality in the same portal

    • An additional configuration change should be applied to the VM configuration file.

    • As DataDog is currently only used for RaaS, we can be sure that all information sent to DD SIEM will be product related, rather than Lyniate staff and internal services.

  • Positives -

    • Easier to implement as it will require a slight configuration change and RaaS team will not need any up-skilling.

    • Log retention for Incident Management is up to 15 monthsl

  • Negatives -

    • We will essentially be managing two different logging locations for CaaS, Org and RaaS. From a security perspective this will become challenging to manage and ideally any Security Operations analyst or Security Engineer will want a single pain of glass to review all SIEM activity.

    • We are retaining service related logs for 30 days (should we be storing these in something like ELK)

Rapid7

  • Features

    • Rapid7 offers full SIEM capabilities.

    • As R7 SIEM is currently being used by CaaS team and Lyniate IT, we should be able to configure RaaS to send data into R7

    • R7 agent would need to be installed on VM or deployed into K8's cluster

    • Rapid7 offer the ability to collect logs and resource metrics from VM’s and containers.

    • This is currently not a service that Lyniate are opted into and would require additional configuration.

  • Positives -

    • Platform is already in-use for both CaaS and for the Org (Internal User base and internal systems)

    • R7 offers an agent that can be deployed onto Linux distributions

  • Negatives -

    • Deploying an additional agent onto the RaaS VM could potentially cause an unintentional increase in resource utilisation.

AV and Remediation

Discover y

Anti-Virus protection across all servers is required by ISO27001 standards, however most AV’s will be directly looking for Windows virus signatures and as such can fall short on Linux OS’s and the detection of potential rootkit virus signatures.

Sophos is currently used as the defacto AV tool within the organisation and has been deployed across the entire estate, from CaaS, Org and RaaS - however it seems as though alerting is either being missed or triggering and not remediating.

AV

The Sophos Server protection currently covering RaaS servers are being seen as protected, however in the dashboard there seems to be a notification suggesting that we are in-fact over our allocated number of licenses

In terms of coverage according to Sophos, the Server Workload Protection covers the following;

If Sophos detects potential Virus or Malware designed explicitly to attack Linux based distributions, then the emphasis is on the security team to manage the incident by determining the level of threat and its potential blast radius.

Using additional tooling such as CSPM (Orca) we can establish the integrity of the running OS. CSPM tools have the ability to verify the underlying OS, kernel and running applications to verify if there is any known CVE’s and can supply information to a vulnerability manager for OS patching.
CSPM can also determine if a server is potentially compromised , which can be used as a backup to the already running AV agent.

Remediation

Remediation can come in many forms, the best approach to take is to tackle the type of threat and from where it came.
By determining the above we can help reduce the vectors of attack and control security of infrastructure.

Using cloud native services such as AWS EventBridge, AWS Autoscaling and AWS Lambda the technology team and/or security team can triage compromised instances using event driven architecture by destroying the instance and redeploying a new one in its place.