Paper Info
Title
Understanding Security Group Usage In A Public Iaas Cloud
Abstract
To ensure security, cloud service providers employ security groups as a key tool for cloud tenants to protect their virtual machines (VMs) from attacks. However, security groups can be complex and often hard to configure, which may result in security vulnerabilities that impact the entire cloud platform. The goal of this paper is to investigate and understand how cloud tenants configure security groups and to assist them in designing better security groups. We first conduct a measurement-based analysis of security group configuration and usage by tenants in an IaaS cloud. We then propose and develop a tool called Socrates, which enables tenants to visualize and hence understand the static and dynamic access relations among VMs. Socrates also helps diagnose potential misconfigurations and provides suggestions to refine security group configurations based on observed traffic traversing tenants' VMs. Applying Socrates to all tenants hosted on the IaaS cloud, we analyze the common usage ("good" as well as "bad" practices) of cloud security groups and report the key lessons learned in our study. To the best of our knowledge, our work is the first to analyze cloud security group usage based on real-world datasets, and to develop a system to help cloud tenants understand, diagnose and better refine their security group configurations.
Year
Venue
Field
2016
IEEE INFOCOM 2016 - THE 35TH ANNUAL IEEE INTERNATIONAL CONFERENCE ON COMPUTER COMMUNICATIONS
World Wide Web,Virtual machine,Computer security,Computer science,Security service,Cloud computing security,Cloud service provider,Cloud testing,Computer security model,Cloud computing,Vulnerability
DocType
ISSN
Citations 
Conference
0743-166X
2
PageRank 
References 
Authors
0.36
6
3
Name
Order
Citations
PageRank
Cheng Jin171.24
Abhinav Srivastava239324.48
Zhi-Li Zhang34063317.10