SSH hardening for cloud virtual machines

What’s specific to Cloud Virtual Machines? SSH is required to access your virtual machines that run in your Cloud infrastructure, so you can not disable it. Due to new threats that arise with IaaS Cloud Computing (Cloud Security Alliance Top Threats), you must protect your infrastructure against Malicious insiders. Even if we refer to IaaS…

Elastic Vulnerability Assessment (EVA) Credentials for AWS EC2 and VPC

One of the major obstacles to Elastic Detector adoption is the step where infrastructure API credentials are asked. Security guys do not easily give their keys to strangers. We fully understand that, so we have proposed two solutions: Virtual appliance, such as an AMI on the AWS marketplace. We provide VMware (vmdk) and KVM versions…

vSphere 5 Hardening Guide

Vmware has just released a great guide: the official hardening guide for vSphere 5.  The terminology has changed and if you are used to the version 4.1, there is a nice companion document to help you compare. The security of the virtualization layer is fundamental for the security of the cloud infrastructures. This is acknowledged…

New CloudyScript: Security Audit via SSH

We are glad to announce a new CloudyScript Security Audit via SSH which makes a Security Audit of an Amazon EC2 AMI. It requires a privileged user that can perform sudo. Security Auditing is very important in cloud computing infrastructures where virtual machine images (AMI in the case of Amazon) could be shared among users.…