Mobile Virtual Network Operators (MVNO) Security 335
• VM isolation (security zone and
traffic separation)
• Secure boot –Trusted platform
module (TPM)
• Secure crash
• Secure browser
• Corruption and tampering (botnet, malware, ransomware…)
Data
Hypervisor, SDN and NFV
Application
• Software updates and security
patches
• Secure coding
• IDS
• Vulnerability and virus scanning
• Firewall
• Encryption
• Validation and error checking
mechanisms
Figure 14.6 Integrity requirements for cloudified network.
Sec
ure
crash
Se
cure
boot - Tru ste d P la tf o rm
M o d u le
( T P M )
VM
isolation
(sec uri ty zo ne
& tr a ff ic
s e p e
r a ti o n )
C
o
r
r
u
p
ti
o
n
&
ta
m
p
e
rin
g
AAA
Availability
Integrity
Data
Application
Hypervisor, SDN & NFV
Threats
Mitigation
D at a clean up befo re sw itc h in g te n a n t
Uniq ue pr iv a te
k e y s fo
r
e a c h V M
Pat ch in g a n d c lo s in g
te
s t
an d m on ito ri n g in te
r fa
c e s
S
to
r
e
d
p
a
s
s
w
o
rd
a
nd
k
e
y
s
in
V
M
im
a
g
e
B
a
c
k
d
o
o
r,
te
s
t
a
n
d
m
o
n
it
o
ri
n
g
in
te
rfa
ce
s
S e
r v ic e in je ct io n att ack
C o
o k ie
p o is o ni ng
Hype rvi so r m o n it o ri n g
VM iso lat io n
S
id
e
c
h
a
n
n
e
l
a
tt
a
c
ks
S
p y w a re
E nc ryp tion and hard en in g
R u le b as ed poli cy c o n tr
o l
S e cu re prot oc o ls
Fire wall
AAA
Ph ishin g
IP spoofin g
U se r to rem ot e
R em ote to lo ca l
P robing
A va ila bi lity of management sta tio ns
C on fig ura tion corruption
Im ag e los s
L o g ic a l n e tw
o r k v a li d a ti o n fo r
M a n a g e
m
e n t s ta ti o n
C o n fi g u ra
ti o n
te s t
Im pl em enti ng system rel at ed
ap pl ica tion s in PaaS
A tt a c k
o n
s y a te
m
re la te d ap pli cat ions
A
b
u
s
iv
e
us
e
Lo ad
b a la n c
in
g
a n d re so urc e isolation (C P U , N W
,
m
e m o re y)
U n e x pe cted sys te m fa
il u re
Da ta rem ov a l
DoS
IDS
Ba cku p
F irewall
L o ad balan ci n
g
R e du ndanc y
IDS
En crypti o n
Fi rewall
Er
ro
r
c h ec king me ch a n
is
m s
V u ln er abi lity & vi ru s s c
a n n in g
C
o rr u pt ion & tam pe ri in
g
S
e
cu
re
coding
S
o
ft
w
a r e u p d a te ds & secur ity pa tc h e s
Se cure browser
C o r
r u p a ti o n & ta m p er in g
M a n in the midd le a tt a c k
S o ftt w ar e updates an d se cu rt iy p a tc h e s
E n cr yp tin g cookie data
D is a b li n g n o t
u s e d te s t & d eb ug int erfa ces
Figure 14.7 Security requirements for cloudified network.
• VM isolation (security zone and
traffic separation)
• Secure boot –Trusted platform
module (TPM)
• Secure crash
• Secure browser
• Corruption and tampering (botnet, malware, ransomware…)
Data
Hypervisor, SDN and NFV
Application
• Software updates and security
patches
• Secure coding
• IDS
• Vulnerability and virus scanning
• Firewall
• Encryption
• Validation and error checking
mechanisms
Figure 14.6 Integrity requirements for cloudified network.
Sec
ure
crash
Se
cure
boot - Tru ste d P la tf o rm
M o d u le
( T P M )
VM
isolation
(sec uri ty zo ne
& tr a ff ic
s e p e
r a ti o n )
C
o
r
r
u
p
ti
o
n
&
ta
m
p
e
rin
g
AAA
Availability
Integrity
Data
Application
Hypervisor, SDN & NFV
Threats
Mitigation
D at a clean up befo re sw itc h in g te n a n t
Uniq ue pr iv a te
k e y s fo
r
e a c h V M
Pat ch in g a n d c lo s in g
te
s t
an d m on ito ri n g in te
r fa
c e s
S
to
r
e
d
p
a
s
s
w
o
rd
a
nd
k
e
y
s
in
V
M
im
a
g
e
B
a
c
k
d
o
o
r,
te
s
t
a
n
d
m
o
n
it
o
ri
n
g
in
te
rfa
ce
s
S e
r v ic e in je ct io n att ack
C o
o k ie
p o is o ni ng
Hype rvi so r m o n it o ri n g
VM iso lat io n
S
id
e
c
h
a
n
n
e
l
a
tt
a
c
ks
S
p y w a re
E nc ryp tion and hard en in g
R u le b as ed poli cy c o n tr
o l
S e cu re prot oc o ls
Fire wall
AAA
Ph ishin g
IP spoofin g
U se r to rem ot e
R em ote to lo ca l
P robing
A va ila bi lity of management sta tio ns
C on fig ura tion corruption
Im ag e los s
L o g ic a l n e tw
o r k v a li d a ti o n fo r
M a n a g e
m
e n t s ta ti o n
C o n fi g u ra
ti o n
te s t
Im pl em enti ng system rel at ed
ap pl ica tion s in PaaS
A tt a c k
o n
s y a te
m
re la te d ap pli cat ions
A
b
u
s
iv
e
us
e
Lo ad
b a la n c
in
g
a n d re so urc e isolation (C P U , N W
,
m
e m o re y)
U n e x pe cted sys te m fa
il u re
Da ta rem ov a l
DoS
IDS
Ba cku p
F irewall
L o ad balan ci n
g
R e du ndanc y
IDS
En crypti o n
Fi rewall
Er
ro
r
c h ec king me ch a n
is
m s
V u ln er abi lity & vi ru s s c
a n n in g
C
o rr u pt ion & tam pe ri in
g
S
e
cu
re
coding
S
o
ft
w
a r e u p d a te ds & secur ity pa tc h e s
Se cure browser
C o r
r u p a ti o n & ta m p er in g
M a n in the midd le a tt a c k
S o ftt w ar e updates an d se cu rt iy p a tc h e s
E n cr yp tin g cookie data
D is a b li n g n o t
u s e d te s t & d eb ug int erfa ces
Figure 14.7 Security requirements for cloudified network.