Data loss prevention and perimeter access patterns

Security enforcements

The following security enforcements are in place for application user access:

1. IBM Cloud Internet Services: Provides Layer 3 DDoS protection, DNSSec, IP firewall (ASN/Region/CIDR filtering), and load balancing.

2. VPC network ACLs: Allow IP addresses only from Cloud Internet Services (CIS).

3. Security groups: Allow connections only from Cloud Internet Services (CIS) to F5.

4. F5 BIG-IP: Provides Layer 7 WAF, DDoS protection, TLS termination, and access policies. Has a public floating IP associated with it (behind ACL and security group).

5. Geographic restrictions: IBM Cloud blocks traffic from embargo countries as documented in IBM Cloud Notices.

Threat mitigation

Compromise of F5 to initiate exfiltration

The only public port open on the external interface is 443 (enforced by security groups and ACLs). When security groups or ACLs are changed, events are logged to IBM Cloud Activity Tracker. For more information, see Activity Tracker events for VPC.

Exfiltration from F5

Public IP cannot be used to log in to F5. Operators must use VPN to access the F5 console. VPN connections are logged by Activity Tracker. If the operator has access only to F5, they cannot change ACLs or security groups. F5 audit logs can be sent to SIEM for monitoring.

Architectural decisions

• Use Cloud Internet Services (CIS) and F5 with appropriate ACLs and security groups
• Send audit logs from F5 to SIEM
• Send Activity Tracker events to SIEM

Security enforcements

The following security enforcements are in place for cloud administrator access:

1. VPC network ACLs: Allow IP addresses only from the ISV network.

2. Security groups: Allow connections only from the ISV network.

3. Client-to-site VPN: Has a public IP but is protected by ACLs and security groups. Requires IAM user credentials and/or certificate-based authentication.

4. IAM access control: Users need IAM access for VPN and bastion host (SSH) access.

5. Bastion host: Records all activities performed by privileged users.

6. Geographic restrictions: IBM Cloud blocks traffic from embargo countries.

Threat mitigation

Unauthorized access

Only IAM-authorized users can connect to the VPN. ACLs and security groups allow access only from the ISV's CIDR ranges.

Exfiltration attempts

VPN connections are logged by Activity Tracker. Bastion hosts log all activity and create recordings.

Architectural decisions

• Use appropriate ACLs and security groups to restrict access
• Send audit logs from bastion hosts to SIEM
• Send Activity Tracker events to SIEM

Security enforcements

The following security enforcements are in place for application administrator access:

1. Cloud Internet Services (CIS): Provides Layer 3 DDoS protection, DNSSec, IP firewall (ASN/Region/CIDR filtering), and load balancing.

2. VPC network ACLs: Allow IP addresses only from Cloud Internet Services (CIS).

3. Security groups: Allow connections only from Cloud Internet Services (CIS) to F5.

4. F5 public IP: network connections restricted by ACL and security groups

5. F5 capabilities: L7 WAF, DDoS, TLS termination, Access Policy

6. F5 access policies: Can determine if the accessed page is an admin page and apply appropriate policies.

7. Geographic restrictions: IBM Cloud blocks traffic from embargo countries.

Threat mitigation

Unauthorized access

Allow privileged users to access admin functions only through a bastion host when using VPN access.

Architectural decisions

• Forward application audit logs to SIEM
• If the application has a dedicated URL for admin access, consider routing admin traffic through VPN instead of F5
• If the application does not have a dedicated URL for admin access, use role-based access control (RBAC) at the application level

Security enforcements

The following security enforcements are in place for console access:

Account settings

Allow access only from ISV network IP addresses.

IAM access control

Provides specific access to appropriate access groups (operators). Individual access policies are not used.

Multi-factor authentication

2FA is enforced for all users.

Access groups

All permissions are managed through access groups, not individual policies.

Activity Tracker

Logs all changes to resources and provides audit logging for HTTPS access and API calls.

Separation of duties

Platform access and service access can be separated.

Geographic restrictions

IBM Cloud blocks traffic from embargo countries.

Threat mitigation

Rogue user from ISV

Must originate from ISV IP range, have IAM credentials, pass 2FA, have IAM platform permissions, and have IAM service permissions. All actions generate Activity Tracker events for SIEM alerting.

Remote or distributed employees

Must use full tunnel VPN into ISV enterprise network to access the cloud console. Non-ISV IP range access is denied. Administrators can also access through client-to-site VPN to bastion host, then to cloud console.

Architectural decisions

• Maintain an allow list of IP addresses from which the console can be accessed
• Configure services with the same IP restrictions using Context-based restrictions (CBR)
• Administrators can access from:
  • ISV internal network
  • Client-to-site VPN connection, then to IBM Cloud console
• Add customer IP addresses to allow list for customer users to view tickets on the console

Security enforcements

The following security enforcements are in place for Transit Gateway connectivity within the same account:

1. Prefix filtering: Use Transit Gateway prefix filtering to limit which address prefixes are shared between VPCs.

2. Activity Tracker: Logs all changes to resources and provides audit logging.

3. Network segmentation: Isolate sensitive data and limit the impact of potential breaches.

4. Access controls: Use security groups, network ACLs, and IAM policies to restrict access to sensitive data.

5. Encryption: Ensure data in transit is encrypted.

6. Local Transit Gateway: Use local Transit Gateway for regional deployments.

7. Flow logs analysis: Analyze flow logs using SIEM to ensure source and destination IP addresses are from known CIDR ranges.

Threat mitigation

Inadvertent data sharing

Sensitive data might be inadvertently shared across VPCs due to misconfigured Transit Gateway connections. Use prefix filtering and network segmentation to prevent this.

Unauthorized data access

Unauthorized applications or services might leverage Transit Gateway to access and exfiltrate data. Use security groups, ACLs, and flow log analysis to detect and prevent unauthorized access.

Security enforcements

The following security enforcements are in place for cross-account Transit Gateway connectivity:

1. Connection approval: Cross-account Transit Gateway connections must be requested and accepted by both accounts.

2. Prefix filtering: Use Transit Gateway prefix filtering to limit which address prefixes are shared between accounts.

3. Activity Tracker: Logs all changes to resources and provides audit logging. For more information, see Activity Tracker events for Transit Gateway.

4. Network segmentation: Isolate sensitive data and limit the impact of potential breaches.

5. Access controls: Use security groups, network ACLs, and IAM policies to restrict access to sensitive data.

6. Encryption: Ensure data in transit is encrypted.

7. Local Transit Gateway: Use local Transit Gateway for tregional deployments.

8. Flow logs analysis: Analyze flow logs using SIEM to ensure source and destination IP addresses are from known CIDR ranges.

Architectural decisions

• Use of cross-account connectivity using Transit Gateway is discouraged and requires addictional justifications
• Enabling cross-account Transit Gateway connectivity can be tracked by Activity Tracker

Threat mitigation

Inadvertent data sharing

Sensitive data might be inadvertently shared across VPCs in different accounts due to misconfigured Transit Gateway connections. Use prefix filtering, connection approval process, and network segmentation to prevent this.

Unauthorized data access

Unauthorized applications or services might leverage Transit Gateway to access and exfiltrate data. Use security groups, ACLs, and flow log analysis to detect and prevent unauthorized access.

Security enforcements

The following security enforcements are in place for Public Gateway access:

1. Access controls: Use security groups, network ACLs, and IAM policies to restrict access.

2. Activity Tracker: Logs all changes to resources and provides audit logging.

3. Encryption in transit: Only allow outbound connections with encryption in transit when outbound connections are needed.

4. Alternative approaches: For sites that do not publish CIDR ranges, assets should be made available using an alternative approach.

5. Security and Compliance Center: Checks for rules that do not allow access to 0.0.0.0/0 with any port, ensuring specific IP addresses or CIDR ranges are used.

6. Geographic restrictions: IBM Cloud blocks traffic from embargo countries.

Threat mitigation

Insider data exfiltration

Insiders with access to instances connected to the internet can intentionally or unintentionally transfer sensitive data outside the organization. Use security groups, ACLs, and monitoring to detect and prevent unauthorized data transfers.

Unauthorized data transfer

Unauthorized applications or services might leverage the Public Gateway to send data to external destinations without proper oversight. Use flow log analysis and SIEM monitoring to detect unauthorized transfers.

Architectural decisions

• Consider using an egress proxy to filter based on URL and domain
• Minimize the number of subnets with access to Public Gateway to mitigate risk

Security enforcements

The following security enforcements are in place for client-to-site VPN access:

1. Network ACLs: Limit client connections to ISV on-premises networks and Cloud Internet Services (CIS).

2. Cloud Internet Services (CIS) routing: For remote locations, route the client-to-site VPN through Cloud Internet Services (CIS) and use IP firewall to filter by IP, ASN, or region.

3. Access controls: Ensure correct ACLs and security groups are applied to allow access to resources for VPN users.

4. Geographic restrictions: IBM Cloud blocks traffic from embargo countries.

Threat mitigation

Insider data misuse

Employees with legitimate VPN access might misuse their access to transfer sensitive data outside the organization. Use monitoring, logging, and access controls to detect and prevent misuse.

Remote work risks

Remote work environments might lack adequate supervision, increasing the risk of data misuse. Implement endpoint security controls and monitoring.

Architectural decisions

• All internet-exposed interfaces must be restricted to Cloud Internet Services (CIS), with exceptions for site-to-site VPN
• Consider an assessment check for laptop encryption to secure critical data like VPN certificates

Security enforcements

The following security enforcements are in place for site-to-site VPN access:

1. Peer IP restrictions: Site-to-site connections are limited based on peer IP addresses.

2. Activity Tracker: Changes to the connection resource can be tracked by Activity Tracker.

3. Network routing: Remote users connect to on-premises ISV VPN and then can connect to cloud VPC resources with appropriate routing.

Threat mitigation

Insider data misuse

Employees with legitimate VPN access might misuse their access to transfer sensitive data outside the organization. Use monitoring, logging, and access controls to detect and prevent misuse.

Remote work risks

Remote work environments might lack adequate supervision, increasing the risk of data misuse. Implement endpoint security controls and monitoring.

Architectural decisions

• During Financial Services assessment, ISV must demonstrate how they handle security restrictions to minimize access to IBM Cloud account
• Define controls for using VPN for machine-to-machine flows

Security enforcements

The following security enforcements are in place for customer site-to-site VPN access:

1. Peer IP restrictions: Site-to-site connections are limited based on peer IP addresses.

2. Activity Tracker: Changes to the connection resource can be tracked by Activity Tracker.

3. Network routing: Remote users connect to on-premises customer VPN and then can connect to cloud VPC resources with appropriate routing.

Threat mitigation

Insider data misuse

Employees with legitimate VPN access might misuse their access to transfer sensitive data outside the organization. Use monitoring, logging, and access controls to detect and prevent misuse.

Remote work risks

Remote work environments might lack adequate supervision, increasing the risk of data misuse. Implement endpoint security controls and monitoring.

Security enforcements

The following security enforcements are in place for Direct Link connectivity:

1. Peer IP restrictions: Direct Link connections are limited based on peer IP addresses configured at the point of presence (PoP).

2. Activity Tracker: Changes to the connection resource can be tracked by Activity Tracker.

3. Network routing: Remote users connect to on-premises ISV VPN and then can connect to cloud VPC resources with appropriate routing.

Threat mitigation

Insider data misuse

Employees with legitimate Direct Link access might misuse their access to transfer sensitive data outside the organization. Use monitoring, logging, and access controls to detect and prevent misuse.

Remote work risks

Remote work environments might lack adequate supervision, increasing the risk of data misuse. Implement endpoint security controls and monitoring.

Architectural decisions

• Similar to site-to-site VPN, define how the access through Direct Link is restricted
• Establish audit procedures to verify access controls

High availability considerations

The following high availability patterns are recommended for ISV deployments:

Workload VPC

Deploy across 2 or 3 availability zones depending on required SLA.

Management VPC

Deploy across 2 availability zones.

Edge VPC

Deploy across 2 availability zones. Public application load balancers are deployed in active-active mode. Optionally, use separate Edge VPCs for critical and non-critical workloads. The Edge VPC hosts application load balancers, bastion hosts, and VPN gateways.

Cloud Internet Services (CIS)

Deploy WAF and global load balancer with Cloud Internet Services (CIS).

Cloud service access

All IBM Cloud services are accessed from VPCs using Virtual Private Endpoints (VPEs). VPEs are deployed for each VPC to ensure private connectivity to cloud services.