2SU 3: Sécurité des infrastructures de virtualisation et Cloud ComputingVirtualisation et Cloud Computing (STI)

FISEFISA STI Semester 9 Common Core Machine translation

2SU 3 : Security of Virtualization and Cloud Computing Infrastructures

Teaching unit Security and Distributed Systems · AS09_SSR1 | EC Code AS09_SSR1-2

4ECTS (EU)

1Coefficient

21:20Hours

Séquencement

Learning objectives

The aim of this module is to deepen understanding of the functioning of virtualization infrastructure and the technologies on which it is based in order to evaluate, design or ensure safety.

Prerequisites

Module	Teaching unit	Semester
C Programming	Programming Principles	S5
Networks	Introduction to Systems and Networks	S5
System Programming	System Introduction	S5
Computer Security	Network and System Administration	S6
System Security	Computer Security	S7
Network Security	Computer Security	S7
Linux System Administration	Network and System Administration	S6
Principles of Virtualization and Cloud Computing	Virtualization and Cloud Computing	S9
Containers and Cloud Computing	Virtualization and Cloud Computing	S9

Program

General introduction on cloud infrastructure and introduction of the module framework
Containers under Linux
Availability: UNIX concepts and cgroups
Insulation with namespaces
Linux Capabilities
seccomp-bpf
TD 1:
Containers with Docker
Using the kernel interface to create C-namespaces
systemd
Background
Operation and general use
Security features
Threat model, attack surface, potential and known vulnerability
TD 2:
Systemd & logd operation
Hardening of a unit systemd
Managing with cgroups
SELinux
Basic Security Concepts
Confidentiality / Integrity / Diposability
Extensions: Authenticity / Auditability / No repudiation
Principle of every privilege
Access control models
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Basic concepts for SELinux
Concepts needed to write a SELinux policy
TD 3:
Operation of SELinux
Context and Boolean Management
Writing a Policy Module
User confidence
Security of container managers (Podman, Docker, etc.)
Operation of a container manager
Threat model, attack surface, potential and known vulnerability
Hardening of container managers
Safety and hardening of KVM
Operation of virtualization with KVM
Operation of virtual machine managers
Threat model, attack surface, potential and known vulnerability
Hardening of virtual machine managers and virtualization with KVM
TD 4:
Containment of containers with SELinux
Creation and hardening of a container image
Publication of a container image on a public register
Infrastructure security
OpenStack General Operation and Security
Operation and security of Kubernetes
Cloud provider security
Security-sensitive deployment models
Infrastructure as Code
Immutable Infrastructure
TD 5:
Introduction to Terraform (Infrastructre as Code)
Introduction to Fedora CoreOS (Immutable Infrastructure)
Kubernetes and OpenShift Security

Assessment

Final examination in the form of a QCM, carried out in progress, at the end of the intervention.

Project to be completed within 2-3 weeks, requiring the application of skills acquired during TDs:

Creation of a unit systemd taking into account security constraints
Creating a SELinux policy module for a demon-like application
Creation (Dockerfile) and execution of a container taking into account security constraints

References

General:

OpenStack:

Kubernetes:

Skills

Ref.	Verb	Description	Level
C2_3	implement	Implementation of the security features proposed by container managers	3
C2_3	implement	Implementation of systemd security features	3
C2_6	implement	Implementation of the security features proposed by SELinux	3

SecNumEdu Skills

Skill	Lecture hours	Practical hours	Entry level	Exit level
Security of electronics and hardware architectures	1	0	0	1
Study of hardware and software architecture for the implementation of virtualized systems and security implications.
Operating system security	9	10	2	3
Security of containers, virtualization, container orchestrators, containment with SELinux, systemd. Linux only.