Presentation is loading. Please wait.

Presentation is loading. Please wait.

Www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Cloud Security Alliance Research & Roadmap Cloud Security Alliance Research & Roadmap.

Similar presentations


Presentation on theme: "Www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Cloud Security Alliance Research & Roadmap Cloud Security Alliance Research & Roadmap."— Presentation transcript:

1 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Cloud Security Alliance Research & Roadmap Cloud Security Alliance Research & Roadmap June 2012 Presenter Name

2 www.cloudsecurityalliance.org Copyright © 2012 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2012 Cloud Security Alliance Global, not-for-profit organization Over 35,678 individual members, 123 corporate members, 20 affiliate members, 64 chapters worldwide Building best practices and a trusted cloud ecosystem Agile philosophy, rapid development of applied research GRC: Balance compliance with risk management Reference models: build using existing standards Identity: a key foundation of a functioning cloud economy Champion interoperability Enable innovation Advocacy of prudent public policy “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.”

3 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Developed first comprehensive best practices for secure cloud computing, Security Guidance for Critical Areas of Focus for Cloud Computing (updated October 2011) First and only user certification for cloud security, the CCSK (Certificate of Cloud Security Knowledge, September 2010) Tools for managing Governance, Risk and Compliance in the Cloud Registry of cloud provider security practices, the CSA STAR (Security, Trust & Assurance Registry, Q4 2011) Industry leading security practices, education and tools developed by 30+ working groups Selection of CSA venue by US White House to announce the US Federal Cloud Strategy in 2011 Leadership in developing new security standards addressing cloud computing Trusted advisor to governments and Global 2000 firms around the world “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.”

4 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance http://cloudsecurityalliance.org/research/

5 www.cloudsecurityalliance.org Copyright © 2012 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2012 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Global resource and research coverage through our corporate membership, affiliate members, chapters and Connected to great minds: Research contributors represent some of the top minds in information security and cloud computing Copyright © 2012 Cloud Security Alliance

6 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Popular best practices for securing cloud computing Flagship research project V 3.0 Released (November 2011) In alignment with international standards > 100k downloads: > 100k downloads: cloudsecurityalliance.org/guidance cloudsecurityalliance.org/guidance

7 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Family of 4 research projects Cloud Controls Matrix Consensus Assessments Initiative Cloud Audit Cloud Trust Protocol Tools for governance, risk and compliance management Control Requirements Provider Assertions Private, Community & Public Clouds

8 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Controls derived from guidance Mapped to familiar frameworks: ISO 27001, COBIT, PCI, HIPAA, FISMA, FedRAMP, etc. Rated as applicable to S-P-I Customer vs. Provider role Help bridge the “cloud gap” for IT & IT auditors

9 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Research tools and processes to perform shared assessments of cloud providers Integrated with Controls Matrix Version 1 CAI Questionnaire released Oct 2010, approximately 140 provider questions to identify presence of security controls or practices Use to assess cloud providers today, procurement negotiation, contract inclusion, quantify SLAs

10 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Open standard and API to automate provider audit assertions Change audit from data gathering to data analysis Necessary to provide audit & assurance at the scale demanded by cloud providers Uses Cloud Controls Matrix as controls namespace Use to instrument cloud for continuous controls monitoring

11 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Developed by CSC, transferred to CSA Open standard and API to verify control assertions “Question and Answer” asynchronous protocol, leverages SCAP (Secure Content Automation Protocol) Integrates with Cloud Audit Now we have all the components for continuous controls monitoring

12 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance CSA STAR (Security, Trust and Assurance Registry) Public Registry of Cloud Provider self assessments Based on Consensus Assessments Initiative Questionnaire Provider may substitute documented Cloud Controls Matrix compliance Voluntary industry action promoting transparency Free market competition to provide quality assessments Provider may elect to provide assessments from third parties Available October 2011

13 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance To Promote Education, Research and Certification of Secure and Interoperable Identity Comprehensive Cloud Security Reference Architecture Assemble reference architectures with existing standards www.cloudsecurityalliance.org/trustedcloud.html

14 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance TCI Reference Architecture

15 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Information Security Industry Re-invented Define Security as a Service (SecaaS) Identify Ten Categories within SecaaS Develop Domain 14 within CSA Guidance V3 Implementation Guidance for each SecaaS Category Align with international standards and other CSA research www.cloudsecurityalliance.org/secaas.html

16 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance To identify the current state of public cloud provider maturity identified in CSA Guidance research Cloud Data Governance Maturity Survey of current Cloud Provider practices in the market (e.g. backup, encryption, secure deletion, etc.) Structure based on Domain 5: Information Lifecycle Management Re-define Data Life Cycle Model Identify Key Concerns for Stakeholders Data Governance in Emerging Technologies in the Cloud

17 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Consensus research for emergency response in Cloud Enhance community’s ability to respond to incidents Standardized processes Supplemental best practices for CERTs Hosted Community of Cloud CERTs Being spun out into a separate, related entity www.cloudsecurityalliance.org/cloudsirt.html

18 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Industry a key stakeholder in future of cloud CSA’s liaison to ITU-T 5 Telecom Initiatives Telecom and the GRC Stack ISO 27017 Interviews to CSP’s SIEM Compliance Monitoring Cloud Forensics and Legal https://cloudsecurityalliance.org/research/telecom/

19 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Provide needed context to assist organizations in making educated risk management decisions regarding their cloud adoption strategies V.2 of Top Threats Report released in July 2012 “Top Threats” document will be updated regularly to reflect expert consensus on the probable threats which customers should be concerned about. https://cloudsecurityalliance.org/research/to p-threats

20 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Securing application stores and other public entities deploying software to mobile devices Analysis of mobile security capabilities and features of key mobile operating systems Cloud-based management, provisioning, policy, and data management of mobile devices to achieve security objectives Guidelines for the mobile device security framework and mobile cloud architectures Solutions for resolving multiple usage roles related to BYOD, e.g. personal and business use of a common device

21 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Scalable authentication from mobile devices to multiple, heterogeneous cloud providers Best practices for secure mobile application development Identification of primary risks related to individually owned devices accessing organizational systems (commonly known as BYOD – Bring Your Own Device) https://cloudsecurityalliance.org/research/mobile

22 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Identifying scalable techniques for data-centric security and privacy problems Lead to crystallization of best practices for security and privacy in big data Help industry and government on adoption of best practices Establish liaisons with other organizations in order to coordinate the development of big data security and privacy standards Accelerate the adoption of novel research aimed to address security and privacy issues https://cloudsecurityalliance.org/research/big-data

23 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Provide direct influence on how health information service providers deliver secure cloud solutions (services, transport, applications and storage) to their clients, and foster cloud awareness within all aspects of healthcare and related industries 2 Health Initiatives HIPAA and HiTech Best Practices Healthcare Recommendations Guidance to V.3 https://cloudsecurityalliance.org/research/him/

24 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance The Cloud Security Alliance (CSA) and ISACA announced the availability of a new survey on cloud market maturity, part of the first collaborative project between the two organizations The survey will be open to the public through June 1, and can be found here: https://www.surveymonkey.com/s/Clou dMarketSurvey https://www.surveymonkey.com/s/Clou dMarketSurvey

25 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance The CSA Projects will begin migrating to the "new" Basecamp found at the following URL: https://launchpad.37signals.com/ This site will give you access to all of your CSA projects on the new Basecamp and the pre-existing projects found in the renamed "Basecamp Classic". The 37Signals Launchpad will help you navigate to both Basecamp sites if you are participating in multiple CSA Working Groups. https://launchpad.37signals.com/

26 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Learn how you can participate in Cloud Security Alliance's goals to promote the use of best practices for providing security assurance within Cloud Computing http://www.linkedin.com/groups?gid=1864210 https://cloudsecurityalliance.org/get-involved/

27 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Do you have an idea for a research project on a cloud security topic? If so, please take the time to describe your concept. Ideas are monitored by the CSA research team, who will review your proposal and respond to you with feedback. https://cloudsecurityalliance.org/research/https://cloudsecurityalliance.org/research/, the Submit Ideas tab Submit Your Research Ideas

28 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance The Cloud Security Alliance is a community non-profit which is driven by its members. Have a white paper or information on a cloud security product you want to contribute? https://cloudsecurityalliance.org/education/white-papers-and- educational-material/ Contribute to the CSA library

29 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance http://cloudsecurityalliance.org/chapters/

30 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance 50 chapters and growing Every continent except Antarctica Translating guidance Adapting research to local needs Creating their own research projects

31 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance http://cloudsecurityalliance.org/education/

32 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Benchmark of cloud security competency Measures mastery of CSA guidance and ENISA cloud risks whitepaper Understand cloud issues Look for the CCSKs at cloud providers, consulting partners Online web-based examination www.cloudsecurityalliance.org/certifyme

33 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance CCSK Basic One day course to enable student to pass CCSK CCSK Plus Two day course includes practical cloud lab work GRC Stack Training One day course to use GRC Stack components PCI/DSS In the Cloud Achieving PCI compliance in cloud computing http://cloudsecurityalliance.org/education/training/

34 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance http://cloudsecurityalliance.org/events/

35 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Re-visit the SecureCloud 2012 Presentations from select speakers will be available soon at: https://cloudsecurityalliance.org/events/securecloud-2012/

36 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Re-visit the inaugural CSA “Building Trust in Cloud Computing” Summit 2012 hosted by the CSA Hong Kong & Macau Chapter held on May 17, 2012 at Hong Kong’s Cyberport. http://www.isoc.hk/2012/04/building-trust-in-cloud-computing-summit-2012.html

37 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance September 25-26, 2012 Amsterdam, Netherlands For more information visit: http://www.cloudsecuritycongres s.com/

38 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance CSA Congress USA Workshops November 7,8, 9 Venue: Hilton Disney World Resort To register and for more information visit: https://misti.com/cloudhttps://misti.com/cloud

39 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Help Us Secure Cloud Computing www.cloudsecurityalliance.org info@cloudsecurityalliance.org LinkedIn: www.linkedin.com/groups?gid=1864210www.linkedin.com/groups?gid=1864210 Twitter: @cloudsa

40 www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance


Download ppt "Www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Cloud Security Alliance Research & Roadmap Cloud Security Alliance Research & Roadmap."

Similar presentations


Ads by Google