We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byAnnabella Ferguson
Modified about 1 year ago
Cloud Security Challenges Today and Tomorrow NameTitle February 2011
Copyright © 2011 Cloud Security Alliance Cloud: Dawn of a New Age Cloud – overhyped in the short run, underestimated in the long term Compute becoming a utility Changes everything: business models, venture capital, R&D, ……
Copyright © 2011 Cloud Security Alliance What is Cloud Computing? Compute as a utility: third major era of computing Cloud enabled by Moore’s Law Hyperconnectivity SOA Provider scale Key characteristics Elastic & on-demand Multi-tenancy Metered service
Copyright © 2011 Cloud Security Alliance : the Hybrid Enterprise enterprise boundary public clouds Extended Virtual Data Center private clouds cloud of users Notional organizational boundary Dispersal of applications Dispersal of data Dispersal of users Dispersal of endpoint devices
Copyright © 2011 Cloud Security Alliance Cloud Forcing Key Issues Critical mass of separation between data owners and data processors Anonymity of geography of data centers & devices Anonymity of provider Transient provider relationships Physical controls must be replaced by virtual controls Identity management has a key role to play Cloud WILL drive change in the security status quo Reset button for security ecosystem
Copyright © 2011 Cloud Security Alliance Key Cloud Security Problems of Today From CSA Top Threats Research: Trust: Lack of Provider transparency, impacts Governance, Risk Management, Compliance Data: Leakage, Loss or Storage in unfriendly geography Insecure Cloud software Malicious use of Cloud services Account/Service Hijacking Malicious Insiders Cloud-specific attacks
Copyright © 2011 Cloud Security Alliance Key Problems of Tomorrow Globally incompatible legislation and policy Non-standard Private & Public clouds Lack of continuous Risk Mgt & Compliance monitoring Incomplete Identity Mgt implementations Haphazard response to security incidents
Copyright © 2011 Cloud Security Alliance About the Cloud Security Alliance Global, not-for-profit organization Over 17,000 individual members, 90 corporate members Building best practices and a trusted cloud ecosystem Agile philosophy, rapid development of applied research GRC: Balance compliance with risk management Reference models: build using existing standards Identity: a key foundation of a functioning cloud economy Champion interoperability Advocacy of prudent public policy “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.”
Copyright © 2011 Cloud Security Alliance Helpful research from CSA
Copyright © 2011 Cloud Security Alliance CSA Guidance Research Guidance > 100k downloads: cloudsecurityalliance.org/guidancecloudsecurityalliance.org/guidance Governance and Enterprise Risk Management Legal and Electronic Discovery Compliance and Audit Information Lifecycle Management Portability and Interoperability Security, Bus. Cont,, and Disaster Recovery Data Center Operations Incident Response, Notification, Remediation Application Security Encryption and Key Management Identity and Access Management Virtualization Cloud Architecture Operating in the Cloud Governing the Cloud Popular best practices for securing cloud computing Popular best practices for securing cloud computing V2.1 released 12/2009 V2.1 released 12/2009 V3 target Q V3 target Q wiki.cloudsecurityalliance.org/guidance wiki.cloudsecurityalliance.org/guidance
Copyright © 2011 Cloud Security Alliance Sample Guidance - Governance Best opportunity to secure cloud engagement is before procurement – contracts, SLAs, architecture Know provider’s third parties, BCM/DR, financial viability, employee vetting Identify data location when possible Plan for provider termination & return of assets Preserve right to audit where possible Reinvest provider cost savings into due diligence
Copyright © 2011 Cloud Security Alliance Sample Guidance - Operating Encrypt data when possible, segregate key mgt from cloud provider Adapt secure software development lifecycle Understand provider’s patching, provisioning, protection Logging, data exfiltration, granular customer segregation Hardened VM images Assess provider IdM integration, e.g. SAML, OpenID
Copyright © 2011 Cloud Security Alliance Cloud Controls Matrix Tool Controls derived from guidance Rated as applicable to S-P-I Customer vs Provider role Mapped to ISO 27001, COBIT, PCI, HIPAA Help bridge the “cloud gap” for IT & IT auditors
Copyright © 2011 Cloud Security Alliance Consensus Assessment Initiative Research tools and processes to perform shared assessments of cloud providers Lightweight “common criteria” concept Integrated with Controls Matrix Ver 1 CAI Questionnaire released Oct 2010, approx 140 provider questions to identify presence of security controls or practices – use to assess cloud providers today
Copyright © 2011 Cloud Security Alliance CloudAudit Open standard and API to automate provider audit assertions Change audit from data gathering to data analysis Necessary to provide audit & assurance at the scale demanded by cloud providers Uses Cloud Controls Matrix as controls namespace Use to instrument cloud for continuous controls monitoring
Copyright © 2011 Cloud Security Alliance CSA GRC Stack Suite of tools, best practices and enabling technology Consolidate industry research & simplify GRC in the cloud For cloud providers, enterprises, solution providers and audit/compliance Controls Framework, Questionnaire and Continuous Controls Monitoring Automation Control Requirements Provider Assertions Private & Public Clouds
Copyright © 2011 Cloud Security Alliance CCSK – Certificate of Cloud Security Knowledge Only user certification for cloud security Web-based test for competency in CSA guidance $295 USD price Training courses under development
Copyright © 2011 Cloud Security Alliance Trusted Cloud Initiative Comprehensive Cloud Security Reference Architecture Secure & interoperable Identity in the cloud Getting SaaS, PaaS to be “Relying Parties” for corporate directories Scalable federation Outline responsibilities for Identity Providers Assemble reference architectures with existing standards Identity Mgt best practices whitepaper:
Copyright © 2011 Cloud Security Alliance The need for the Security as a Service Initiative Information assurance challenged by disruptive trends (cloud, mobility, social networking, etc) Cloud provides opportunity to rethink security (economics, architecture, service delivery models, etc) Fulfill 2 nd half of mission statement: “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.”
Copyright © 2011 Cloud Security Alliance Security as a Service Scope Information Security Industry Re-invented Define Security as a Service Articulate solution categories within Security as a Service Guidance for adoption of Security as a Service Align with other CSA research Develop deliverables as a proposed 14 th domain within CSA Guidance version 3.
Copyright © 2011 Cloud Security Alliance CloudSIRT Consensus research for emergency response in Cloud Enhance community’s ability to respond to incidents Standardized processes Supplemental best practices for SIRTs Hosted Community of Cloud SIRTs
Copyright © 2011 Cloud Security Alliance Contact Help us secure cloud computing LinkedIn:
Copyright © 2011 Cloud Security Alliance Achieving Security Assurance and Compliance in the Cloud Jim Reavis, Executive Director.
Copyright © 2011 Cloud Security Alliance DANIELE CATTEDDU CSA Managing Director EMEA.
Insert presenter logo here on slide master 1 WHAT IS CLOUD COMPUTING REALLY? Scott Clark Chicago Chapter President Cloud Security Alliance.
Cloud Security: Infrastructure, Data Security, and Access Control Adapted from slides by Keke Chen.
V © 2009 IBM Corporation Systems & Technology Group Cloud computing for System z.
Invitation to Join Open Health Tools Draft by Skip McGaughey
Clouds: What’s new is old is new… Joseph Alhadeff, VP Global Public Policy; CPO, Oracle.
Cloud Security Assessment. 2 CoE IT Leadership.- Progress report Introduction »Cloud computing is an approach in which infrastructure and software resources.
© John Beveridge CobiT Update NSAA IT Conference Richmond, VA John W. Beveridge September 27, 2007.
Notes accompany this presentation. Please select Notes Page view. These materials can be reproduced only with written approval from Gartner. Such approvals.
Information Technology Management (ITM101) Week 02: IT Standards & Governance Matthew W. Stephan: CISM, CISSP, CGEIT, CRISC, PMP.
Start With A Great Information Security Plan! Tammy L. Clark, CISO, Georgia State University William Monahan, Lead Information Security Administrator,
Impacts of 3 rd Party IaaS on broadband network operations and businesses Prabhat Kumar Managing Partner, i 3 m 3 Solutions.
© 2004 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice The Business Case for Configuration.
How to Create an IT Security Program Tracy Mitrano Steve Schuster R. David Vernon Copyright Tracy Mitrano, Steven Schuster and David Vernon, This.
page 1 Architecture Transition Framework (ATF 1.0) A presentation at SOA for E-Gov Conference, October 30 – 31, 2006 Satish Gattadahalli, Senior.
1 Copyright © 2011, Oracle and/or its affiliates. All rights reserved. A Scalable Secure Development Program Rajiv Sharma, CSSLP Sr. Principal Program.
Copyright Roger Clarke, Xamax Consultancy, Canberra Visiting Professor in Computer Science, ANU and in Cyberspace Law & Policy, UNSW 2nd International.
Cloud Standards Overview Cloud-Standards.org. Outline Open Standards and Standards Groups Cloud Standards Roadmap Process – Use Cases – Specifications.
Lost in Cyberspace? Best Practices for Maintaining Security on the Internet and in the Cloud.
Copyright Roger Clarke, Xamax Consultancy, Canberra Visiting Professor in Computer Science, ANU and in Cyberspace Law & Policy, UNSW Computer Science.
Managing IT Budgets in Uncertain Economic Times: IT Optimization.
Presentation Title | Date | Page 1 The Road to SOA.
Dr. Chen, Electronic Commerce Pearson/Prentice Hall & Dr. Chen, Electronic Commerce Chapter 14 E-Commerce Strategy and Global EC.
Effectively and Securely Using the Cloud Computing Paradigm.
IPMA Executive Summary - October 31, 2002 IPMA Executive Summit The Enterprise Architecture of the HR/Payroll Systems October 31, 2002 FINAL NOTES AND.
Presented to OUHSC Policies and Procedures Workshop IT Information Security Services.
© 2016 SlidePlayer.com Inc. All rights reserved.