1. © Cloud Security Alliance, 2015 March 2, 2016

2. Agenda © Cloud Security Alliance, 2015 The SecaaS Working Group Recent Activity Charter Category outline/templates Looking Ahead

3. What is Security as a Service? © Cloud Security Alliance, 2014. Much focus has been on securing data and systems in the cloud. What about providing security services FROM the cloud? That is Security as a Service (SecaaS)! Provisioning elastic, scalable security solutions and services to both cloud based and traditional on premises systems in pure cloud or hybrid models.

4. The CSA SecaaS Working Group © Cloud Security Alliance, 2014. One of the many CSA branches of research Bringing together an international group of users, potential users, vendors and brokers of SecaaS solution. Research SecaaS – balanced and vendor neutral Define types / categories of service Produce architectural and implementation guidance Find us here: https://cloudsecurityalliance.org/research/secaas/

5. SecaaS Working Group Charter © Cloud Security Alliance, 2015 Revised Charter early 2016 https://cloudsecurityalliance.org/download/security-as-a-service-working-group- charter/ Working Group Executive Overview Scope and Responsibilities Work Group Membership and Structure Standard Operations Research Lifecycle Peer Review Deliverables/Activities Charter Revision History

6. Category Framework © Cloud Security Alliance, 2014. Define elements What (hardware, software) How (process, workflow) Why (governance, risk) Who (resources) When (plan, incident, report) Guidance (methodology) Multiple Target Audiences Control selection, disciplines Interfaces, Infrastructure SLAs and Service functions Implementation models

7. Category Outlines/Template © Cloud Security Alliance, 2015 Description Architecture ( Infrastructure, Public-Facing Services, Intrusion & Incident, Risk Framework ) Category General Description Business Elements Core Functionalities Optional Features Technical Elements Disciplines Related Services Standards Controls Threats and Challenges References – Links, CSA Controls, CSA Guidance

8. Looking Ahead © Cloud Security Alliance, 2014. Categories of Service Document version 2 Small Working Group, focus on standardization Continuous Monitoring Category 11 New working group or task force Built from new template, create a map of category relationships Category Guidance to version 2 Standard Template of Category Methodologies Controls, Disciplines, Services Enterprise—Location, Function, Process Delivery Model—In, Through, From Cloud to target environments (cloud, virtualized, traditional customer) Vertical Market Particulars—compliance, governance

9. Category Status © Cloud Security Alliance, 2015 Network Security Vulnerability Scanning Web Security Email Security Identity and Access Management Encryption Intrusion Management Data Loss Prevention Security Information and Event Management Business Continuity and Disaster Recovery Continuous Monitoring Security Assessments

10. Project Plan © Cloud Security Alliance, 2015 Bi-Weekly Meetings Status, updates, challenges Major Milestones Category Drafts Open Peer Review Final Drafts Individual Category Publishing Defined Categories of Service 2016 – Complete Series Individual Category - Implementation Guidance continued documents, 2016

11. Contacts/References © Cloud Security Alliance, 2015 SecaaS Leadership secaas-leadership@cloudsecurityalliance.org research@cloudsecurityalliance.org Reference Links CSA Website https://cloudsecurityalliance.org/group/security-as-a-service/ Basecamp https://basecamp.com/1825565/projects/1179002

12. THANK YOU © Cloud Security Alliance, 2014. Big thank you to all contributors! Category Leads Group members Technical writers CSA support Now is a great time to volunteer – Get involved! Help define the future of the group here: https://cloudsecurityalliance.org/group/security-as-a-service//#_initiatives

13. ? ? ? ? © Cloud Security Alliance, 2015