cloud security challenges today and tomorrow aloysius cheang asia pacific strategy advisor april...
TRANSCRIPT
![Page 1: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/1.jpg)
Cloud Security Challenges Today and Tomorrow
Aloysius CheangAsia Pacific Strategy Advisor
April 2011
![Page 2: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/2.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Cloud: Dawn of a New Age• Art Coviello - the most overhyped,
underestimated phenomenon since the Internet • Compute as a utility• Changes everything: business models, venture
capital, R&D, ……
![Page 3: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/3.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
What is Cloud Computing?• Compute as a utility: third major era of computing
• Cloud enabled by• Moore’s Law
• Hyperconnectivity
• SOA
• Provider scale
• Key characteristics• Elastic & on-demand
• Multi-tenancy
• Metered service
![Page 4: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/4.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
4
2010-2013: the Hybrid Enterprise
enterprise boundary
public clouds
Extended Virtual Data Center
private clouds
cloud of users
Notional organizational
boundary
• Dispersal of applications
• Dispersal of data
• Dispersal of users
• Dispersal of endpoint devices
![Page 5: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/5.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Cloud & mobility forcing key issues• Critical mass of separation between data owners
and data processors• Anonymity of geography of data centers &
devices• Anonymity of provider• Transient provider relationships• Physical controls must be replaced by virtual
controls• Identity management has a key role to play• Cloud WILL drive change in the security status
quo• Reset button for security ecosystem
![Page 6: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/6.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Key Cloud Security Problems of Today
From CSA Top Threats Research:• Trust: Lack of Provider transparency, impacts
Governance, Risk Management, Compliance
• Data: Leakage, Loss or Storage in unfriendly geography
• Insecure Cloud software
• Malicious use of Cloud services
• Account/Service Hijacking
• Malicious Insiders
• Cloud-specific attacks
![Page 7: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/7.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Key Problems of Tomorrow
•Globally compatible legislation and policy
•Compatible Private & Public clouds•Real-time Risk Mgt & Compliance•Identity Management•Responding to security incidents
![Page 8: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/8.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
About the Cloud Security Alliance• Global, not-for-profit organization• Over 16,500 individual members, 90 corporate
members• Building best practices and a trusted cloud
ecosystem• Agile philosophy, rapid development of applied
research• GRC: Balance compliance with risk management• Reference models: build using existing standards• Identity: a key foundation of a functioning cloud
economy• Champion interoperability• Advocacy of prudent public policy
“To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud
Computing to help secure all other forms of computing.”
![Page 9: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/9.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Helpful research from CSA
![Page 10: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/10.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CSA Guidance Research
Guidance > 100k downloads: cloudsecurityalliance.org/guidance
Governance and Enterprise Risk Management
Legal and Electronic Discovery
Compliance and Audit
Information Lifecycle Management
Portability and Interoperability
Security, Bus. Cont,, and Disaster Recovery
Data Center Operations
Incident Response, Notification, Remediation
Application Security
Encryption and Key Management
Identity and Access Management
Virtualization
Cloud Architecture
Op
erat
ing
in
th
e C
lou
d
Go
vernin
g th
e C
lou
d
• Popular best practices for securing cloud computing
• V2.1 released 12/2009
• V3 target Q3 2011
• wiki.cloudsecurityalliance.org/guidance
![Page 11: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/11.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Securing the Cloud - Governance• Best opportunity to secure cloud engagement
is before procurement – contracts, SLAs, architecture
• Know provider’s third parties, BCM/DR, financial viability, employee vetting
• Identify data location when possible
• Plan for provider termination & return of assets
• Preserve right to audit
• Reinvest provider cost savings into due diligence
![Page 12: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/12.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Securing the Cloud - Operating• Encrypt data when possible, segregate key
mgt from cloud provider
• Adapt secure software development lifecycle
• Understand provider’s patching, provisioning, protection
• Logging, data exfiltration, granular customer segregation
• Hardened VM images
• Assess provider IdM integration, e.g. SAML, OpenID
![Page 13: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/13.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Cloud Controls Matrix Tool• Controls derived from
guidance
• Rated as applicable to S-P-I
• Customer vs Provider role
• Mapped to ISO 27001, COBIT, PCI, HIPAA
• Help bridge the gap for IT & IT auditors
![Page 14: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/14.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Consensus Assessment Initiative
• Research tools and processes to perform shared assessments of cloud providers
• Lightweight “common criteria” concept
• Integrated with Controls Matrix
• Ver 1 CAI Questionnaire released Oct 2010, approx 140 provider questions to identify presence of security controls or practices
![Page 15: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/15.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CloudAudit
• Open standard and API to automate provider audit assertions
• Change audit from data gathering to data analysis
• Necessary to provide audit & assurance at the scale demanded by cloud providers
• Uses Cloud Controls Matrix as controls namespace
• Now a CSA project! www.cloudaudit.org
![Page 16: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/16.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CSA GRC Stack• Suite of tools, best practices and enabling technology
• Consolidate industry research & simplify GRC in the cloud
• For cloud providers, enterprises, solution providers and audit/compliance
• Controls Framework, Questionnaire and Continuous Controls Monitoring Automation
www.cloudsecurityalliance.org/grcstack Control Requirements
Provider Assertions
Private & Public Clouds
Private & Public Clouds
![Page 17: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/17.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CCSK – Certificate of Cloud Security Knowledge
• Only user certification for cloud security
• Web-based test for competency in CSA guidance
• $295 USD price
• www.cloudsecurityalliance.org/certifyme
• Training courses are available now!
![Page 18: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/18.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
o
• Courseware complete for CCSK Basic (1 day) and CCSK Plus (2 day)
- creating schedule
• In the pipeline
- PCI in the Cloud
- For QSAs and Merchants IT Staff
- 1 Day course (beta course hosted by Silicon Valley chapter)
- Courseware to be completed by late May
CCSK – Latest Updates
![Page 19: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/19.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Trusted Cloud Initiative• Comprehensive Cloud Security Reference
Architecture
• Secure & interoperable Identity in the cloud
• Getting SaaS, PaaS to be “Relying Parties” for corporate directories
• Scalable federation
• Outline responsibilities for Identity Providers
• Assemble reference architectures with existing standards
• Identity Mgt best practices whitepaper: http://www.cloudsecurityalliance.org/guidance/csaguide-dom12-v2.10.pdf
![Page 20: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/20.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
o
• Consensus research for emergency response in Cloud
• Enhance community’s ability to respond to incidents
• Standardized processes
• Supplemental best practices for SIRTs
• Hosted Community of Cloud SIRT
• https://cloudsecurityalliance.org/cloudsirt.html
Cloud SIRT
![Page 21: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/21.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
The need for the Security as a Service Initiative
• Information assurance challenged by disruptive trends (cloud, mobility, social networking, etc)
• Cloud provides opportunity to rethink security (economics, architecture, service delivery models, etc)
“To promote the use of best practices for providing security assurance within Cloud Computing, and
provide education on the uses of Cloud Computing to help secure all other forms of
computing.”
![Page 22: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/22.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Security as a Service Scope
• Information Security Industry Re-invented• Define Security as a Service• Articulate solution categories within Security
as a Service• Guidance for adoption of Security as a Service• Align with other CSA research
• Develop deliverables as a proposed 14th domain within CSA Guidance version 3.
![Page 23: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/23.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
o
• InfoSecurity Europe- April 19th -21st, 2011- Earl’s Court, London UK- Free Registration – Visit: www.infosec.co.uk
• CSA Summit on April 21st, 2011- Full agenda and registration for the event will be
posted on the CSA website and on LinkedIn
InfoSec Europe, April 19th -21st , London UK
Upcoming Events
![Page 24: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/24.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
o
• Call for Papers- Abstract Submission Deadline: April 4th, 2011- Curriculum sessions plan to date are posted on
the CSA website:https://cloudsecurityalliance.org/csac2011.html
- Additional information can be found at:http://www.misti.com/cloud
CSA Congress, November 16th – 17th, Orlando, Florida
Upcoming Events
![Page 25: Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011](https://reader035.vdocuments.mx/reader035/viewer/2022062516/56649e025503460f94aed1bd/html5/thumbnails/25.jpg)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Contact
• Asia Pacific Leader - Aloysius Cheang ([email protected])
• Chapters in Asia Pacific- Japan- Greater China (Beijing, Shanghai, Guangzhou, Hong Kong)- India (Mumbai, Chennai, Bangalore, Hyderabad)- Singapore- Indonesia
• [email protected]• LinkedIn: www.linkedin.com/groups?gid=1864210• Twitter: @cloudsa