Cloud Security

Rapp Consulting peet.rapp@yahoo.com

Cloud Security and Audit Issues

Agenda Cloud Computing 101

Reality Check

Security Issues

ISACA Member Responsibilities

What’s Missing

Cloud Computing 101

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

- NIST Definition of Cloud Computing

Cloud Computing 101 History - Definitions

Applications

System Platform

Hardware

traliz

Per Novell Cloud Presentation 09/09

Basic Concepts – Cloud Enabling Technologies / Functions

Cloud Computing is the attemtped

commercialization of Virtual computing

Server Partitioning #1

Basic Concepts – Cloud Enabling Technologies / Functions

SOA - XML – API Hypervisor Dynamic Partitioning API - Application Programming Interface Server Optimization OS / Application / Data Server Migration Client CPU/Memory Utilization Monitoring

Basic Concepts – Enabling Technologies

Dynamic Partitioning – the variable allocation of cpu processing and memory to multiple OS’s, applications, and data within one server

Lawson / UNIXHR / WINeCom / JAVAERP / Sun OS

Server Partitioning #2Lawson

/ UnixHR / WINeCom / JavaERP / SUN OS

Cloud Computing 101ASPs vs SaaS

ASPs are traditional, single-tenant applications, hosted by a third party.SaaS applications are multi-tenant, user facing, web-based applications hosted by a vendor

Cloud Computing 101PaaS

A Development Environment (Platform) as a Service.

Developer Tool Kits provided. “Pay as you develop/test” business modelRapid Propagation of Software Applications – Low Cost of Entry

Cloud Computing 101IaaS

The “Bare Metal” Infrastructure as a Service

•Clients provide all OS, security andapplication software

•Used for quick-implementation, as-needed data processing / data storage

Cloud Computing 101 - Service Delivery Models

IAAS Infrastructure as a

Service

PaaSPlatform as a Service

SaaSSoftware as a Service

Cloud Deployment Models

Public cloud Sold to the public, mega-scale infrastructures

Private cloud Enterprise-owned or leased to a Single Client

Community cloud Shared infrastructure for a Specific

Community Hybrid cloud

Composition of two or more Cloud Models

Cloud Computing 101

Reality Check

The Cloud Is and Will Happen

Current Major Players – IaaS, PaaS Amazon Web Services, ATT, IBM Rackspace, Terramark, Savvis

Current Major Players - SaaS FaceBook, Salesforce.com, Google (Gmail), Netsuite

Reality Check

Cloud Status in the US

US GovtIndustry

InternetNews.com, “Obama CIO: Government Can Lead in IT,”March 12, 2009

Reality Check Spending Forecasts

Claimed Cloud Computing Business Advantages

Optimizes Server Utilization Cost Savings Dynamic Scalability Time Savings for New Programs Right-sizes your enterprise Outsources IT Transitions CAPEX to OPEX

Excellent Cloud Examples

NASDAQ / NYT

SalesForce.com Signiant ThinLaunch Software Intuit QuickBase Webroot

A Disruptive Technology

The Cloud Reshuffles the IT deck

Shrink Wrapped Application s and Enterprise-Sized will migrate to Online Apps, Possibly Open-Sourced

OS will tend towards web-partial systems Desktops and Notebooks Lose Hard

Drives Businesses’ IT Staffing Requirements Will

Current Press Status

The Majority of Press Coverage supports Service Providers attempting to gain mindshare.

Most IT Analysis is very positive about (hyping) the merits of the cloud.

Very little is written of Cloud Security or its Audit- ability

The Gartner Hype Curve

Reality Check

Greatest concerns surrounding cloud adoption at your

company (per CIO) Security 45%

Security Issues

“Cyber Crime in 2008 measured more to be a larger societal loss than illegal drugs.

“The main objective of most attackers is to makemoney. The underground prices for stolen bank login accounts range from $10–$1000 (depending on theavailable amount of funds), $0.40–$20 for credit cardnumbers, $1–$8 for online auction site accounts and $4–$30 for email passwords.”

Symantec Global Internet Security Threat Report – April 2009

Security Issues

“Cybersecurity risks pose some of the most serious economic and national security challengesof the 21st Century. The digital infrastructure’sarchitecture was driven more by considerations ofinteroperability and efficiency than of security.”

White House Cyberspace Security Review May 2009

Security Issues

Reality Check

company (per CIO) Security 45% Integration with existing systems 26% Loss of control over data 26% Availability concerns 25% Performance issues 24% IT governance issues 19% Regulatory/compliance concerns 19%

Cloud Security & Control Groups

ENISACloud Security Alliance – CSA

Jericho Forum

Apps.gov

Cloud Security Alliance Members

Cloud Security Alliance

Security Issues Data Location

SaaS Clients’ data co-mingled

Accuracy and Authenticity of both Data and Applications transferred between servers

Penetration Detection & Multi-Client UA

Public Cloud-Server Owner – Due Diligence? Data Erasure?

Current Regulations

PCI Compliance

States’ PII requirements

Sarbanes Oxley

Current Regulations & Standards

ISACA Member Responsibilities – Opportunities

company (per CIO) Security 45% Integration with existing systems 26% Loss of control over data 26% Availability concerns 25% Performance issues 24% IT governance issues 19% Regulatory/compliance concerns 19%

Ensure Organization’s Key Players Aware of Cloud Security Issues

Audit Data / Applications targeted for Cloud Computing

Input / Review Cloud Provider’s SLA Agreement

Strengthen internal IAM ProgramRapp Consulting

Ensure Organization’s Key Players Aware of Cloud Security Issue

Target respected type “A”champions Business Application Owners Corporate Attorneys CxOs HR

Audit Data/Applications targeted for Cloud ComputingData MappingWhat is the application data’s

internal security level? Who are the Data Owners?What Type of Cloud (public,

private, etc) is targeted?

Input / Review Cloud Provider’s SLA

Open Sourced API’s, etcXACML-based IAM programSecurity Transparency Ownership of DataAudit at WillDR/BC policy and practiceReturn of application and data policy

Strengthen IAM Program

Rapp Consulting

Strengthen Identity – Access Management Program

XACML Based IAM program Federated User Access – integrated

across both cloud and internal enterprise

Aligned with compliance requirements SSO – (Single Sign On) IAM Security Monitoring – Reporting Oppty to implement risk-based

provisioning

KEY TAKE-AWAY #1

Cloud Computing should provide organizations

sufficient- enough costs-savings to afford investments in required best – practice IS

security measures.

KEY TAKE-AWAY #2

Employ the same best-practice audit and risk management

principles for cloud computing as you have been trained for and have used (or should be using)

your entire career.

Key Take Away #3

Develop an Overarching Business Impact

Analysis Moving an Application / Data to the cloud

Cloud computing can be evaluated much in the same way as a new operating system. And yet, it's somethng more as well. It has the usual system services but also some fantastic ones -- unlimited memory, unlimited storage, unlimited network bandwidth, unlimited (and on-demand) scalability and parallelism

http://www.ddj.com/web-development/220300736?pgno=4

This fundamental difference between probabilistic riskand risk introduced by an intelligent adversary (or adaptive threats) leads to the conclusion that more understanding of the cyber security issues and impactsthat are possible on the electric grid is needed. Indeed,there really is no statistical norm for the behavior of cyber attackers and information systems and components failure, and their potential impacts to grid reliability.

NERC - 2009 Long-Term Reliability Assessment

Internal Enterprise

Distribution Reseller

Suppliers

CRM Cloud App

ERP Cloud App

Internal Enterprise

Distribution Reseller

Suppliers

Stock Opt

Advrtz

CRM Cloud App

Cust Servic

eERP Cloud App

There needs to be rock-solid security, and annual (or when

changes occure) audit-to-certification standards developed

for Cloud Service Providers (CSPs)

Summary –

•Become a Weatherman – Learn the Clouds

•Educate Key Organization Decision makers

• Internal risk assessment of Apps and Data

•Insist on Seat in SDLC Group

•Insist on open source or open standard cloud tools

Summary –

•Audit CSP’s Security and DR/BC Policies

•Is CSP promoting best security practices?

•Upgrade Current Internal IAM program

•Insist on “SAS70” type audit from partners and outsource providers of their cloud enterprises

What’s Still Needed

Commercial Cloud Applications Security Standards.

Training & Certification requirements for Individual Cloud Developers Cloud Service Providers Cloud Security Tool Providers

What’s Still Needed

Best Practice Standards for Internal Audits of Enterprises Employing Cloud Applications. Combination of the ENISA cloud risk

assessment with the financial Shared Assessment program

Implement an annual Know Your Client (KYC) type audit/certification for all clients and cloud services providers.

questions

Thank you

Peet Rapp – MBA, CISApeet.rapp@yahoo.com603-731-0494

Cloud Security

Technology

Transcript of Cloud Security

Cloud Insights Security : Cloud Insights...Cloud Insights Security Product and customer data security is of utmost importance at NetApp. Cloud Insights follows security best practices

Cloud Security - Security Aspects of Cloud Computing

Navigating the Changing Cloud Security Landscape · Navigating the Changing Cloud Security Landscape Dell cloud security white paper | September 2013 As cloud security threat levels

Cloud Security Strategies - eba.europa.euFabio+Gianotti+-+Cloud+Security+Strategies.pdf · Cloud Security Strategies ... Different approaches to cloud adoption due to ... • Evaluation

Cyber Security and Cloud Security

Transforming Security Part 1: Cloud & Virtualization · Transforming Security Part 1: Cloud ... Practitioners Vendors Cloud Infrastructure ... Transforming Security Part 1: Cloud

Cloud Security & Cloud Encryption Explained

Scaling the Cloud - Cloud Security

IBM Cloud Security for the Cloud · IBM Cloud Security for the Cloud Amr Ismail Security Solutions Sales Leader – Middle East & Pakistan

Federated Cloud Security Architecture for Secure and … · Federated Cloud Security Architecture 171 2 Cloud Security We brieﬂy review cloud security [40] and related prior work

Cloud Security Certification - Certified Cloud Security ...

Security kaizen cloud security

CLOUD STORAGE SECURITY INTRODUCTION - SNIA Security Concerns with Cloud Understanding how Cloud services provide for the ... cloud computing environment, ... Cloud Storage Security

Cloud Security

Planning Guide: Cloud Security - Intel · 5 Intel IT Center Planning Guide | Cloud Security The Cloud Security Alliance, an industry group promoting cloud computing security …

Professional Cloud security Manager - wiselearner.com Cloud Security Manager.pdf · Understanding Cloud Computing Vulnerabilities Vulnerability Vulnerabilities and Cloud Risk Cloud

SECURITY CLOUD

Cloud Security ("securing the cloud")

Cloud security and security architecture

Cloud Storage Security & Privacy - Troopers IT-Security ...€¦ · Cloud Storage. Cloud Storage. Cloud Storage. Cloud Storage. Why cloud storage? Price. Why cloud storage? Scalable.