Achieving Security Assurance and Compliance in the Cloud Jim Reavis , Executive Director
description
Transcript of Achieving Security Assurance and Compliance in the Cloud Jim Reavis , Executive Director
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Achieving Security Assurance and Compliance in the Cloud
Jim Reavis, Executive Director
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Cloud: Ushering in “IT Spring”Cloud – a simple idea
Compute as a utilityAlign technology costs with usage
Challenges our assumptions about everything
Barriers to market entry in any industryOrganizational structure and business planningInvestment, venture capital, Research & Development
Driving a new macroeconomic reality“Revolutions are not about trifles, but spring from trifles.” Aristotle
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
The Revolution Has Tinder
Social networking, blogging and mircoblogging
Egalitarianism of media and communicationsMobile computing
Empowering the citizensCloud computing
Egalitarianism of ITWhat can’t this change?Timing is everything
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
What is Cloud Computing?
Compute as a utility: third major era of computingCloud enabled by
Moore’s LawHyperconnectivitySOAProvider scale
Key characteristicsElastic & on-demandMulti-tenancyMetered service
IaaS may track energy costs
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
5
2011-2014: The Hybrid Enterprise
enterprise boundary
public clouds
Extended Virtual Data Center
private clouds
cloud of users
Notional organizational
boundary
Cloud + MobileDispersal of applicationsDispersal of dataDispersal of usersDispersal of endpoint devices
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Cloud Forcing Key IssuesCritical mass of separation between data owners and data processorsAnonymity of geography of data centers & devicesAnonymity of providerTransient provider relationshipsPhysical controls must be replaced by virtual controlsIdentity management has a key role to playCloud WILL drive change in the security status quoReset button for security ecosystem
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
What are the Trust Issues?
Will my cloud provider be transparent about governance and operational issues? Will I be considered compliant?Do I know where my data is?Will a lack of standards drive unexpected obsolescence? Is my provider really better at security than me?Are the hackers waiting for me in the cloud?Will I get fired?
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Key Problems of Tomorrow
Keeping pace with cloud changesGlobally incompatible legislation and policyNon-standard Private & Public cloudsLack of continuous Risk Management & Compliance monitoringIncomplete Identity Management implementationsHaphazard response to security incidents
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
About the Cloud Security Alliance
Global, not-for-profit organizationOver 23,000 individual members, 100 corporate members, 50 chaptersBuilding best practices and a trusted cloud ecosystemAgile philosophy, rapid development of applied research
GRC: Balance compliance with risk managementReference models: build using existing standardsIdentity: a key foundation of a functioning cloud economyChampion interoperabilityEnable innovationAdvocacy of prudent public policy
“To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud
Computing to help secure all other forms of computing.”
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
HOW DO WE BUILD THE “TRUSTED CLOUD?”
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Here’s How…
StrategyEducationSecurity FrameworkAssessmentBuild for the Future
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
StrategyIT Architecture supporting Hybrid enterprise
Federated IdMService Oriented Architecture “loose coupling” principles
Consider cloud as an option to any new IT initiative
What are the cost differences?What are the feature/functionality differences?Does the application support different cloud deployments and multiple providers?
Risk ManagementSensitivity of application and data, new risks introduced by cloud, risk tolerance levels
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
EDUCATION
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CSA Guidance ResearchPopular best practices for securing cloud computingFlagship research projectV2.1 released 12/2009V3 research underway, targeting Q3 2011 releasewiki.cloudsecurityalliance.org/guidance
Ope
rati
ng in
the
Cl
oud
Governing the Cloud
Guidance > 100k downloads: cloudsecurityalliance.org/guidance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Guidance Highlights – 1/2
Governance, ERM: Secure the cloud before procurement – contracts, SLAs, architectureGovernance, ERM: Know provider’s third parties, BCM/DR, financial viability, employee vettingLegal: Plan for provider termination & return of assetsCompliance: Identify data location when possibleILM: Persistence, ProtectionPortability & Interoperability: SOA “loose coupling” principles
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Guidance Highlights – 2/2
BCM/DR: provider redundancy vs. your ownDC Ops: provisioning, patching, loggingEncryption: encrypt data when possible, segregate key mgt from cloud providerAppSec: Adapt secure software development lifecycleVirtualization: Harden, rollback, port VM imagesIdM: Federation & standards e.g. SAML, OpenID
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Certificate of Cloud Security Knowledge (CCSK)
Benchmark of cloud security competencyMeasures mastery of CSA guidance and ENISA cloud risks whitepaperUnderstand cloud issuesLook for the CCSKs at cloud providers, consulting partnersOnline web-based examinationwww.cloudsecurityalliance.org/certifyme
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Training Courses CCSK Basic
One day course to enable student to pass CCSK
CCSK Plus Two day course includes practical cloud lab work
GRC Stack Training One day course to use GRC Stack components
PCI/DSS In the Cloud Achieving PCI compliance in cloud computing
http://cloudsecurityalliance.org/education/training/
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Upcoming Conferences
CSA Summit Korea, Sept. 29, SeoulCSA Summit Europe, Oct. 10, London (with RSA Europe)CSA Congress, Nov. 16-17, OrlandoCSA Summit RSA, Feb. 27, 2012, San FranciscoSecureCloud 2012 (partnership with ENISA)
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
SECURITY FRAMEWORK
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CSA Reference ModelCSA Cloud Reference Model
IaaS (Compute & storage) is the foundationPaaS (Rapid application dev) adds middleware to IaaSSaaS represents complete applications on top of PaaS
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Cloud Controls MatrixControls derived from guidanceMapped to familiar frameworks: ISO 27001, COBIT, PCI, HIPAA, FISMA, FedRAMPRated as applicable to S-P-ICustomer vs Provider roleHelp bridge the “cloud gap” for IT & IT auditors
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
ASSESSMENT
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Assessment Responsibility
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Consensus Assessment Initiative
Research tools and processes to perform shared assessments of cloud providersIntegrated with Controls MatrixVersion 1 CAI Questionnaire released Oct 2010, approximately 140 provider questions to identify presence of security controls or practices Use to assess cloud providers today, procurement negotiation, contract inclusion, quantify SLAswww.cloudsecurityalliance.org/cai.html
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CSA STAR RegistryCSA STAR (Security, Trust and Assurance Registry)Public Registry of Cloud Provider self assessmentsBased on Consensus Assessments Initiative Questionnaire
Provider may substitute documented Cloud Controls Matrix compliance
Voluntary industry action promoting transparencyFree market competition to provide quality assessments
Provider may elect to provide assessments from third parties
Available October 2011
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
BUILD FOR THE FUTURE
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CSA GRC StackFamily of 4 research projects
Cloud Controls MatrixConsensus Assessments InitiativeCloud AuditCloud Trust Protocol
Tools for governance, risk and compliance managementEnabling automation and continuous monitoring of GRC
Control Requirements
Provider Assertions
Private, Community
& Public Clouds
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CloudAudit
Open standard and API to automate provider audit assertionsChange audit from data gathering to data analysis Necessary to provide audit & assurance at the scale demanded by cloud providersUses Cloud Controls Matrix as controls namespace Use to instrument cloud for continuous controls monitoring
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Cloud Trust Protocol (CTP)
Developed by CSC, transferred to CSAOpen standard and API to verify control assertions“Question and Answer” asynchronous protocol, leverages SCAP (Secure Content Automation Protocol)Integrates with Cloud AuditNow we have all the components for continuous controls monitoring
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
CloudSIRT
Consensus research for emergency response in Cloud
Enhance community’s ability to respond to incidentsStandardized processesSupplemental best practices for SIRTsHosted Community of Cloud SIRTswww.cloudsecurityalliance.org/cloudsirt.html
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Trusted Cloud InitiativeComprehensive Cloud Security Reference ArchitectureSecure & interoperable Identity in the cloudGetting SaaS, PaaS to be “Relying Parties” for corporate directoriesScalable federationOutline responsibilities for Identity ProvidersAssemble reference architectures with existing standardswww.cloudsecurityalliance.org/trustedcloud.html
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Reference Model Structure
TCI Reference Architecture
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Security as a ServiceInformation Security Industry re-inventedDefine Security as a ServiceArticulate solution categories within Security as a ServiceGuidance for adoption of Security as a ServiceAlign with other CSA researchDevelop deliverables as a proposed 14th domain within CSA Guidance Version 3.www.cloudsecurityalliance.org/secaas.html
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Data Governance Project
Survey of current Cloud Provider data governance practices in the market (e.g. backup, encryption, secure deletion, etc.)Structure based on Domain 5: Information Lifecycle MgtProject co-sponsored by CSA Silicon Valley and CSA SingaporeTarget Sept. 2011 Report releaseCharter and participation info to be posted on CSA website 1st week of August.
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
What Might Cloud 2.0 Look Like?
Less centralized than you think: cloud brokering, SOA, REST, evade energy costs, gridRegulated – if we don’t do it ourselvesDisruptive technologies, e.g. format preserving encryption, new secure hypervisors, Identity Management everywhereNew cloud business app modelsGreater policy harmonization (maritime law?)4 of 10 biggest IT companies of 2020 do not exist
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Going to the Cloud Securely
Challenges remainMore tools available than you thinkWaiting not an optionMany types of cloudsIdentify IT options appropriate for specific cloudLeverage business drivers & risk managementBe Agile!
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
Contact
Help Us Secure Cloud Computingwww.cloudsecurityalliance.orginfo@cloudsecurityalliance.orgLinkedIn: www.linkedin.com/groups?gid=1864210Twitter: @cloudsa
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance
THANK YOU!