Cloud computing 101
31
Cloud Computing 101 Kevin Riggins Wednesday, 2:45 Just the Facts Ma’am.
-
Upload
kriggins -
Category
Technology
-
view
574 -
download
0
description
TH
Transcript of Cloud computing 101
Cloud Computing 101Kevin Riggins
Wednesday, 2:45
Just the Facts Ma’am.
Welcome to secure360 2012 Did you remember to scan your badge for CPE
Credits? Ask your Room Volunteer for assistance.
Please complete the Session Survey front and back (this is Room 12), and leave on your seat.
Note: “Session” is Tuesday or Wednesday
Are you tweeting? #Sec360
What the &^%$ is Cloud?Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.
~ NIST SP800-145
What the &^%$ is Cloud?Broad
Network Access
RapidElasticity
MeasuredService
On-DemandSelf-Service
Resource Pooling
Software as aService (SaaS)
Platform as aService (PaaS)
Infrastructure as a
Service (IaaS)
Community
HybridPrivatePublic
NIST Visual Model of Cloud Computing
Essential Characteristics
Service Models
Deployment Models
Essential Characteristics
Cloud
Wait! Over
Here Too!
Yup,Here Too
FromHere
FromHere
Broad Network Access
Essential Characteristics
Little Cloud
Bigger Cloud
Little Cloud
Rapid Elasticity
Zoom
Zoom
Essential Characteristics
Measured Service
A Little
Middlin’
A Lot
Time
Essential Characteristics
On-Demand Self-Service
I want to do
it. NOW!
Essential Characteristics
Resource Pooling
Everybody uses the same water.
Service Models
Facilities
Hardware
Abstraction
Core Connectivity & DeliveryAPIs
Integration and Middleware
IaaS
(Infr
ast
ruct
ure
as
a S
erv
ice)
PaaS
(Pla
tform
as
a S
erv
ice)
Data ContentMetadata
APIs
Applications
Presentation Modality
Presentation Platform
SaaS
(Soft
ware
as
a S
erv
ice)
Service Models
Here’s a bunch of logs, have at it.
IaaS
Service Models
Here’s a foundation, some tools, and more materials. Knock yourself out.
PaaS
Service Models
It’s all in there. Just move in.
SaaS
Who’s In Control?
Less ControlAs We Go Up
IaaS
PaaS
SaaS
Deployment Models
Private
Community
Public
Hybrid
Deployment Models
Private
Source: http://dogs.icanhascheezburger.com/2012/03/16/funny-dog-pictures-mine-all-mine-2/
Deployment Models
Public
Source: http://popupcity.net/2009/11/on-moscows-public-toilets/
Deployment Models
Community
Deployment Models
Hybrid
http://www.coolfunnycomments.com/funnypictures/dogs_041.html
Actors
Consumer
Provider Broker Auditor Carrier
Things to Think About
Backups Encryption Logging Authenticatio
n Access
control Monitoring
Visibility Compliance Availability Audit Disaster Rec. Monitoring
Great! But…. should I use the Cloud?
Questions to Ask Yourself
How would we be harmed if
the asset became widely
public and widely distributed?
Questions to Ask Yourself
How would we be harmed if an
employee of our cloud provider
accessed the asset?
Questions to Ask Yourself
How would we be harmed if
the process or function were
manipulated by an outsider?
Questions to Ask Yourself
How would we be harmed if the
process or function failed to
provide expected results?
Questions to Ask Yourself
How would we be harmed if
the information/data were
unexpectedly changed?
Questions to Ask Yourself
How would we be harmed if
the asset were unavailable for
a period of time?
References
NIST SP800-145 Cloud Definitionhttp://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf
NIST SP800-146 Cloud Computing Synopsis and Recommendations http://csrc.nist.gov/publications/drafts/800-146/Draft-NIST-SP800-146.pdf
NIST SP500-292 Cloud Computing Reference Architecturehttp://www.nist.gov/customcf/get_pdf.cfm?pub_id=909505
Cloud Security Alliance Guidancehttps://cloudsecurityalliance.org/guidance/csaguide.v3.0.pdf
ENISA Cloud Risk Assessmenthttp://www.enisa.europa.eu/activities/risk-management/files/deliverables/cloud-computing-risk-assessment
Australian DoD Cloud Security Considerationshttp://www.dsd.gov.au/publications/Cloud_Computing_Security_Considerations.pdf
Jericho Cloud Cubehttps://collaboration.opengroup.org/jericho/cloud_cube_model_v1.0.pdf
Cloud Security Ruleshttp://www.amazon.com/The-Cloud-Security-Rules-Technology/dp/1463691785
Questions?
Twitter: @kriggins, @infosecramblinsEmail: kriggins@infosecramblings
