German IT-Grundschutz
Cloud Management
Dominic Mylo
Cooperation with
Workshop
Certification, InteRnationalisation and
standaRdization in cloUd Security
3 CIRRUS Workshop Cloud Security Vienna, 19. November 2013
Introduction
Dominic Mylo
Cloud Security Vienna, 19. November 2013
Atos Cloud Competencies
▶ Experience in providing Cloud Services
– Canopy
– Research & Innovation department of Atos has more
than 10 ongoing research projects related to cloud security ▶ Corporate Member Cloud Security Alliance
▶ Atos is member of European Cloud Partnership
▶ Actively participating in initiatives run by ETSI, ENISA, CEN ▶ Atos is participating in Helix Nebula federated cloud
for science
Cloud Security Vienna, 19. November 2013
IT-Grundschutz Methodology
▶ Describes a method for setting up and integrating IS management in an organisation.
▶ ISO 27001 certification process in accordance with IT-Grundschutz by german BSI as accreditation body per law.
▶ The IT-Grundschutz Catalogues contain over 4500 pages describing potential threats and protective security controls.
▶ The IT-Grundschutz Catalogues are constantly being revised, and new, specialised subjects are added as required.
7
CIRRUS Workshop Cloud Security Vienna, 19. November 2013
Security Concept IT-Grundschutz
Structure analysis
Protection requirments determination
Risk analysis
Modelling of domain (select safeguards)
Implementation of safeguards
Individual sec controls IT-Grundschutz sec controls normal prot. Requirements High protection Requirementssimplified process
Cloud Security Vienna, 19. November 2013
Protection Requirements
▶ Technical, organisational, personnel, and infrastructural security safeguards ▶ Reach a baseline security level
▶ Protect business-related information having normal protection requirements. ▶ Basis for IT systems and applications requiring a high level of protection. ▶ Protection requirements are define by possible impact caused by loss of CIA. ▶ Cloud Problem: CSP cannot rate the protection value of cloud data
(CSP is not information owner) ▶ a) Ask the cloud user
9
CIRRUS Workshop Cloud Security Vienna, 19. November 2013
Layer Model IT-Grundschutz
▶ Cloud Usage ▶ Cloud Management ▶ Webservices
Layer 1
Layer 2
Layer 3
Layer 4
Layer 5
covers all generic information security issues. These include the human resources, data
backup concept
covers the technical issues related to building construction. Examples include the modules for buildings, server rooms
covers individual IT systems. Examples include the general client, general server, telecommunication system, laptop modules. concerns the issues relating to networking IT systems. Examples include WLAN, VoIP,
network management modules
deals with the actual applications. Examples include the e-mail, web server, and database modules. ▶ Virtualisation ▶ (Cloud) Storage systems
Cloud Modules
Cloud Modules
11
CIRRUS Workshop Cloud Security Vienna, 19. November 2013
Information sources
International Best Practices
▶ Cloud Security Alliance
– Cloud Control Matrix
– Cloud Security Guidance
▶ ENISA
– Cloud Computing Risk Assessment ▶ BSI
– Security Recommendations for Cloud Computing Providers ▶ VMware
– Study VCE Vblock
▶ IETF
Cloud Security Vienna, 19. November 2013
Target Group
Cloud Management Module
▶ Cloud Service Provider▶ Cloud User should use Module „Cloud usage“ ▶ Target group german public agencies
▶ Applicable cross market ▶ Secure providing,
management & operation of cloud environments ▶ Out of scope:
– infrastructure security
13
CIRRUS Workshop Cloud Security Vienna, 19. November 2013
Cloud Reference Model
IETF
data / content Cloud Portal
Cloud Services (SaaS, PaaS, IaaS)
resource control layer
virtual resource control layer
physical resource control layer
Cloud
„Self-Service-Portal“ Cloud Management:
Cloud configuration Registry & Repository
Audit & Logging SLA
Cloud Security Vienna, 19. November 2013
Cloud Management Threats
Summary
organisational shortcomings Human error technical failures deliberate acts▶ Failures in Planning Cloud Service Templates
▶ Incorrect Provisioning of Cloud Services
▶ Insufficient isolation of cloud services
▶ Insufficient Business Continuity Mgt
▶ Insufficient configuration of cloud services and management
components
▶ Failures in automated Cloud Management
▶ Outage of cloud management components
▶ unauthorised usage of snapshots
▶ fraudulent use of
administrative permissions
15 CIRRUS Workshop Cloud Security Vienna, 19. November 2013
Security Controls
Summary
Provisioning Planning concepts implemen tation operation BCM▶ Planning Cloud Service Templates and Cloud-Ressources
▶ Third party contracts
▶ Selection of cloud-components
▶ Secure communication for cloud access
▶ Training for cloud administrators
▶ Event logging and monitoring
▶ patch management
▶ Security Controls to ensure continuous Multitenancy
▶ Business continuity
▶ backup
▶ Cloud user administration
▶ Complete and „secure“ deletion of cloud data for sensible information
▶ Controlled provisioning & deprovisioning of cloud services
Cloud Security Vienna, 19. November 2013
Atos, the Atos logo, Atos Consulting, Atos Worldline, Atos Sphere, Atos Cloud and Atos WorldGrid
www.atos.net
For more information please contact:
Dominic Mylo Security Consultant T +49 (5931) 805-478 M +49 (177) 915 1856 [email protected] Lohberg 10 49716 Meppen
