Cloud Security. DLT Solutions LLC June #DLTCloud

Cloud Security

DLT Solutions LLC

Your Hosts

• Van Ristau

Chief Technology Officer, DLT Solutions

• David Blankenhorn

Introduction

• Cloud Webcast Series

– Five weekly webcasts (Thursdays May 12–June 9)

• Webcast #1 –May 12– Introduction to Cloud Computing • Webcast #2 –May 19– Software as a Service (SaaS)

• Webcast #3 –May 26– Infrastructure as a Service (IaaS) • Webcast #4 –June 2– Platform as a Service (PaaS)

• Webcast #5 –June 9– Securing the Cloud

• Series Objectives

– Provide the audience with

• A baseline understanding of Cloud Computing service models.

• Suggested decision criteria for selecting appropriate Cloud services. • An overview of vendor Cloud services available

Agenda – Cloud Security

• What’s different?

• Key Security and Privacy Issues • Security Upside

• Security Downside • Threats & Risks

• Private & Virtual Private Clouds • What To Look For

• What To Ask

Current Models – It’s All Inside

Physical Datacenter

Systems • Servers (Hypervisors) • Storage • Network • Appliances Application Platforms • Operating Systems (VMs) • Applications Account Management • Identity • Authentication • Authorization Governance, Risk & Compliance (GRC) • Audit • Analysis • Business Continuity Security Infrastructure • Intrusion Prevention • Intrusion Detection • Continuous Monitoring • Access Controls Client Interface • Browsers • Smartphones • Desktops • Laptops • Tablets

Traditional Hosting Models IT • Systems • Application Platform • GRC • Account Management • Security Infrastructure • Client Interface Hosting Provider

• Physical Data Center • Systems (limited)

• Application Platform (limited)

Public Cloud - Realms of Responsibility

SaaS

PaaS

IaaS

• Application • Application Platform • Security Infrastructure

Governance Compliance Trust Architecture & Software Isolation Identity & Access Availability Incident Response Data Protection

Possible Security Upside • Cloud Staff Specialization • Platform Strength • Resource Availability

Possible Security Downside • Shared, Multi-tenant Services

• Complexity

• Loss of Control & Visibility • Internet Facing

• Data Sovereignty

Top Threats & Risks Threats

• Abuse & Nefarious Use • Insecure Interfaces &

APIs

• Malicious Insiders • Shared Technology • Data Loss or Leakage • Account or Service

Hijacking

• Unknown Risk Profile

Source: Cloud Security Alliances’ (CSA) Top Threats to Cloud Computing v1.0

Risks

• Privileged User Access • Regulatory & Ethical

What About Private? • Needs Additional Security

– Virtualization

– Cloud Infrastructure – VM Mobility

• Loses Scale

• Requires New Skills • Pay Upfront

• Solves “Data Sovereignty”

• Maintains Control & Visibility

Virtual Private Cloud? • Resource Dedication

– Multi-Tenancy Risk Reduced

• Virtual Private Network (VPN) • Additional Security Boundaries • Visibility & Control Increased

– But still limited

• Agility

What To Look For

• Service Level Agreements • Certifications & Compliance

– FISMA

– SAS 70, Type II – ISO 27001

– PCI DSS, HIPAA, etc.

• Penetration Testing

• Incident Response Processes & Procedures

What To Ask • How to audit?

• Where’s the data? • Who can access?

• How are employees trained?

Considerations & Cautions • Data Sovereignty • Key Management • Identity Integration • Network Latency • Cloud Compatibility • Auditors

• Trust, but Verify

Resources

• National Institute of Standards and Technology (NIST)

– http://www.nist.gov/itl/cloud/

– 800-37: Guide to Security Certification and Accreditation of Federal Systems – 800-53r3: Recommended Security Controls for Federal Information Systems and

Organizations

– 800-146: DRAFT Cloud Computing Synopsis and Recommendations – 800-144: Guidelines on Security and Privacy in Public Cloud Computing – 800-125: Guide to Security for Full Virtualization Technologies

• Cloud Security Alliance (CSA)

– https://cloudsecurityalliance.org/ – Cloud Controls Matrix

• European Network and Information Security Agency (ENISA)

– http://www.enisa.europa.eu/

– Cloud Computing: Benefits, risks and recommendations for information security

• Federal Risk and Authorization Management Program (FedRAMP)

Closing Thoughts

“Clouds are massive complex systems [that] can be reduced to simple primitives that are

replicated thousands of times and common functional units.” – Peter Mell and Tim Grance, NIST.

““When eating an elephant, take one [bite] at a time.” – General Creighton Abrams Jr.

Contact Information

DLT Cloud Advisory Group

1-855-CLOUD01 (256-8301)

[email protected] www.dlt.com/cloud