Project acronym: NEBULA
Project name: A novel vocational training programme on cloud computing skills Project code: 540226-LLP-1-2013-1-GR-LEONARDO-LMP
Document Information
Document ID name: Nebula_WP4_D4.3.1_Learning_Material_and_Content_2015_30_04 Document title: Nebula VET program learning material and content
Type: Slides
Date of Delivery: 30/04/2015
Work package: WP4
Activity D.4.3.1
Dissemination level: Public
Document History
Versions Date Changes Type of change Delivered by
Version 1.0 15/04/2015 Initial Document - UCBL and INSA of Lyon
Version 2.0 26/06/2015 Edition to feedback provided byModifications according
partners UCBL and INSA of Lyon Version 2.1 02/09/2015 Edition Insertion of license type UCBL and INSA of Lyon
Acknowledgement
The persons of UCBL in charge of producing the course are Parisa Ghodous, Catarina Ferreira Da Silva, Jean Patrick Gelas and Mahmoud Barhamgi. The persons from UCBL involved in preparing, translation and review are Hind Benfenatki, Gavin Kemp and Olivier Georgeon.
The persons of “INSA of Lyon” in charge of producing the course are Frédérique Biennier, Nabila Benharkat. The persons from INSA of Lyon involved in preparing, translation and review are Francis Ouedraogo and Youakim Badr.
Disclaimer
The information in this document is subject to change without notice. All rights reserved.
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
This publication reflects the views only of the author, and the Commission cannot be held responsible for any use, which may be made of the information contained therein.
Module 3 objectives
The aim of this module is to provide the student with
the capabilities to analyse the risks and legal
implications associated to the migration process,
assessing their influence in the data, processes, and
applications
---Note: due to intellectual property reasons, the logotype of UCBL
must remain in all utilisation of this course content, as well as the
note “copyright DUNOD” mentioned in some slides with figures.
Risk, security, and legal analysis for migration to cloud
According to you, how can you assess
the risks associated to the Cloud
Migration?
• Do you know some risks analysis methods?
• Are you aware of security project in your organisation?
• Do you know some Cloud security models?
• How can you evaluate organisational risks?
• How can you evaluate Cloud platform risks?
According to you, how can you assess
the risks associated to the Cloud
Migration?
• In this part you will
– Learn basic principles of Security Risks management
methods
– Get information to compare some methods and organise a
security project
– Learn basic Cloud security models
– Get information on Business and Cloud platform security
models
– Identify security risks associated to a Business Process
migration
PART 2 OVERVIEW
1. Security models and methods
2. Cloud security models
Methods to design secured systems
• Different goals
– Security policy specification
• Security goals
• Risks identification
• Methods
– Ebios – Octave
– Secured infrastructure organisation
• Safe
• SNA
– Introduction os security constraints in IS / process design:
Security by design?
Vulnerabilities classes
• Organisation related vulnerabilities
– Backup management
– Role and access rights management
• Software components related vulnerabilities
– Code audit
– Software certification
• Communication infrastructure related vulnerabilities
– Intrusion
– Tapping communication traffic
– Deny of service
Methods to manage a security project
• Traditional project organisation
– Preliminary study -> Perimeter and requirements definition
– Specification -> Threats and vulnerabilities identification
– Integration of solutions to mitigate risks
– Deployment
• Choose convenient technologies
• Organise the architecture
• Major need
– Engineering the Global architecture with an end to end perspective
– Know precisely who is responsible for what
• Knowledge bases provided by the different methods (EBIOS,
MEHARI, OCTAVE, SNA, Safe…)
Comparison of different methods
Requirements analysis Design
Implementation
EBIOS
Risks and security
goals identification
Protection patterns
OCTAVE
Identification of the
way IS can be acceded
Best practices and
security goals
organisation
Audit and
implementation + project
management
SNA
IT components and
Business Process
identification
Design of an
attack-proof system
Information on attacks
and implementaiton of
knowledge bases
MEHARI Limited risks analysis
Best practices
Enterprise security
dashboards
Cloud risks
• Is security different for Clouds?
– Cloud has its own vulnerabilities
• Architecture
– Hypervisor
– Distributed system
– Different software components
• Organisation
– Different actors
– Responsibilities areas
– Distributed system using “hot plug / hot deployment”
– Difficulties related to the use conditions
• Personal data
Jericho Forum’ security model
• Three axes define how the cloud is controlled
– Where the cloud is implemented
– Who manages the Cloud
– Which kind of software
Cloud Security Alliance
• Software stack oriented standard
specifications
• Top threats analysis
(https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf)
• CSA also provides a risk analysis tool
Cloud Security Alliance
Risks and controls…
XaaS Security criteria
Confidentiality Integrity Availability Non Repudiation
IaaS Secured network and physical access to infrastructures Users and hosting process integrity control on each cloud node Resources (bandwith, storage, network, VM computing environment….) availability Manage, monitor and log actvities related to network, storage, computing and VMs resources
PaaS Design APIs without weaknes and implement platform access control
API integrity APIs and Cloud
platform availability Log platform accesses
SaaS Data security
management Exchanged messages and processed data integrity management Data and application availability
Identify and log accesses to applications and data
Risks depending on Cloud types
Deployment
model Security challenges
Private Cloud Data confidentiality and integrity must be taken into account as in classical Information System
The Cloud manager / owner is reponsible for the consequences in case of damages
Public Cloud Data confidentiality and integrity as in private Cloud + provide isolation means so that data belonging to different clients won’t be mixed
Check that the Cloud legal environment that will be used will not compromise Data confidentiality (ex: US Patriot Act)
Community
cloud The global security policy should comply each entreprise security policy. This is difficult as corporates do not have the same security / collaboration / Cloud hosting strategies
Data classification
Traffic Light
Protocol Government classification Description
RED Top secret Highly sensitive data that must not be shared. Any disclosure causes exceptionally grave damages.
ORANGE Secret Very sensitive data that can only be shared with members of the organisation who need to know this data to achieve their tasks. Any disclosure beyond this restricted perimeter will seriously damage corporate safety.
GREEN Confidential Sensitive data that can be shared with authorise
parners and / or members of the community. Disclosure beyond this perimeter negatively impacts security.
LIGHT GREEN Restricted Low sensitive data that can be shared with the
members of the organisation. Its disclosure may have unsuitable effects.
BLANC Unclassified Non sensitive data that can be accessed / shared
without any restriction provided that authoring rights / licensing are controlled / respected. It does not require any authorisation
Business security model
• Integration of organisational specification
– Define data and process patrimonial value
• Financial / personal / strategic
– Identification of actors / rights…
• Who can accede / launch / use
• When, from where and how
• See the excel file
FunctionalSpecification
Financial Strategic personnal
OtherFunctional FromWhere Who Functional&OrganizationlSpecification When OragnizationalSpecification AccessControl How
