![Addressing the new security challenges posed by virtualisation & cloud computing,[object Object],Rik Ferguson • Senior Security Advisor ,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-1-2048.jpg?cb=1668941657)
![A working definition of Cloud Computing,[object Object],Cloud computing is a pay-per-use model for enabling available, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.,[object Object],National Institute of Standards & Technology (NIST), USA,[object Object],5 Key Cloud Characteristics,[object Object],[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-2-2048.jpg?cb=1668941657)
![Pay per use,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-6-2048.jpg?cb=1668941657)
![Security: the #1 Cloud Challenge,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-7-2048.jpg?cb=1668941657)
![Who Has Control?,[object Object],Servers,[object Object],Virtualization & ,[object Object],Private Cloud,[object Object],Public Cloud,[object Object],PaaS,[object Object],Public Cloud,[object Object],IaaS,[object Object],Public Cloud,[object Object],SaaS,[object Object],End-User (Enterprise),[object Object],Service Provider,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-8-2048.jpg?cb=1668941657)
![Amazon Web Services™Customer Agreement,[object Object],7.2. Security. We strive to keep Your Content secure, but cannot guarantee that we will be successful at doing so, given the nature of the Internet. Accordingly, without limitation to Section 4.3 above and Section 11.5 below, you acknowledge that you bear sole responsibility for adequate security, protection and backup of Your Content and Applications. We strongly encourage you, where available and appropriate, to (a) use encryption technology to protect Your Content from unauthorized access, (b) routinely archive Your Content, and (c) keep your Applications or any software that you use or run with our Services current with the latest security patches or updates. We will have no liability to you for any unauthorized access or use, corruption, deletion, destruction or loss of any of Your Content or Applications.,[object Object],http://aws.amazon.com/agreement/#7 (3 March 2010),[object Object],The cloud customer has responsibility for security and needs to plan for protection. ,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-9-2048.jpg?cb=1668941657)
![The Evolving Datacentre,[object Object],Stage 1,[object Object],Consolidation,[object Object],Stage 2,[object Object],Expansion & Desktop,[object Object],Stage 3,[object Object],Private > Public Cloud,[object Object],Cost-efficiency ,[object Object],+ Quality of Service ,[object Object],+ Business Agility ,[object Object],Servers,[object Object],85%,[object Object],70%,[object Object],30%,[object Object],Virtualization Adoption Rate,[object Object],Desktops,[object Object],15%,[object Object],Datacentres are evolving to drive down costs and increase business flexibility,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-10-2048.jpg?cb=1668941657)
![Security Challenges in the Cloud ,[object Object],Stage 1,[object Object],Consolidation,[object Object],Stage 2,[object Object],Expansion & Desktop,[object Object],Stage 3,[object Object],Private > Public Cloud,[object Object],Cost-efficiency ,[object Object],+ Quality of Service ,[object Object],+ Business Agility ,[object Object],Servers,[object Object],85%,[object Object],70%,[object Object],30%,[object Object],Virtualization Adoption Rate,[object Object],Desktops,[object Object],Inter-VM attacksInstant-ON gapsMixed Trust Level VMsResource ContentionMaintaining ComplianceService Provider (in)SecurityMulti-tenancy,[object Object],15%,[object Object],Inter-VM attacksInstant-ON gapsMixed Trust Level VMsResource ContentionMaintaining Compliance,[object Object],Inter-VM attacksInstant-ON gaps,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-11-2048.jpg?cb=1668941657)
![The Enterprise Cloud Conundrum:The Cloud is Fantastic, but…,[object Object],How can I maintain control of my data in the cloud? ,[object Object],What if I want to change cloud vendors? How can I verify my data is “destroyed” when terminating a service provider?,[object Object],What happens if my service provider goes out of business? ,[object Object],How can I comply with security best practices, internal governance and compliance rules in the cloud? ,[object Object],How can I guarantee only I have access to my data? ,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-12-2048.jpg?cb=1668941657)
![Challenges for Public Cloud,[object Object],Multiple customers on one physical server – potential for attacks via the hypervisor,[object Object],Shared network inside the firewall,[object Object],Internet,[object Object],Shared Storage,[object Object],Shared Firewall,[object Object],Shared firewall – Lowest common denominator – less fine grained control,[object Object],Easily copied machine images – who else has your server?,[object Object],Shared storage – is customer segmentation secure against attack?,[object Object],Virtual Servers,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-13-2048.jpg?cb=1668941657)
![Data Security Challenges in the Cloud,[object Object],Encryption rarely used:,[object Object], - Who can see your information?,[object Object],Storage volumes and servers are mobile: ,[object Object], - Where is your data? Has it moved?,[object Object],Rogue servers might access data: ,[object Object], - Who is attaching to your storage?,[object Object],Audit and alerting modules lacking:,[object Object], - What happened when you weren’t looking? ,[object Object],Encryption keys tied to vendor:,[object Object],- Are you locked into a single security solution? ,[object Object], Who has access to your keys? ,[object Object],Storage volumes contain residual data:,[object Object], - Are your storage devices recycled securely?,[object Object],Name: John Doe,[object Object],SSN: 425-79-0053,[object Object],Visa #: 4456-8732…,[object Object],Name: John Doe,[object Object],SSN: 425-79-0053,[object Object],Visa #: 4456-8732…,[object Object],11,[object Object],Classification 2/7/2011,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-14-2048.jpg?cb=1668941657)
![Physical layer,[object Object],Could retool,[object Object],New Shared Storage systems,[object Object],Designed to segment multiple hostile tenants,[object Object],Dynamic firewall policies,[object Object],Different and flexible for every customer,[object Object],Strongly segmented networks,[object Object],Hardened switches that can’t be hacked from the inside,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-15-2048.jpg?cb=1668941657)
![The security arms race,[object Object],Existing infrastructure hits EOL too early,[object Object],Every customer wants to inspect and audit,[object Object],They have to for their compliance,[object Object],Always someone demanding the latest security feature,[object Object],More frequent swap out cycle,[object Object],Lower ROI,[object Object],Need permission from every customer to make a change,[object Object],Your kit has become part of their security audit,[object Object],You end up stuck in an impossible position where you make less money and still can’t keep the customers happy,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-16-2048.jpg?cb=1668941657)
![Logical Layer,[object Object],Customer has responsibility for their data,[object Object],Give them a solution to help them deliver on that,[object Object],Let them segment their data,[object Object],Away from other customers (may be the bad guy),[object Object],Away from you (don’t inherit a liability),[object Object],Look for something that runs on top of any hardware,[object Object],You run your own swap out programmes without interference,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-17-2048.jpg?cb=1668941657)
![Challenge of Securing Data,[object Object],Datacenter,[object Object],Public Cloud,[object Object],Perimeter,[object Object],Company 1,[object Object],Company 2,[object Object],Company 3,[object Object],Company 4,[object Object],Company 5,[object Object],Company n,[object Object],App 1,[object Object],App 2,[object Object],App 3,[object Object],…,[object Object],App 2,[object Object],App 1,[object Object],App 3,[object Object],App 4,[object Object],App 5,[object Object],App n,[object Object],Hypervisor,[object Object],Hypervisor,[object Object],Strong perimeter security,[object Object],No shared CPU,[object Object],No shared network,[object Object],No shared storage,[object Object],Weak perimeter security,[object Object],Shared CPU,[object Object],Shared network,[object Object],Shared storage,[object Object],Traditional “outside-in” approach is inadequate in an “inside-out” cloud world full of strangers,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-18-2048.jpg?cb=1668941657)
![Protection at the OS levelServer & application protection for:,[object Object],PHYSICAL,[object Object],VIRTUAL & PRIVATE CLOUD,[object Object],PUBLIC CLOUD ,[object Object],Deep Packet Inspection,[object Object],Firewall,[object Object],Integrity,[object Object],Monitoring,[object Object],Log,[object Object],Inspection,[object Object],Malware Protection,[object Object],IDS / IPS,[object Object],Web App.,[object Object],Protection,[object Object],Application,[object Object],Control,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-19-2048.jpg?cb=1668941657)
![Protection at the Data LevelEncryption designed to secure the cloud,[object Object],Cloud Service Provider,[object Object],Enterprise Datacenter or SaaS Offering,[object Object],VM,[object Object],CorporateApp,[object Object],Hypervisor,[object Object],Enterprise Key,[object Object],SharedStorage,[object Object],Cloud SecurityConsole,[object Object],MyEnterprise Data,[object Object]](https://image.slidesharecdn.com/rikferguson-110207050000-phpapp02/75/rik-ferguson-20-2048.jpg?cb=1668941657)
Rik Ferguson
•0 j'aime•425 vues
Signaler
Partager
Addressing the new security challenges posed by virtualisation & cloud computing - Rik Ferguson, Senior Security Advisor, Trend Micro
Recommandé
Contenu connexe
Tendances
Tendances(19)
En vedette
En vedette(9)
Similaire à Rik Ferguson
Similaire à Rik Ferguson(20)
Plus de CloudExpoEurope
Plus de CloudExpoEurope(18)
Dernier
Dernier(20)
Rik Ferguson
- 4. Location independent resource pooling
Notes de l'éditeur
- This is a depiction of a customer’s typical virtualization journey put together by Vmware.In stage 1, orgs have begun virtualization all of their low hanging fruit – web servers, file and print servers, some app servers, and begun to realize the hardware consolidation and operational mgmt benefits that result in lower CAPX and OPEX costs.In stage 2, they have begun virtualizing more of their tier 1 apps and mission critical servers now. They are also leveraging some of the more advanced capabilities of virtualization such as automatic live migration, disaster recovery and software fault tolerance. Many stage 2 orgs have also started deploying virtual desktops as well.Benefits in stage 2 are even more cost efficiencies plus also higher QoS from the higher level virtualization capabilities.In stage 3, organizations have started leveraging private and public clouds. The IT dept has transformed itself into acting as a service provider with charge-back type processes where consumers of IT are in effect renting computing space and time from IT. Benefits are further cost efficiencies, QoS and faster business agility.If we now look at security and how it impacts the virtualization journey:As organizations move to stage 1, they typically employ the same technologies and processes as they did in the virtual world. Forrester survey data showed that 88% of N.A. orgs did have a SPECIFIC virtualization security strategy in place. As they move to stage 2, security starts playing more of a dampening role.A CDW study showed that the majority of organizations that considered themselves fully deployed with virtualization had only virtualized a 3rd of their servers. When asked why they stopped virtualizing, security was the primary barrier. (Other barriers were ISV support, performance concerns etc.)As orgs considered their move to stage 3, security was top of mind – IDC survey data shows that it is the #1 issue why orgs will not move to the cloud.