The Cloud & I, The CISO challenges with Cloud Computing
•
2 j'aime•1,004 vues
The Cloud is a challenge for the Security professional, but also creates opportunities. In this presentation we will overview the different cloud challenges according to each market sector.
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
En vedette (12)
Similaire à The Cloud & I, The CISO challenges with Cloud Computing
Similaire à The Cloud & I, The CISO challenges with Cloud Computing (20)
Plus de Moshe Ferber
Plus de Moshe Ferber (6)
Dernier
Dernier (20)
The Cloud & I, The CISO challenges with Cloud Computing
- 1. The Cloud & I, CISO challenges with the cloud Moshe Ferber CCSK, CCSP When the winds of change blow, some people build walls and others build windmills. - Chinese Proverb
- 2. About myself Information security professional for over 20 years Founder, partner and investor at various cyber initiatives and startups Popular industry speaker & lecturer (DefCon, BlackHat, Infosec and more) Founding committee member for ISC2 CCSP certification. CCSK Certification lecturer for the Cloud Security Alliance. Member of the board at Macshava Tova – Narrowing societal gaps Chairman of the Board, Cloud Security Alliance, Israeli Chapter
- 3. So, what is cloud?
- 4. Cloud Computing What the CEO think about it?
- 5. Cloud Computing How the CFO see it?
- 6. Cloud Computing How the End-User feel regarding it?
- 7. Cloud Computing And how the CISO Feels about it?
- 8. Everyday Examples “Moving to cloud will expose our data to foreign government” “I got a virtualized servers, so I already in the cloud” “I don’t trust the vendors” “What about compliance?” “Our regulator forbid us from moving to the cloud” “Cloud lacks the visibility we need” “We use hosting, so we are already in the cloud.” “We will loose control over our assets” “And What about the NSA…?” “Cloud services are not mature enough”
- 9. AgilityAgility What do you say… And how the CISO understand it
- 10. ScalabilityScalability What do you say… And how the CISO understand it
- 11. ComplianceCompliance What do you say… And how the CISO understand it
- 12. ManageabilityManageability What do you say… And how the CISO understand it
- 13. ReliabilityReliability What do you say… And how the CISO understand it
- 14. Multi tenancyMulti tenancy What do you say… And how the CISO understand it
- 15. And of course, you can not avoid the big question… Who is more secured? Cloud or on premise?
- 16. Can we define what is more secure? > <=
- 17. Can we define which cloud service? Cloud provider A Cloud provider B
- 18. Does it really matter?
- 19. Cloud Services are very different in nature SaaS PaaS IaaS Private Hybrid Public
- 20. The shared responsibility model Physical Security Network & Data Center Security Hypervisors Security Virtual Machines & OS security Data layer & development platform Application Identity Management DATA Audit & Monitoring IaaS PaaS SaaS Consumer responsibility Provider responsibility
- 21. So, bottom line, is cloud security improving?
- 22. Providers are doing more to increase trust
- 23. Improvement with security standards & compliance
- 24. Security automation is improving, specially in IaaS/PaaS
- 25. Monitoring & auditing are improving
- 26. Legal eco-system is getting complicated Technical complexity Legal complexity
- 27. Configuration is still open by default, very easy to make mistakes Legal complexity
- 28. Increased chances for cloud provider lock-in Legal complexity
- 29. Government snooping is increasing Legal complexity
- 30. Cloud Focused (Heavy use) Cloud Adopters (running apps in the cloud) Cloud Curious (First projects) Cloud Avoider (Private Cloud adapters) National Infrastructure Cloud challenges varies depending on the market sector Startups Energy SMB Hi Tech Government Health Military Telecom providers Homeland & Military industries Utility Retail Banks Financial Services Industry
- 31. The Challenge: Private cloud still got the same attack vectors! Cloud Attack Vectors Provider Administration Management Console Multi tenancy & Virtualization Automation & API Chain of supply Side Channel Attack Insecure Instances Cloud Avoiders Cloud Curious Cloud Adopters Cloud Focused
- 32. The Challenge: Build your Cloud strategy Cloud Curious Cloud Avoiders Cloud Adopters Cloud Focused
- 33. The challenge: Understand the share responsibility model Cloud Curious Cloud Avoiders Cloud Adopters Cloud Focused
- 34. The Challenge: Evaluating the providers Cloud Adopters Cloud Avoiders Cloud Curious Cloud Focused
- 35. Copyright © 2015 Cloud Security Alliance Industry Standards used by Major Cloud Providers ISO/IEC 27018:2014 Cloud Adopters Cloud Avoiders Cloud Curious Cloud Focused
- 36. The Challenge: Look for those abundant applications that can benefit from cloud computing Cloud Adopters Cloud Avoiders Cloud Curious Cloud Focused Public Cloud Integrity Availability On premise Confidentiality
- 37. Telecom Providers The Challenge: Building cloud services Transparency Certifications Security operations Cloud Adopters Cloud Avoiders Cloud Curious Cloud Focused
- 38. The Challenge: managing multiple cloud applications Governance Encryption Identity management Availability Cloud Focused Cloud Avoiders Cloud Curious Cloud Adopters DLP
- 39. Startups The Challenge: Integrating security into your software lifecycle & operations Monitoring Static & Dynamic Analysis Multi Tenancy DEVOPS Cloud Focused Cloud Avoiders Cloud Curious Cloud Adopters
- 40. To wrap Things Up… Join CSA Israel Facebook & LinkedIn Forums in order to stay updated regarding latest technologies and community meetups. Don’t let security hold you down
- 41. To wrap Things Up… Join CSA Israel Facebook & LinkedIn Forums in order to stay updated regarding latest technologies and community meetups. Use the right tools
- 42. To wrap Things Up… Perform responsible cloud adoption!
- 43. KEEP IN TOUCH Cloud Security Course Schedule can be find at: http://www.onlinecloudsec.com/course-schedule
- 44. Questions?
Notes de l'éditeur
- The cloud providers AWS and Azure provide a number of compliance certifications. These certifications save time and resources if customers can rely on 3rd party audits by the bodies awarding these certifications (due diligence should be carried out where required). This is not an exhaustive list..There may be more. CCM has been adopted by both Amazon and Microsoft for their IaaS and PaaS services. Microsoft have it for some of their SaaS products such as Office 365 and CRM Dynamics as mentioned earlier. Source https://aws.amazon.com/compliance/ https://azure.microsoft.com/en-us/support/trust-center/compliance/