This document discusses cloud security and incident response. It outlines the traditional approach to incident response, and how this must change in the cloud where data is distributed across different jurisdictions and vendors. It stresses the importance of establishing clear roles and responsibilities between an organization and its cloud service provider, including agreeing on policies, procedures, access to logs and tools for incident response. It also recommends establishing relationships and practicing incident response plans with cloud providers.

1. Helping You Piece IT Together
http://www.bhconsulting.ie info@bhconsulting.ie
Incident Response
&
Cloud Security

2. Who Am I?
Brian.honan@bhconsulting.ie
www.bhconsulting.ie
www.twitter.com/brianhonan
www.bhconsulting.ie/securitywatch

3. Business View of The Cloud

4. Vendor View of the Cloud

5. Security View of the Cloud
5

6. Stuff Happens !!

7. Traditional Incident Response
Detect
Contain
Eradicate
Remediate
Recover
Review
Communicate

8. Traditional IR

9. Cloud Incident Response

10. How Do You Contain Cloud?

11. Where is Your Data?

12. Data Protection & Privacy

13. Change of Mindset

14. Change of Mindset

15. Same IR Principles
Detect
Contain
Eradicate
Remediate
Recover
Review
Communicate

16. Engage Early with Business

17. Ensure IR Requirements in T&Cs

18. Establish Team
Information
Security
Operations
Human
Resources
Legal
Public
Relations
Facilities
Management
CSP

19. Establish Relationships

20. Agree Roles &
Responsibilities

21. Agree Policies & Procedures

22. Agree Jurisdictional Issues

23. Agree Disclosure Rules

24. Notification in Place

25. Set up Alerting Mechanisms

26. Access to Logs

27. Other Alerting Mechanisms

28. Identify Tools

29. Practise Makes Perfect

30. Agree Testing

31. Review & Measure

32. Questions To CSP
 Will the CSP Give You Access to Log Files,
Including RAW Data?
 What Is the CSP’s SLA?
 Are Security Demarcations Clearly Understood?
 What Are the CSP preventative measures?
 DDOS Mitigation
 Security Monitoring,
 Alert You of Breach
 IR Plan

33. Questions ?
@brianhonan