Преимущества, которые несут в себе облачная и виртуальная инфраструктура очевидны. Также очевидны и дополнительные риски. На семинаре будут обсуждаться следующие вопросы: какие проблемы связаны с обеспечением ИБ инфраструктур виртуализации; что перевешивает, экономика или безопасность; в чем ограничения средств защиты для виртуальных инфраструктур; взлом облака и взлом из облака.

1. Head in the Clouds…Can we overcome security fears for cloud computing? 19 May 2011 www.pwc.com

3. Scalability

6. Increased agility and ability to ‘try new technologies’

7. Access to up to date technologies without investment

8. Less wastage through underutilized hardware (PCs and Servers) and outdated software

9. «Built-in redundancy»This is why it will happen 2

11. Data loss or leakage

12. Fraud

13. Regulatory constraints

14. Theft of confidential information or intellectual property

15. Data privacy

17. We can’t protect everything

18. Is ‘our security’ that much better – security is not our ‘core business’It all comes down to ‘trust’ 3

20. Security is used as a key ‘differentiator’

21. Significant investments in security have been made by all the ‘top-tier’ vendors

23. Intrusion Detection

24. Vulnerability assessments

25. Anti DDOS

26. Web Application Firewalls and virtual firewalls

27. Splitting of encrypted data across various systemsVendors have the budgets and the technology to do it 4

29. Accounting

30. CRM

31. Email

33. Mission critical data

34. Medical data or highly regulated data (like personal data)

35. Intellectual property

36. Card processingBut people will still want to leverage the technology 5

38. Due diligence on vendor (ownership, financial health, legal status)

39. Full scope review of access management, policies, patch management, incident management, etc

40. Certification and third party audits

41. ISO27001

42. SAS 70

43. Contractual agreements

44. Data rights and ownership

45. Availability, reliability and resilience

46. Recourses for security and availability

47. Service levels and performance

48. Decomissioning and destruction of data

49. Incident response

50. Regulatory compliance requirementsWe need to verify, we need a trust mechanism 6

52. Update incident management to deal with the cloud

53. Understand where there are gaps with cloud vendor and implement compensating controls

54. Defining clearly requirements for encryption, data segregation, user access

55. Ensure vendor can meet our internal risk management requirements

56. Consider scalability

57. Understand cost structure and get comfort on the security and integrity of billing/cost systems

58. Obtain results of security and scalability tests (e.g. Pentests, stress tests)

59. Above all, people will still pose the biggest threat!We don’t absolve ourselves of our responsibilities 7

61. Risks need to be balanced with rewards (as they are today when services are managed in-house)

62. Cloud vendors have a vested interest in providing secure services – their entire business model hangs on their reputation

63. Not every application will go to the cloud

64. Due diligence and assessment of the vendor is vital

65. Get 3rd party reports/assessments for the vendor

66. We are still responsible for our information and need to maintain control of access to it

67. Use a trusted partner to help in intial vendor selection

68. Remember assessment is an ongoing process

69. Moving non-core information and services to the cloud may allow the CISO to focus resources on protecting higher value information within the organization.8 Right Service + Right Vendor + Due Diligence + Contracting + Ongoing Monitoring = Success

70. Focus on the risks and compliance will follow... This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, [insert legal name of the PwC firm], its members, employees and agents do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it. © 2010 ZAO PricewaterhouseCoopers Audit. All rights reserved. In this document, “PwC” refers to ZAO PricewaterhouseCoopers Audit which is a member firm of PricewaterhouseCoopers International Limited, each member firm of which is a separate legal entity. Christopher Gould Director +7 (495) 967 6000 Christopher.Gould@ru.pwc.com