Cloud security and security architecture

Presentation that I gave at ISC2 SecureLondon conference in London on 11th December 2012.

1. Security architecture and Cloud computing, are these mutually exclusive ? ( Introduction to Cloud Security Guidance) Vladimir Jirasek Director of Research, CSA UK 11 December 2012

2. Agenda Cloud risk assessment x compared to traditional risk assessments Cloud security architectures x compared to security architectures CSA domains

3. Cloud risk assessment

4. Cloud model Public Private Hybrid Community Software as a Service ( SaaS ) Platform as a Service ( SaaS ) Infrastructure as a Service ( SaaS ) Broad network access Rapid elasticity Measured service On-demand service Resource pooling

5. Cloud computing deployment models Infrastructure managed by Infrastructure owned by Infrastructure located Accessible and consumed by Public Third party provider Third party provider Off-premise Untrusted Private/ Community or Organisation Organisation On-premise Trusted 3 rd party provider 3 rd party provider Off-Premise Hybrid Both Organisation & Third party provider Both Organisation & Third party provider Both On-Premise & Off-Premise Trusted & Untrusted

6. Cloud model maps to Security model Cloud model Physical security Network security Host security Application sec. Data security SIEM Identity, Access Cryptography Business continuity GRC Direct map

7. Responsibilities for areas in security model compared to delivery models Physical security Network security Host security Application sec. Data security SIEM Identity, Access Cryptography Business continuity GRC Provider responsible Customer responsible IaaS P aaS SaaS IaaS P aaS SaaS

8. Cloud Security Domains Governance Governance and Enterprise Risk Management Legal Issues: Contracts and Electronic Discovery Compliance and Audit Information Management and Data Security Portability and Interoperability Operational Traditional Security, Business Continuity and Disaster Recovery Data Center Operations Incident Response, Notification and Remediation Application Security Encryption and Key Management Identity and Access Management Virtualization Security as a Service

9. Cloud Security Alliance supports number of projects related to cloud Get involved at https :// cloudsecurityalliance.org /research/

10. How to manage cloud security Have a cloud security standard What to do on an Enterprise level Before your Cloud project During your Cloud project BAU Exit from the Cloud provider Risks cannot be outsourced Manage lock-in and exit up-front – especially in SaaS How to drive out the 'seven deadly sins' of cloud computing - new Information Security Forum report

11. Contact Help us secure cloud computing – Get involved http:// cloudsecurityalliance.org.uk [email protected] LinkedIn: http ://www.linkedin.com/groups/Cloud-Security-Alliance-UK-Chapter- 3745837 Twitter: @ CSAUKResearch

12. Thank you!