Introduction to Cloud Security

Cloud has changed the way we use computing and can yield significant economic, collaborative and efficiency benefits. But with this increased adoption, at both the personal & business level, comes increased exposure to potential risks, threats and attacks. This talk will introduce the fundamentals of cloud security, how cloud service and deployment models influence security, and practices that we can all undertake for threat and risk protection.

1. SusanneTedrick
1
Introductionto
CloudSecurity

2. Agenda
WhyCloud?
SecurityImplicationsofCloudServiceandDeploymentModels
CloudSecurityRisksandThreats(A Sampler)
WhatisCloudSecurity?
NIST Cybersecurity Framework
Additional Resources

3. WhyCloud?
Scalability Payasyougo Resourcesharing
Collaboration/
mobility
Competitiveness

4. WhatAboutCloudSecurity?

5. TheSharedResponsibility ofCloudSecurity
On-Premises
Infrastructureasa
Service (IaaS)
Platformasa
Service
(PaaS)
Softwareasa
Service
(SaaS)
UserAccess UserAccess UserAccess UserAccess
Data Data Data Data
Applications Applications Applications Applications
OperatingSystem OperatingSystem OperatingSystem OperatingSystem
NetworkTraffic NetworkTraffic NetworkTraffic NetworkTraffic
Hypervisor Hypervisor Hypervisor Hypervisor
Infrastructure Infrastructure Infrastructure Infrastructure
Physical Physical Physical Physical
White–CustomerResponsibility Shaded–CloudProviderResponsibility

6. CloudDeploymentsModels
Hybrid Private
Cloud security
responsibility
completely
owned byclient
Shared cloud
security
responsibility
betweenclientand
cloudprovider
Cloud security
retained by cloud
provider;no
client control
Public

7. MulticloudLackofVisibility
MostUSbasedenterprisesareusingatleasttwopubliccloudproviders.Thisapproach
addsevenmoresecuritycomplexity.
Source:Cisco

8. DataLeakage
Dataisnolongerunder
your control
Loss ofconfidentiality
DataLoss
DataDamage
Acorrectcopyofthe
data is no longer
available
Compromiseofintegrity
oravailability

9. MalwareInjections
The attacker attempts to inject an
implementationofamaliciousservice
orvirtualmachineintothecloud.
Source:F5

10. DistributedDenialofService
(DDoS)
These types of attacks cause the
availabilityofdataorservicestogo
down because of an overload of
traffictotheserver.
Source:F5

11. InsecureApplication
Programming Interfaces(APIs)
APIsbecomeanopendoorwaytoanapplicationorcloudplatform-itiscriticalthat
they aresecured.
Source:F5

12. Containerization
With the wide adoption of
container-based applications,
systemsbecamemorecomplex
andsecurityrisksincreased.
Source:Devopedia

13. WhatIsCloudSecurity?
CLOUD
Policies,proceduresandtoolsusedtoprotectdata,
applicationsandnetworksincloudenvironments.

14. KeyQuestions
RESPONSIBILITY FORTIFICATION CONTROLS
What is my
responsibility?
HowdoIsecure
my cloud
environment
?
Whatsecurity
controlswork
best?

15. NISTCybersecurity
Framework
Establishedin2014
Maingoals:
■Helpmanagecyberrisks
■Providea“commonlanguage”for
discussingcyberrisks
■Help create and assess and
improvecybersecurity
programs
16

16. NISTCybersecurity
Framework
■Assetidentification
■Useridentification
■Dataidentificationand
governance
17

17. NISTCybersecurity
Framework
■Datasecurity
■Applicationsecurity
■Networksecurity
18

18. NISTCybersecurity
Framework
■Logging
■Continuous
monitoring
■Detectionprocesses
19

19. NISTCybersecurity
Framework
■Developandmaintain
responseplaybooks
■Addresscomplianceand
privacy notification
regulations
■Eliminatetechnologysilos
■Automatesecurityincident
investigations
20

20. NISTCybersecurity
Framework
■Backupandrestore
■Disasterrecovery
■Improvementsand
communication
■Remediation
21

21. Best Practices
•Research Your Cloud Service Provider’s Security Program
•Read Your Cloud Services Provider’s Terms of Use
•Utilize NIST’s Cybersecurity Framework
•Prevent, detect and respond to cyberattacks -nist.gov/cyberframework
•Utilize NIST’s Guidelines on Security and Privacy in Public Cloud
Computing
•nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-144.pdf

22. AdditionalResources
■NISTCybersecurityFramework
nist.gov/cyberframework
■NISTGuidelinesonSecurityandPrivacyinPublicCloudComputing
nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-144.pdf
■CloudSecurityAlliance
cloudsecurityalliance.org
■(ISC)
2
2020 CloudSecurityReport
isc2.org/resource-center/reports/2020-cloud- security-report

23. Thank
You!