Riding the Cloud Storm – Responding to Cloud Risks David Rawle Technical Director

First things first Thanks to Dave and Ian

A little about Bytes SP and myself Security Partnerships acquired by Bytes in 2011 I started working for Security Partnerships in January 2000 as their first Technical Resource As a Consultant I have designed and delivered multi-million pound solutions for household names As a Manager I developed the technical team and professional services within Security Partnerships As one of two Directors of Bytes Security Partnerships I have helped to grow the business by a further 50% in 2 years

I am very proud of our business and what and how it does things

So now you know what the cloud is how does it apply to Information Security?

“Information security, sometimes shortened to InfoSec, is the practice of defending information from unauthorised access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. It is a general term that can be used regardless of the form the data may take” -Wikipedia : September 2013

One more reason why cloud is a good idea…

Why cloud? For every server room that looks like this…

Why cloud? There is one that looks like this…

Information Security in the cloud is just as important as “on-premise” Different challenges Same key requirements You can’t just say “it’s the provider’s problem”

Which vendors cloud technology?

So what does Cloud mean to us?

What are we trying to achieve? This?

What are we trying to achieve? This?

What are we trying to achieve? This?

What are we trying to achieve The reality is its all of them…

The Cloud in the modern workplace Dave has talked about how people are working Ian has talked about all the different things that The Cloud can be

IT Security Evolved

The first phase of change From this Traditional Firewall Office Based Users

All solutions focussed on protecting users from the Internet

The first phase of change To this Next Gen Firewall Users anywhere on any device

Solutions focussed on protecting users from the Internet and providing access to internal systems from different devices in different locations

Where are we headed? And on to this…

The key pillars of Cloud Security Deterrent Controls - These controls are set in place to prevent any purposeful attack on a cloud system. Much like a warning sign on a fence or a property, these controls do not reduce the actual vulnerability of a system. Preventative Controls - These controls upgrade the strength of the system by managing the vulnerabilities. The preventative control will safeguard vulnerabilities of the system. If an attack were to occur, the preventative controls are in place to cover the attack and reduce the damage and violation to the system's security. Corrective Controls - Corrective controls are used to reduce the effect of an attack. Unlike the preventative controls, the corrective controls take action as an attack is occurring. Detective Controls - Detective controls are used to detect any attacks that may be occurring to the system. In the event of an attack, the detective control will signal the preventative or corrective controls to address the issue.

Cloud Security – The same but different The challenges are the same – Secure storage of data that trusted people need to be able to access – Provision of applications that people can work with effectively – Proof that the systems are secure and managed in the right way

Security challenges Who is accessing your data? What are they accessing? When are the accessing it?

Other challenges Cloud is not 100% guaranteed to be available? Your infrastructure as backup for the cloud? How do you deploy a “hybrid” cloud environment? How do you make it appear as one?

Other challenges How do you control devices that are out of the office? Not just Phones and Tablets? How do you make your data available anywhere from any device seamlessly

How can our Vendors help you? Best of breed firewall technology Common rule base on:- – Premises based appliances – VMWare based virtual appliances – Cloud based virtual appliances – Protect from DOS attacks on-premise Consolidated policies, logging and reporting for all deployments

How can our Vendors help you? Best of breed application delivery and security for both Cloud and Premises based deployments

How can our Vendors help you? Best of breed mobile device management and mobile application deployment Purpose built to enable the mobile enterprise Not just about Tablets and Phones

How can our Vendors help you? Providing secure, available cloud storage for s and files Giving users a valid corporate alternative to Dropbox, Google Drive etc

Summary The IT Security Challenges don’t go away, they just move IT Security has become a business enabler rather than a business preventer It is moving into the cloud space hand in hand with the functionality that is available