Security on the Move & In the Clouds DISASTER RECOVERY PRACTICES IN CLOUD COMPUTING ENVIRONMENTS Dr. David A. Abarca, CISSP As an organization migrates it data and applications from local resources to cloud-based solutions, modifications to traditional disaster recovery measures will help translate current practices to prepare for perceived threats associated with this new technology. Two principle elements of information security are the requirement for data integrity and assurance of availability. The cloud computing environment adds new challenges to information security. Information security questions arise when new technologies are introduced to established processes. With the introduction of cloud computing, common questions asked by security professionals are: Where IS the data? How is the data managed? How is the data protected? What assures the integrity of the data backups? What assurance that the cloud has operational integrity? These questions lead to understanding that new threats must be addressed in the disaster preparation process. This presentation will introduce and discuss:(1) the threat vectors associated with the cloud computing environment; (2) the threats that may effect the cloud’s resources; and (3) questions that disaster recovery teams may consider for cloud computing that may have been previously overlooked or were not applicable in a local-resource computing environment.

Introduction Disaster Recovery Cloud Services Security in the Cloud Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary Disaster Recovery DRP Versus BCP DR Issues Threats Cloud Services Where is this cloud? What does it do? Security in the Cloud Impact on Data Centers DR Planning Questions

Disaster Recovery Disaster Disaster Recovery Any event that interrupts normal business operations in such a way as to have a significant impact on the reputation, financial health, or customer relationships of an organization. Disaster Recovery The processes associated with returning an organization’s functional status to “normal operations” as they were prior to the disaster event. Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary

Disaster Recovery Disaster Recovery VS Business Continuity Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary Disaster Recovery VS Business Continuity Disaster Recovery Business Processes Restored Disaster Event Normal Operations Normal Operations Business Continuity Business Continuity The processes required for a business to continue limited functionality until the time at which “normal operations” are restored.

Disaster Recovery Risk Management Avoid the threat Reduce the threat or mitigate its impact Assign the risk of the threat to a third party Accept the risk presented by the threat Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary

Local Facility Threats Physical Location Threat Vectors Power Water External and Internal Threats Nature Technological Obsolescence Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary

Cloud Services Question # 1 Question #2 Questions #3 What is the Cloud? Question #2 Where is the Cloud? Questions #3 Is the Cloud safe? Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary

Security in the Cloud Physical Security Access Control Data Integrity Local and Remote Locations Access Control Preventing unauthorized access Data Integrity Local backups as a safeguard? Availability Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary

Cloud Threats Cloud Threat Vectors Power X 2 Water X 2 External and Internal Threats X 2 Nature X2 Technological Obsolescence X2 Connectivity X2 Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary

Impact of the Cloud on Current Data Centers Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary Competing for budget dollars Technological obsolescence Application Maintenance Legislative requirements

Compelling Questions Where IS our data? What are the threats to that(those) location(s)? Does a need still exits to have local backups? Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary

Compelling Questions How does the need for a warm or cold site impact the disaster preparation process? Does the current datacenter transition to become a “lights out” warm site? What about hardware and application maintenance? Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary

Compelling Questions Do we still need a physical warm/hot site? What is the impact on productivity if the connectivity to the cloud is interrupted? Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary

? Your Questions Introduction Disaster Recovery Threats Cloud Services Security in the Cloud Impact on Data Centers Compelling Questions Summary ?