CONTENTS BACKGROUND CLOUD MODELS SECURITY CONSIDERATIONS MANAGING RISK

01 | BACKGROUND

PONDURANCE SECURITY CONTINUITY COMPLIANCE THREAT HUNTING AND RESPONSE Penetration Testing, Application Security Testing, Forensics CONTINUITY BCP/DRP, vCISO, Risk Management, Vendor Management COMPLIANCE PCI QSA, HITRUST, All the acronyms THREAT HUNTING AND RESPONSE Network, Log, Host – Closed Loop Incident Response

DUSTIN HUTCHISON PARTNER AT PONDURANCE TEACHING RESEARCH FOCUS Operations and Delivery (EST/AST, Continuity and Compliance, SOC) Responsibility TEACHING Sullivan University, Embry-Riddle Aeronautical University, and Ivy Tech RESEARCH FOCUS Cloud computing (Dissertation: Factors affecting the adoption of cloud computing in healthcare) ALPHABET SOUP CISSP, CISA, CRISC, CCSFP, GCIH, PCI QSA

CONCLUSION (SNEAK PEAK) Your ”Cloud” providers should be addressed in your general risk management strategy with a repeatable process (and reviewed periodically). (I know, sounds simple, but how do we put this process in place?)

02 | CLOUD MODELS

CLOUD CONTEXT Confidentiality, Integrity, and Availability (CIA) Defense in Depth Cloud Current State vs Future State Responsibility

POLICIES, PROCEDURES, AND AWARENESS CLOUD MODELS DEFENSE IN DEPTH POLICIES, PROCEDURES, AND AWARENESS PHYSICAL PERIMETER INTERNAL NETWORK HOST APPLICATION DATA

CLOUDS IN DEPTH

CURRENT STATE vs FUTURE STATE (NIST SP800-145) Service Models Software as a Service (SaaS) - Top Google Apps, Salesforce, Microsoft Office 365 Platform as a Service (PaaS) - Middle Google App Engine, AWS Elastic Beanstalk Infrastructure as a Service (IaaS) - Bottom AWS, Azure Deployment Models Private Cloud Community Cloud Public Cloud Hybrid Cloud

RESPONSIBILITY Reference: https://blogs.msdn.microsoft.com/azuresecurity/2016/04/18/what-does-shared-responsibility-in-the-cloud-mean/

FOG COMPUTING (not kidding, NIST SP500-325) Focus on Internet of Things (IoT) devices Name may shift (fog computing, mist computing, cloudlets, or edge computing)

03 | SECURITY CONSIDERATIONS

REASONS FOR ADOPTION Image source: https://www.cisco.com/c/en/us/products/security/security-images-acr2018.html

12 TOP CLOUD SECURITY THREATS? CSO Online article top threats list: Data breaches Insufficient identity, credential, and access management Insecure interfaces and application programming interfaces System vulnerabilities Account hijacking Malicious insiders Advanced persistent threats Data loss Insufficient due diligence Abuse and nefarious use of cloud services Denial of service Shared technology vulnerabilities …This list doesn’t feel specific to cloud providers.

NOTABLE BREACHES 1. Microsoft (2010) 2. Dropbox (2012) 3. National Electoral Institute of Mexico (2016) 4. LinkedIn (2012) 5. Home Depot (2014) 6. Apple iCloud (2014) 7. Yahoo (2013) Microsoft – minor, but early – 2 hour issue, MS configuration exposed non-authorized users to see employee contact info Dropbox – 68 million user passwords – 93 million voter registration records compromised 6 million user passwords Point of sale terminals – 56 million credit card numbers Icloud hack – celebrity photos One billion user accounts

A. SECURITY (through trusted on-prem platforms (or obscurity)?) Reference: ftp://public.dhe.ibm.com/software/os/systemz/pdf/HPINTEGRITYVSSYSTEMZ10ES.pdf

B. SECURITY (through compliance?) GLBA Designate responsible party Identify applications hosting or transacting customer information Assess risks to customer information Design, monitor and test assessment program Hold service providers to same standards Continue to evaluate and adjust programs PCI DSS Protect cardholder data Manage vulnerabilities Provide strong access controls Monitor and test Maintain policies

C. SECURITY (through framework alignment?)

D. All OF THE ABOVE Yes, this one. Probably.

04 | MANAGING RISK

HOW? Vendor Management Risk Assessment MANAGING RISK HOW? Vendor Management Risk Assessment Risk Remediation / Risk Acceptance Continued Monitoring

VENDOR MANAGEMENT PROCESS Business Need Justification Vendor Identification Data Gathering Vendor Questionnaire Contract Review (Legal) Risk Assessment Assesssment* Remediation / Acceptance Legal Review Contract Risk Review Operational Integration Resource Planning Framework Steps (CMDB, DR/BCP, Monitoring, etc.) Continuous Monitoring SaaS vs PaaS vs IaaS VMP, IR, etc.

RISK ASSESSMENT Is a third party risk assessment or CSA CCM report good enough? Is HITRUST or SOC2 good enough? What is your internal process? Consultant response: It depends, but your due diligence is important

RISK TREATMENT Accept Avoid Mitigate Share Transfer

GAME TIME Data breaches Insufficient identity, credential, and access management Insecure interfaces and application programming interfaces System vulnerabilities Account hijacking Malicious insiders Advanced persistent threats Data loss Insufficient due diligence Abuse and nefarious use of cloud services Denial of service Shared technology vulnerabilities

QUESTIONS? THANK YOU. CLOUD COMPUTING