Cloud services security Prof. Manel Medina Head of Unit CERT Operations support ENISA

o The European Network and Information Security Agency o gives advice on information security issues o to national authorities, EU institutions, citizens, businesses o acts as a forum for sharing good NIS practices o facilitates information exchange and collaboration o Set up in 2004 – EC proposed a new mandate for New mandate pending of Council and Parliament approval. o Around 35 security experts and 25 supporting staff. o ENISA has an advisory role (not operational) and the focus is on prevention and preparedness. About ENISA 2

Information Security Risks 3 information security risks time

Part of the solution 4 Cloud computing Smartphones and apps Social media

5 The Shining Cloud

6 o 2009 Cloud computing risk assessment o 2009 Cloud security control framework o 2011 Security and resilience for gov clouds o 2011 Security parameters in gov cloud SLAs o 2011 EU Cloud strategy o 2012 Procure secure o 2012 Critical clouds ENISA’s cloud security work

Leverage

Resilience 8

9 Security will drive adoption of cloud computing

Trust

11 Security and assurance standards

12 Penetration tests

13 Backup/failover tests

14 Data portability tests

From periodic certification to continuous monitoring 15 Cloud security; if you can’t measure it, you can’t manage it

o Work started as an ENISA/OASIS/CSA workshop o Guide for customers on monitoring security parameters of cloud services o Checklist with questions to ask o 8 security parameters o What and How to measure. Independence? o When to rise a flag? Responsible (Customer/Provider)? o Examples of security parameters o Service availability o Incident response o Vulnerability management Procure secure 16

1.Service availability: monitoring, thresholds 2.Incident response: Severity classification, management capabilities 3.Service elasticity and load tolerance: burst tests, who? 4.Data life-cycle management: back-up frequency & integrity 5.Technical compliance and Vulnerability management: Configuration, patches, vulnerability discovery & reporting, 3 rd party 6.Change management: Notification, critical periods, loss of certification status 7.Data isolation: categories of data, independent test? 8.Log management and forensics: frequency, granularity, availability, cross checking Procure secure: security parameters 17

Dr. Marnix Dekker Prof. Manel Medina About securely moving to smartphones and cloud computing Security parameters in Cloud SLAs security/test/procure-secure-a-guide-to-monitoring-of- security-service-levels-in-cloud-contracts security/test/procure-secure-a-guide-to-monitoring-of- security-service-levels-in-cloud-contracts Contact 18