Leveraging the potential of Cloud security SLAs Dr. Jesus Luna Garcia Cloud Security Alliance (Europe)

Agenda Cloud Security SLAs (secSLAs) Good-enough security through secSLAs SecSLA automation Summary

How do you choose a Cloud Service Provider (CSP)? Service-related: Performance Price Reputation What about security (and privacy)?

Cloud Service Level Agreements A cloud SLA is a documented agreement between the cloud service provider (CSP) and cloud service customer that identifies services and associated quality levels (i.e., cloud service level objectives or SLOs). Security specification in cloud SLAs (secSLAs) aims to provide useful/measurable (security) information to Customers. Despite their advocated advantages, most cloud SLAs/secSLAs are offered on a “take it, or leave it” manner. How Cloud customers can benefit from Cloud secSLAs?

Good-enough Cloud security through secSLAs “[…] everything should be made as secure as necessary, but not securer.” Sandhu, 2003 Realizing adequate levels of IT security is typically related to risk management activities. Preliminary research based on Cloud-Adapted Risk Management Framework (CRMF, draft NIST SP 800-173).

Cloud secSLA 1-Impact analysis 2-Elicit security requirements 3-Select Cloud arch. 4-Assess available CSPs 5-Select CSP and negotiate secSLA 6-Monitor CSP and own controls Cloud secSLA Baseline & tailored SLOs SecSLA agreed CSP specific and own SLO’s

Risk Assessment Cloud secSLA 1-Impact analysis Step 1 – Impact analysis. Step 2 – Risk assessment. 1-Impact analysis 2-Elicit security requirements 3-Select Cloud arch. 4-Assess available CSPs 5-Select CSP and negotiate secSLA 6-Monitor CSP and own controls Cloud secSLA Baseline & tailored SLOs SecSLA agreed CSP specific and own SLO’s

Cloud secSLA Risk Treatment 1-Impact analysis 2-Elicit security requirements 3-Select Cloud arch. 4-Assess available CSPs 5-Select CSP and negotiate secSLA 6-Monitor CSP and own controls Cloud secSLA Baseline & tailored SLOs SecSLA agreed Risk Treatment Step 3 – Select the Cloud architecture. Step 4 – Assess CSP options. Negotiate additional security controls with CSP. Identify security controls under the consumer’s responsibility. CSP specific and own SLO’s

Risk Control Cloud secSLA 1-Impact analysis 2-Elicit security requirements 3-Select Cloud arch. 4-Assess available CSPs 5-Select CSP and negotiate secSLA 6-Monitor CSP and own controls Risk Control Step 5 – Select CSP. Draft a SLA. Step 6 – Monitor the CSP (secSLA) and customer-side controls. Cloud secSLA Baseline & tailored SLOs SecSLA agreed CSP specific and own SLO’s

Interested on this topic? “Leveraging the Potential of Cloud Security Service Level Agreements through Standards” Jesus Luna, Neeraj Suri, Michaela Iorga, Anil Karmel IEEE Cloud Computing, 2015

Automating good-enough Cloud secSLAs (putting all the secSLA pieces together)

European Project SPECS CeRICT, Italy (coordinator) TUD, Germany IeAT, Romania CSA, United Kingdom XLAB, Slovenia EISI, Ireland FP7-ICT-10-610795 Project Start: 1/11/2013 Project Type: STREP Duration: 30 Months

SPECS SecaaS based on secSLAs Provisions security services to Customers Manages the secSLA life cycle (negotiation, monitoring and enforcement) Ongoing integration into products like EMC’s ViPR.

Leveraging and contributing to standards

Machine-readable (XML) secSLA specification

It’s showtime! SPECS Demo

Summary: Are we there yet? Standards (vocabularies, metrics, …), and best practices (making Cloud SLAs usable for SMEs). ISO/IEC 19086 Parts 1-4 Cloud secSLAs in supply chains/multi-cloud systems. Certifications or SLA’s or both?

Questions? Give us your opinion about secSLAs: https://www.surveymonkey.com/r/SPECS_SLA Help us secure Cloud computing: http://www.cloudsecurityalliance.org jluna@cloudsecurityalliance.org SPECS: http://www.specs-project.eu/

(Some) Cloud barriers The lack of transparency of some CSPs or brokers Lack of clarity in contracts Cloud security not easy to understand for SME’s