Presentation is loading. Please wait.

Presentation is loading. Please wait.

Ensure Cloud Security in IaaS and PaaS Environments

Similar presentations


Presentation on theme: "Ensure Cloud Security in IaaS and PaaS Environments"— Presentation transcript:

1 Ensure Cloud Security in IaaS and PaaS Environments
Keep your information security risks manageable when leveraging the benefits of cloud computing. Info-Tech's products and services combine actionable insight and relevant advice with ready-to-use tools and templates that cover the full spectrum of IT concerns.© Info-Tech Research Group

2 Table of contents Introduction Section 1: Make the Case
Section 2: Determine Your Hosted Cloud Risk Profile Section 3: Determine Your Security Control Requirements Section 4: Evaluate Vendors From a Security Perspective Section 5: Implement Your Hosted Security Controls Section 6: Build an IaaS/PaaS Security Governance Program

3 Our Understanding of the Problem
CISOs Security Directors and Managers Project Managers Identify the cloud-hosted risk profile and security control gaps that must be covered. Ensure the organization’s hosted environment is secured and protected from data leaks and breaches. Ensure maintaining privacy of data and other information. Leverage the security capabilities from cloud- hosted vendors. Vendor Management Security Architects Business Managers Factor security’s needs into the contract with a cloud service provider (CSP). Address security’s needs in the project plan for configuration of the software and for supporting technology. Put an ongoing program in place to manage the cloud service providers and monitor security controls.

4 Executive Summary Hosted cloud environments, such as infrastructure as a service (IaaS) or platform as a service (PaaS), offer major IT and business benefits that organizations are looking to realize. An organization has decided to migrate some part of its IT operations to a hosted cloud environment to realize any number of benefits. Security Perception The cloud can be secure although unique security threats and vulnerabilities cast concerns to consumers. Balancing Act Securing an IaaS or PaaS environment is a balancing act of determining whether the vendor or the consumer is responsible for meeting specific security requirements. Structured CSP Selection Process Most security challenges and concerns can be minimized through our structured process (CAGI) of selecting the trusted CSP partner. Security remains a large impediment to realizing cloud benefits. Numerous concerns still exist around the ability for data privacy, confidentiality, and integrity to be maintained in a cloud environment. Even if adoption is agreed upon, it becomes hard to evaluate vendors that have strong security offerings and even harder to utilize security controls that are internally deployed in the cloud environment. The business is adopting a hosted cloud environment and it must be secured, which includes: Ensuring business data cannot be leaked or stolen. Maintaining privacy of data and other information. Securing the network connection points. Determine your balancing act between yourself and your CSP; through contractual and configuration requirements, determine what security requirements your CSP can meet and cover the rest through internal deployment. This blueprint and associated tools are scalable for all types of organizations within various industry sectors.

5 How to use this blueprint
Do-It-Yourself Best-Practice Toolkit Onsite Workshops Free Guided Implementation Do-It-Yourself Implementation Use this Best-Practice Blueprint to help you complete your project. The slides in this Blueprint will walk you step-by-step through every phase of your project with supporting tools and templates ready for you to use. You can also use this Best-Practice Blueprint to facilitate your own project accelerator workshop within your organization using the workshop slides and facilitation instructions provided in the Appendix. We recommend that you supplement the Best-Practice Toolkit with a Guided Implementation. Guided Implementations are included in most advisory membership seats. Our expert analysts will provide telephone assistance to you and your team at key project milestones to review your materials, answer your questions, and explain our methodology. Info-Tech Research Group’s expert analysts will come onsite to help you work through our project methodology in a 2-5 day project accelerator workshop. We take you through every phase of the project and ensure that you have a road map in place to complete your project successfully. In some cases, we can even complete the project while we are onsite. Leverage each of the tools in this blueprint to complete the optimization of this project. Enroll in a GI for your project. Or call and ask for the GI Coordinator. Book your workshop now! to get started.

6 Info-Tech is ready to assist. Book a free guided implementation today!
Book a Guided Implementation Today: Info-Tech is just a phone call away and can assist you with your project. Our expert Analysts can guide you to successful project completion. For most members, this service is available at no additional cost.* Here are the suggested Guided Implementation points in the Cloud Security in IaaS and PaaS Environments project: Section 2: Determine your hosted cloud risk profile Info-Tech will work with you to identify your organization’s specific risk profile of hosted cloud environments. Various factors will be evaluated and the final result will be discussed. Section 3: Determine your security control requirements Info-Tech will work with you to determine what security control requirements the organization will need based on its risk profile. Discuss and identify what control requirements should be met by the vendor or by your organization. Section 5: Implement your hosted security controls Info-Tech will work with you to implement identified security controls by providing in-depth implementation steps for each security control. Section 6: Build an IaaS/PaaS security governance program Info-Tech will work with you to develop processes so your organization can maintain and measure their cloud environment security. *Guided Implementations are included in most advisory membership seats.

7 Conduct a workshop, with us or on your own
Onsite Workshops offer an easy way to accelerate your project. If you are unable to complete this project on your own and a Guided Implementation is not enough, we offer low-cost deliveries of each Blueprint. Our expert analysts will come onsite to help you work through our project methodology over the course of 2-5 days. We step through each phase of your project and ensure that you have a road map in place to realize success. In some cases, we can even help you to complete the project while we are onsite. 1. Enroll in a 2-5 day workshop for your project Send an to or call Ext Your account manager will contact you and quote you the cost of the workshop. 2. Book your workshop A Workshop Coordinator will contact you to book a workshop planning call with one of our facilitators and arrange dates for your workshop. We can hold the workshop in Info-Tech’s world-class facility in Toronto or at your location. 3. Participate in your workshop Our experienced workshop facilitators will take your project team through your tailored slides and exercises and will summarize all the workshop outputs into a final report.

8 Two-Day Summary – Workshop Overview
Schedule Name Goal List of Deliverables Day 1 Morning Make the case Provide strong rationale as to why your organization needs to secure your IaaS or PaaS. Discuss Info-Tech’s methodology to deal with cloud security challenges. Realized importance of securing hosted cloud environment through vendor and internal security controls as recommended by Info-Tech Determine your hosted cloud risk profile Identify the member’s specific risk profile of their off-premise hosted cloud environment. Discuss numerous variables that are all customized by the member that determines a risk profile for the member. Determined what the organizational risk profile is for adopting IaaS/PaaS IaaS/PaaS Risk Profile Day 1 Afternoon Determine your security control requirements – CA Determine what security control requirements the organization will need based on its risk profile. Discuss the responsibilities between your organization and the CSP regarding completeness and auditability. IaaS and PaaS Cloud Security CAGI Tool Determine your security control requirements – GI Discuss the responsibilities between your organization and the CSP regarding governability and interoperability.

9 Two-Day Summary – Workshop Overview
Schedule Name Goal List of Deliverables Day 2 Morning Evaluate your cloud vendors Evaluate vendors’ ability to meet the internal control requirements as well as their ability to meet vendor-specific control requirements. SLA document Identified vendors that can meet the necessary security control requirements Implement your security controls Build action plan/roadmap on how to secure their cloud environment. Implement the action plan. Action roadmap Controls discussed and implemented Day 2 Afternoon Implement your security controls – Continued Build a governance program To develop processes so the member can maintain and measure their cloud environment security. Ongoing vendor governance. Ongoing internally-deployed security control governance. Governance document

10 Make the case Make the case Current cloud risks and fears.
Determine your hosted risk profile Determine your security requirements Evaluate vendors Implement your security controls Build a security governance program Current cloud risks and fears. Differences in security frameworks for different cloud environments. Cloud benefits and trends. Changing CIO and security leader roles. Info-Tech cloud security framework and thought model.

11 Determine your hosted cloud risk profile
Determine the risks and review the benefits of securing your hosted environment to make the case 1 2 3 4 5 6 Make the Case Determine your hosted cloud risk profile Determine your security control requirements Evaluate your vendors from a security perspective Implement your hosted cloud security controls Build a Cloud Security Governance Program 1.1 Current major risks and fears around cloud environments 1.2 The cloud is a reality in today’s computing world and offers many different benefits 1.3 IaaS and PaaS environments can be secured the same way but SaaS is much different 1.4 The roles and responsibilities of CIOs and security leaders are changing due to cloud migration 1.5 Use Info-Tech’s unique cloud security framework and thought model to secure your hosted environments Immediate outcomes of this step Key benefits After completing this activity you will have: Understanding of the major risks and fears around cloud computing. A base understanding of the differing security techniques for different cloud environments. Communication points for cloud adoption. Awareness of how CIO and security leaders are changing with the advent of the cloud. These activities will enable you to: Communicate your cloud understanding and rationale. Express different cloud security models.

12 Info-Tech Research Group Helps IT Professionals To:
Quickly get up to speed with new technologies Make the right technology purchasing decisions – fast Deliver critical IT projects, on time and within budget Manage business expectations Justify IT spending and prove the value of IT Train IT staff and effectively manage an IT department Sign up for free trial membership to get practical solutions for your IT challenges “Info-Tech helps me to be proactive instead of reactive – a cardinal rule in a stable and leading edge IT environment. - ARCS Commercial Mortgage Co., LP Toll Free:


Download ppt "Ensure Cloud Security in IaaS and PaaS Environments"

Similar presentations


Ads by Google