1. Prepared for [xxxx] – Commercial in Confidence connect transform protect A Cloudy Cyberspace? Tony Roadknight – Technical Architect

2. Moving Services Into the Cloud What are the models? What are the security issues? What needs to be changed?

3. The NIST Definition of Cloud Computing V15 Cloud computing displays a number of attributes: On-demand self-service Broad network access Resource pooling Rapid elasticity Measured service Can be delivered in the following deployment models: Public cloud Private cloud Community cloud Hybrid cloud Supports the following service models: Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS) http://csrc.nist.gov/groups/SNS/cloud-computing/cloud-def-v15.doc

4. Cloud Computing Services - SPI Framework Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS)

5. Consider a Communication Service

6. In House Deployment Security App used to protect connection Guards what information is released Cleans any information that is received Depending upon trust of network the Security App may: Sign data (Integrity) Encrypt data (Confidentiality)

7. Infrastructure as a Service (IaaS) Deployment Can apply existing model using existing applications Security applied between Service App and the Cloud » Guards what information is released » Cleans any information that is received However Availability now relies upon the Cloud fabric

8. Platform as a Service (PaaS) Deployment Can no longer intercept all communication paths Security must be embedded within Service App » Guards what information is released » Cleans any information that is received Application migration to PaaS Services API

9. Software as a Service (SaaS) Deployment Security must be applied before information released to SaaS Guards what information is released to SaaS Cleans any information that is received from SaaS

10. Cloud and Trust

11. Summary Existing services can be deployed within IaaS Cloud Services Move to PaaS and SaaS requires: Application changes Possible accreditation challenges Acceptance of changing trust model Fully integrated Cloud Computing solution requires: Cloud technology extensions Revised accreditation model Key threat changes: Scale Multi-tenancy Actors