1. Cloud Security Alliance Research & Roadmap June 2012
Presenter Name

2. About the Cloud Security Alliance
Global, not-for-profit organization
Over 35,678 individual members, 123 corporate members, 20 affiliate members, 64 chapters worldwide
Building best practices and a trusted cloud ecosystem
Agile philosophy, rapid development of applied research
GRC: Balance compliance with risk management
Reference models: build using existing standards
Identity: a key foundation of a functioning cloud economy
Champion interoperability
Enable innovation
Advocacy of prudent public policy
“To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.” 2

3. About the Cloud Security Alliance
Developed first comprehensive best practices for secure cloud computing, Security Guidance for Critical Areas of Focus for Cloud Computing (updated October 2011)
First and only user certification for cloud security, the CCSK (Certificate of Cloud Security Knowledge, September 2010)
Tools for managing Governance, Risk and Compliance in the Cloud
Registry of cloud provider security practices, the CSA STAR (Security, Trust & Assurance Registry, Q4 2011)
Industry leading security practices, education and tools developed by 30+ working groups
Selection of CSA venue by US White House to announce the US Federal Cloud Strategy in 2011
Leadership in developing new security standards addressing cloud computing
Trusted advisor to governments and Global 2000 firms around the world
“To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.” 3

4. RESEARCH 4

5. Global Research Footprint
Global resource and research coverage through our corporate membership, affiliate members, chapters and
Connected to great minds: Research contributors represent some of the top minds in information security and cloud computing
Copyright © 2011 Cloud Security Alliance
Copyright © 2012 Cloud Security Alliance

6. CSA Guidance V3 Popular best practices for securing cloud computing
Flagship research project
V 3.0 Released (November 2011)
In alignment with international standards
The CSA Guidance is our flagship research that provides a broad catalog of best practices. It contains 13 domains to address both broad governance and specific operational issues. This Guidance is used as a foundation for the other research projects in the following slides that relate to compliance.
> 100k downloads: cloudsecurityalliance.org/guidance 6

7. Private, Community & Public Clouds
CSA GRC Stack
Family of 4 research projects
Cloud Controls Matrix
Consensus Assessments Initiative
Cloud Audit
Cloud Trust Protocol
Tools for governance, risk and compliance management
Control
Requirements
Provider
Assertions
Private, Community & Public Clouds

8. Cloud Controls Matrix Tool
Controls derived from guidance
Mapped to familiar frameworks: ISO 27001, COBIT, PCI, HIPAA, FISMA, FedRAMP, etc.
Rated as applicable to S-P-I
Customer vs. Provider role
Help bridge the “cloud gap” for IT & IT auditors

9. Consensus Assessment Initiative
Research tools and processes to perform shared assessments of cloud providers
Integrated with Controls Matrix
Version 1 CAI Questionnaire released Oct 2010, approximately 140 provider questions to identify presence of security controls or practices
Use to assess cloud providers today, procurement negotiation, contract inclusion, quantify SLAs

10. CloudAudit Open standard and API to automate provider audit assertions
Change audit from data gathering to data analysis
Necessary to provide audit & assurance at the scale demanded by cloud providers
Uses Cloud Controls Matrix as controls namespace
Use to instrument cloud for continuous controls monitoring

11. Cloud Trust Protocol (CTP)
Developed by CSC, transferred to CSA
Open standard and API to verify control assertions
“Question and Answer” asynchronous protocol, leverages SCAP (Secure Content Automation Protocol)
Integrates with Cloud Audit
Now we have all the components for continuous controls monitoring

12. CSA STAR Registry CSA STAR (Security, Trust and Assurance Registry)
Public Registry of Cloud Provider self assessments
Based on Consensus Assessments Initiative Questionnaire
Provider may substitute documented Cloud Controls Matrix compliance
Voluntary industry action promoting transparency
Free market competition to provide quality assessments
Provider may elect to provide assessments from third parties
Available October 2011

13. Trusted Cloud Initiative
To Promote Education, Research and Certification of Secure and Interoperable Identity
Comprehensive Cloud Security Reference Architecture
Assemble reference architectures with existing standards

14. TCI Reference Model Structure – 7 Domains
TCI Reference Architecture

15. Security as a Service Information Security Industry Re-invented
Define Security as a Service (SecaaS)
Identify Ten Categories within SecaaS
Develop Domain 14 within CSA Guidance V3
Implementation Guidance for each SecaaS Category
Align with international standards and other CSA research 15

16. Data Governance Project
To identify the current state of public cloud provider maturity identified in CSA Guidance research
Cloud Data Governance Maturity Survey of current Cloud Provider practices in the market (e.g. backup, encryption, secure deletion, etc.)
Structure based on Domain 5: Information Lifecycle Management
Re-define Data Life Cycle Model
Identify Key Concerns for Stakeholders
Data Governance in Emerging Technologies in the Cloud 16

17. CloudCERT Consensus research for emergency response in Cloud
Enhance community’s ability to respond to incidents
Standardized processes
Supplemental best practices for CERTs
Hosted Community of Cloud CERTs
Being spun out into a separate, related entity

18. Telecom Working Group Industry a key stakeholder in future of cloud
CSA’s liaison to ITU-T
5 Telecom Initiatives
Telecom and the GRC Stack
ISO Interviews to CSP’s
SIEM
Compliance Monitoring
Cloud Forensics and Legal

19. Top Threats
Provide needed context to assist organizations in making educated risk management decisions regarding their cloud adoption strategies
V.2 of Top Threats Report released in July 2012
“Top Threats” document will be updated regularly to reflect expert consensus on the probable threats which customers should be concerned about.
p-threats

20. Mobile
Securing application stores and other public entities deploying software to mobile devices
Analysis of mobile security capabilities and features of key mobile operating systems
Cloud-based management, provisioning, policy, and data management of mobile devices to achieve security objectives
Guidelines for the mobile device security framework and mobile cloud architectures
Solutions for resolving multiple usage roles related to BYOD, e.g. personal and business use of a common device

21. Mobile (Part 2)
Scalable authentication from mobile devices to multiple, heterogeneous cloud providers
Best practices for secure mobile application development
Identification of primary risks related to individually owned devices accessing organizational systems (commonly known as BYOD – Bring Your Own Device)

22. Big Data
Identifying scalable techniques for data-centric security and privacy problems
Lead to crystallization of best practices for security and privacy in big data
Help industry and government on adoption of best practices
Establish liaisons with other organizations in order to coordinate the development of big data security and privacy standards
Accelerate the adoption of novel research aimed to address security and privacy issues

23. HIM Working Group
Provide direct influence on how health information service providers deliver secure cloud solutions (services, transport, applications and storage) to their clients, and foster cloud awareness within all aspects of healthcare and related industries
2 Health Initiatives
HIPAA and HiTech Best Practices
Healthcare Recommendations Guidance to V.3

24. CSA and ISACA Joint Cloud Maturity Project
The Cloud Security Alliance (CSA) and ISACA announced the availability of a new survey on cloud market maturity, part of the first collaborative project between the two organizations
The survey will be open to the public through June 1, and can be found here: dMarketSurvey 24

25. CSA Basecamp
The CSA Projects will begin migrating to the "new" Basecamp found at the following URL: This site will give you access to all of your CSA projects on the new Basecamp and the pre-existing projects found in the renamed "Basecamp Classic".  The 37Signals Launchpad will help you navigate to both Basecamp sites if you are participating in multiple CSA Working Groups.

26. How do you get involved?
Learn how you can participate in Cloud Security Alliance's goals to promote the use of best practices for providing security assurance within Cloud Computing

27. Submit Your Research Ideas
New Research Ideas
Submit Your Research Ideas
Do you have an idea for a research project on a cloud security topic? If so, please take the time to describe your concept. Ideas are monitored by the CSA research team, who will review your proposal and respond to you with feedback.
the Submit Ideas tab

28. Contribute to the CSA library
The Cloud Security Alliance is a community non-profit which is driven by its members. Have a white paper or information on a cloud security product you want to contribute?
educational-material/

29. GLOBAL CHAPTERS 29

30. Chapters Around the World
50 chapters and growing
Every continent except Antarctica
Translating guidance
Adapting research to local needs
Creating their own research projects 30

31. TRAINING & CERTIFICATION 31

32. Certificate of Cloud Security Knowledge (CCSK)
Benchmark of cloud security competency
Measures mastery of CSA guidance and ENISA cloud risks whitepaper
Understand cloud issues
Look for the CCSKs at cloud providers, consulting partners
Online web-based examination

33. Training Courses CCSK Basic CCSK Plus GRC Stack Training
One day course to enable student to pass CCSK
CCSK Plus
Two day course includes practical cloud lab work
GRC Stack Training
One day course to use GRC Stack components
PCI/DSS In the Cloud
Achieving PCI compliance in cloud computing

34. CONFERENCES & EVENTS 34

35. CSA Events Re-visit the SecureCloud 2012
Presentations from select speakers will be available soon at:

36. CSA Events
Re-visit the inaugural CSA “Building Trust in Cloud Computing” Summit 2012 hosted by the CSA Hong Kong & Macau Chapter held on May 17, 2012 at Hong Kong’s Cyberport.

37. CSA Events September 25-26, 2012 Amsterdam, Netherlands
For more information visit:

38. CSA Events CSA Congress USA Workshops November 7,8, 9
Venue: Hilton Disney World Resort
To register and for more information visit:

39. Contact Help Us Secure Cloud Computing www.cloudsecurityalliance.org
LinkedIn:
Do visit the website
Do join the LinkedIn Groups – you will receive regular updates 39

40. THANK YOU