1. Cloud Security Challenges Today and Tomorrow Aloysius Cheang Asia Pacific Strategy Advisor April 2011

2. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Cloud: Dawn of a New Age Art Coviello - the most overhyped, underestimated phenomenon since the Internet Compute as a utility Changes everything: business models, venture capital, R&D, ……

3. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance What is Cloud Computing? Compute as a utility: third major era of computing Cloud enabled by Moore’s Law Hyperconnectivity SOA Provider scale Key characteristics Elastic & on-demand Multi-tenancy Metered service

4. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance 4 2010-2013: the Hybrid Enterprise enterprise boundary public clouds Extended Virtual Data Center private clouds cloud of users Notional organizational boundary Dispersal of applications Dispersal of data Dispersal of users Dispersal of endpoint devices

5. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Cloud & mobility forcing key issues Critical mass of separation between data owners and data processors Anonymity of geography of data centers & devices Anonymity of provider Transient provider relationships Physical controls must be replaced by virtual controls Identity management has a key role to play Cloud WILL drive change in the security status quo Reset button for security ecosystem

6. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Key Cloud Security Problems of Today From CSA Top Threats Research: Trust: Lack of Provider transparency, impacts Governance, Risk Management, Compliance Data: Leakage, Loss or Storage in unfriendly geography Insecure Cloud software Malicious use of Cloud services Account/Service Hijacking Malicious Insiders Cloud-specific attacks

7. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Key Problems of Tomorrow Globally compatible legislation and policy Compatible Private & Public clouds Real-time Risk Mgt & Compliance Identity Management Responding to security incidents

8. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance About the Cloud Security Alliance Global, not-for-profit organization Over 16,500 individual members, 90 corporate members Building best practices and a trusted cloud ecosystem Agile philosophy, rapid development of applied research GRC: Balance compliance with risk management Reference models: build using existing standards Identity: a key foundation of a functioning cloud economy Champion interoperability Advocacy of prudent public policy “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.”

9. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Helpful research from CSA

10. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance CSA Guidance Research Guidance > 100k downloads: cloudsecurityalliance.org/guidancecloudsecurityalliance.org/guidance Governance and Enterprise Risk Management Legal and Electronic Discovery Compliance and Audit Information Lifecycle Management Portability and Interoperability Security, Bus. Cont,, and Disaster Recovery Data Center Operations Incident Response, Notification, Remediation Application Security Encryption and Key Management Identity and Access Management Virtualization Cloud Architecture Operating in the Cloud Governing the Cloud Popular best practices for securing cloud computing Popular best practices for securing cloud computing V2.1 released 12/2009 V2.1 released 12/2009 V3 target Q3 2011 V3 target Q3 2011 wiki.cloudsecurityalliance.org/guidance wiki.cloudsecurityalliance.org/guidance

11. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Securing the Cloud - Governance Best opportunity to secure cloud engagement is before procurement – contracts, SLAs, architecture Know provider’s third parties, BCM/DR, financial viability, employee vetting Identify data location when possible Plan for provider termination & return of assets Preserve right to audit Reinvest provider cost savings into due diligence

12. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Securing the Cloud - Operating Encrypt data when possible, segregate key mgt from cloud provider Adapt secure software development lifecycle Understand provider’s patching, provisioning, protection Logging, data exfiltration, granular customer segregation Hardened VM images Assess provider IdM integration, e.g. SAML, OpenID

13. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Cloud Controls Matrix Tool Controls derived from guidance Rated as applicable to S-P-I Customer vs Provider role Mapped to ISO 27001, COBIT, PCI, HIPAA Help bridge the gap for IT & IT auditors

14. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Consensus Assessment Initiative Research tools and processes to perform shared assessments of cloud providers Lightweight “common criteria” concept Integrated with Controls Matrix Ver 1 CAI Questionnaire released Oct 2010, approx 140 provider questions to identify presence of security controls or practices

15. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance CloudAudit Open standard and API to automate provider audit assertions Change audit from data gathering to data analysis Necessary to provide audit & assurance at the scale demanded by cloud providers Uses Cloud Controls Matrix as controls namespace Now a CSA project! www.cloudaudit.orgwww.cloudaudit.org

16. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance CSA GRC Stack Suite of tools, best practices and enabling technology Consolidate industry research & simplify GRC in the cloud For cloud providers, enterprises, solution providers and audit/compliance Controls Framework, Questionnaire and Continuous Controls Monitoring Automation www.cloudsecurityalliance.org/grcstack Control Requirements Provider Assertions Private & Public Clouds

17. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance CCSK – Certificate of Cloud Security Knowledge Only user certification for cloud security Web-based test for competency in CSA guidance $295 USD price www.cloudsecurityalliance.org/certifyme Training courses are available now!

18. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance o Courseware complete for CCSK Basic (1 day) and CCSK Plus (2 day) - creating schedule In the pipeline -PCI in the Cloud -For QSAs and Merchants IT Staff -1 Day course (beta course hosted by Silicon Valley chapter) -Courseware to be completed by late May CCSK – Latest Updates

19. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Trusted Cloud Initiative Comprehensive Cloud Security Reference Architecture Secure & interoperable Identity in the cloud Getting SaaS, PaaS to be “Relying Parties” for corporate directories Scalable federation Outline responsibilities for Identity Providers Assemble reference architectures with existing standards Identity Mgt best practices whitepaper: http://www.cloudsecurityalliance.org/guidance/csaguide-dom12-v2.10.pdf http://www.cloudsecurityalliance.org/guidance/csaguide-dom12-v2.10.pdf

20. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance o Consensus research for emergency response in Cloud Enhance community’s ability to respond to incidents Standardized processes Supplemental best practices for SIRTs Hosted Community of Cloud SIRT https://cloudsecurityalliance.org/cloudsi rt.htmlhttps://cloudsecurityalliance.org/cloudsi rt.html Cloud SIRT

21. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance The need for the Security as a Service Initiative Information assurance challenged by disruptive trends (cloud, mobility, social networking, etc) Cloud provides opportunity to rethink security (economics, architecture, service delivery models, etc) “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.”

22. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Security as a Service Scope Information Security Industry Re-invented Define Security as a Service Articulate solution categories within Security as a Service Guidance for adoption of Security as a Service Align with other CSA research Develop deliverables as a proposed 14 th domain within CSA Guidance version 3.

23. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance o InfoSecurity Europe - April 19th -21st, 2011 - Earl’s Court, London UK - Free Registration – Visit: www.infosec.co.uk CSA Summit on April 21st, 2011 - Full agenda and registration for the event will be posted on the CSA website and on LinkedIn Upcoming Events

24. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance o Call for Papers - Abstract Submission Deadline: April 4th, 2011 - Curriculum sessions plan to date are posted on the CSA website: https://cloudsecurityalliance.org/csac2011.html - Additional information can be found at: http://www.misti.com/cloud Upcoming Events

25. www.cloudsecurityalliance.org Copyright © 2011 Cloud Security Alliance Contact Asia Pacific Leader - Aloysius Cheang (acheang@cloudsecurityalliance.org)acheang@cloudsecurityalliance.org Chapters in Asia Pacific - Japan - Greater China (Beijing, Shanghai, Guangzhou, Hong Kong) - India (Mumbai, Chennai, Bangalore, Hyderabad) - Singapore - Indonesia info@cloudsecurityalliance.org LinkedIn: www.linkedin.com/groups?gid=1864210www.linkedin.com/groups?gid=1864210 Twitter: @cloudsa

26. www.cloudsecurityalliance.org Thank you!