Sikkerhet i skyen v/ Ole Tom Seierstad, Chief Security Adviser, Microsoft Norge

SIKKERHET I SKYEN
Ole Tom Seierstad
Chief Security Advisor
Microsoft Norge AS
oles@microsoft.com

Hva er cloud?
Komplette IT løsninger kan kjøres på én sentral tjener og at de tilgjengeliggjøres via internett på en rekke ulike enheter. Dette er hva vi kaller “Cloud Computing”.

Cloud computing er en del avløsnigen
Skybaserte løsninger gir IT-ressurser, som en tjeneste, på en dynamisk og skalerbar måte over et nettverk.
Fem viktige egenskaper
Tjenestertilgjenglig for selvbetjening
God tilgangtilnettet
Delingavressurser (Resource pool)
Raskemuligheter for endringer
Målingavresultater
CLOUD
Web
Client-Server
Mainframe
4

Web Apps

Tilbakemeldingerfrabrukere
Reduserekostnader
ØkteffektivitetogGrønn IT
Øktkundeog partner kontaktsamtbedrekundeopplevelse
6

Trender - FLEKSIBILITET

Trender - Fleksibilitet

Trender – Nye måter å arbeide på – regelverk

Kriminellefra “Cool...”

Til “Cash”

Tilpassningavnettverket

Tilpassning av nettverket

Sikkerhet er en nødvendighet

ULIKE implementeringer for CLOUD Computing
Flytt hele løsningen til skyen
Kjør deler av programmvaren i skyen
Lagring av data i skyen
Lag nye løsninger ved å kombinere ulke
Cloud Services
Utvikle helt nye skybaserte løsninger

Ulike modeller – fra Offentlig til private skyløsninger
Pålokaleservere
Privat sky
Offentlig sky
Tilgjenglighetpåulikeenheter

Informasjon er under leverandørens kontroll
Ikkebegrensetavgeografiogplassering
Endringer i IT prosesser
Leverandøren kan ha bedre sikkerhets prosesser og rutiner
Fysisk sikkerhet vil bli administrert av sky-leverandøren
Utfordringer med juridisksuverenitet
Sentralisert lagring av data
Økonomisk skalerbarhet
Attraktiv for kriminelle
Personvern utfordringer
Forensics/etterforskning
Muligheter og utfordringer

Vurderinger av sikkerhet i SKYEN

Compliance is still the duty of the Customer
Sound Risk Management encompassing the Cloud is needed
Collaboration between Customer and Provider is essential
Need of a certain level of Process Transparency
Strong Internal Team needed
Contract Negotiation
Definition of Controls and Metrics
Integration of Controls into own processes
Compliance and Risk Management
Compliance requirements can be fulfilled by a skilled internal team and a certain level of process transparency by the cloud provider(s).

Cross-Domain Collaboration requires secure identities
People and Devices
Based on In-Person Proofing or similar
Claims-Based
Based on interoperable standards
Privacy vs. Authentication has to be balanced
Processes have to be able to include several providers
Identity and Access Management
Any digital identity system for the cloud has to be interoperable across different organisations and cloud providers and based on strong processes.

Service Engineering and Development
Strong and Transparent Engineering Processes Needed
Requirements
Design
Implementation
Verification
Release
Response
Proofed
Based on Threat Models or similar
Service Integrity
The provider should follow a clear, defined, and provable process to integrate security and privacy in the service from the beginning and for the whole lifecycle.

Service Delivery
Internal processes have to be able to cover multiple provider
Security Monitoring
Auditing
Forensics
Incident response
Business Continuity
Etc.
Requirements depend on application and information needs
Service Integrity
The service delivery capabilities of the provider and the security management and auditing needs of the customer must be aligned.

Is part of the delivery chain
Often subject to social engineering attacks (and similar)
Review today’s processes and policies
Endpoint Integrity
It is very important to include the end point in any security consideration for cloud-based services.

Data Classification is the foundation
Requirements
Legal Needs
Persistent Data Protection needed
Encryption/Rights Management
Has to cover the whole transaction
Data in transit
«New» Challenges
Data Sovereignty
Access to Information
Data Partitioning and Processing
Information Protection
Implemented Data Classification helps to decide which data is ready for the cloud, under which circumstances, and with which controls.

Well-Functioning Risk and Compliance Programs are a must
Data classification is the base
Choose the right Deployment Model (Private, Community, or Public)
Strong, cloud trained, Internal Team still needed
Process Transparency, Compliance Controls, and Auditability by the Provider
Implement a Secure Development Lifecycle and evaluate the Provider and their vendors as well
Stronger federated identity and access controls
Information Lifecycle Controls
Access controls to operate across organisational boundaries without surrendering identity ownership
Recommendations

© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Sikkerhet i skyen v/ Ole Tom Seierstad, Chief Security Adviser, Microsoft Norge

by IKT-Norge on Apr 25, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

2 Embeds 105

Statistics

Sikkerhet i skyen v/ Ole Tom Seierstad, Chief Security Adviser, Microsoft Norge — Presentation Transcript

http://sikkerhetsdagen.no	101
http://www.slideshare.net	4