• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
The Cloud Beckons, But is it Safe?
 

The Cloud Beckons, But is it Safe?

on

  • 301 views

 

Statistics

Views

Total Views
301
Views on SlideShare
301
Embed Views
0

Actions

Likes
0
Downloads
2
Comments
0

0 Embeds 0

No embeds

Accessibility

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment
  • Those were examples that illustrate that the Internet itself is a dangerous place. Yet who would give up their Internet connection?
  • If you shop and bank online, and share personal info via social media, you already use the cloud. You probably trust your bank and online merchants like Amazon because you believe they have the capability and the incentive to protect your information. You probably also realize that “free” social media vendors make money by selling information about you.
  • Here are some vulnerabilities that apply to all systems connected to the Internet, including systems in the cloud.Reputable cloud vendors significant resources and teams of computer and security specialists devoted to maintaining the security of the data they handle. They can be far better positioned to protect your data than you are.
  • People target systems for attack when that they know have valuable information, like account numbers, social security numbers and the like. Things that nonprofits don’t typically have.Hackers after fame are more likely to attack big ACME Bancorp, International, than a community food bank’s systems.This means your risk of attack is lower than that of some big company, but it doesn’t mean you’re safe.
  • Cyber crime is often the computer equivalent of trying front doors until you find an unlocked house. IMPORTANT: Payment information SHOULD NOT be stored on your systems. If you have donor’s credit card data for recurring payments, move to a reputable payment processing vendor. Then delete this information. Thieves can’t steal data that you don’t have.
  • People target systems for attack when that they know have valuable information, like account numbers, social security numbers and the like. Things that nonprofits don’t typically have.Hackers after fame are more likely to attack big ACME Bancorp, International, than a community food bank’s systems.This means your risk of attack is lower than that of some big company, but it doesn’t mean you’re safe.
  • Reputable cloud vendors significant resources and teams of computer and security specialists devoted to maintaining the security of the data they handle. They can be far better positioned to protect your data than you are.
  • If you have no full time IT and your server lives in a broom closet, your data is not likely secure.
  • Information security boils down to these three areas, plus privacy.
  • You know whether there is integrety. Like going in to change your salary because everyone has access, no accountablity. No universal login
  • One of the most common. DNS attack. Systems are reliable.
  • If you avoid automobiles, you’ll never be in a car accident. But you won’t get very far, either.Avoiding the Internet will cut your information security risk, but your productivity will be set back a few decades.There are ways to maximize information security, but you can’t entirely eliminate risk.
  • This kind of “discovery” exercise is important. You may find that the data you think you have differs from what you actually. Maybe you have sensitive data that you’re not aware of. Secret Service level security might not be warranted, but its nice to know what protection is appropriate.How old is your server? Is it near the end of its life? What would you do if it crashed tomorrow?Can someone just walk up to your server? Do they need to log in? Is the admin password “letmein”?
  • Don’t keep financial information related to donors on your system. Thieves can’t steal data you don’t have, and there’s no reason for you to take on the risk of handling such sensitive information. Better to outsource to a payment vendor who can guarantee the security of this information.
  • Might the exposure of donor data hurt your ability to raise money in the future? What if that “anonymous” major donor was outted?What would be the financial impact if you couldn’t access key systems (wasted staff hours, missed fundraising opportunities, etc)?
  • Might the exposure of donor data hurt your ability to raise money in the future? What if that “anonymous” major donor was outted?What would be the financial impact if you couldn’t access key systems (wasted staff hours, missed fundraising opportunities, etc)?
  • If data and systems are in house, what are you doing to protect them? Could a cloud vendor do a better job than you can?Systems penetration – reverse engineer passwords, social engineering, known vulnerabilitiesinformation handling/protection procedures? Policies for changing passwords, what you do with old users
  • The greater the depth of security measures, the longer a potential attacker will be delayed. This is important
  • Computer intrusion detection and prevention systems alert you to possible systems breaches and try to thwart them. Look for abnormal patterns. Prevention – alerting someone. More harm than good for small orgs – so many false postives. Data center has “intrusion guy”Firewalls attempt to block entry to your systems by malicious people and information. Let’s in an out things in a circuit. HTTP is generally open, but there are rules to help with attacksAnti-virus software helps prevent malware from installing on your systems, and attempts to clean exisiting infections.
  • Websites use security certificates to encrypt data while in transit *and* verify to you that the URL belongs to the organization you think it belongs to. FTP or secure FTP. PGP. VPN= encrypted tunnel between two trusted partners.https rather than http indicates that the site you’re using has a certificate and is encrypting the data you send. Newer browser allow you to click on icon near the URL (a picture of a lock in the case of Chrome) to show information on the encryption used and the site’s owner.
  • Stolen data is of little use if it’s encryptedUnderstand what is recoverable from backups, and how. Disaster recovery backups do not necessarily mean that you’ll be able to restore data you accidentally overwrite.Business continuity/disaster recovery
  • Designed to protect private health related data, but HIPAA compliance can speak well of how other sensitive data is handled.
  • Designed to protect private health related data, but HIPAA compliance can speak well of how other sensitive data is handled.
  • Designed to protect private health related data, but HIPAA compliance can speak well of how other sensitive data is handled.
  • These audits are performed by CPA firms and verify that a vendor has procedures in place that allow it to meet standards for handling sensitive data and for meeting regulatory requirements like HIPAA.SSAE16 is the newer audit standard and is slowly replacing SAS70. SSAE16 is more internationalized than SAS70
  • Provides guidance on how debit and credit card information should be handled. Especially relevant for payment processing vendors that handle online donations.
  • Provides guidance on how debit and credit card information should be handled. Especially relevant for payment processing vendors that handle online donations.
  • Provides guidance on how debit and credit card information should be handled. Especially relevant for payment processing vendors that handle online donations.

The Cloud Beckons, But is it Safe? The Cloud Beckons, But is it Safe? Presentation Transcript

  • The Cloud Beckons, But is it Safe? You should hear voices. If you can’t hear anything, check thatyour computer volume is turned up and un-muted, and the “Use Mic” radio button is selected. Or you can use a phone to listen to the same audio by calling (914) 339-0030, Access Code: 742-024-148
  • Logistics: Audio Via Phone Speakers not working? Prefer the phone? Dial in: (914) 339-0030 742-024-148 (If you can’t see this panel, click the “Show ControlChoose “Use Telephone” Panel” button)
  • Logistics: Ask QuestionsAsk questions! Otherwise I’m speaking to a blackhole! Click to open the chat window Raise your hand and I’ll unmute you Not hearing anything? Call 773-945-1010, access 257-723-187
  • Having Trouble?You should hear voices. If you can’t hearanything, check that your computer volume isturned up and un-muted, and the “Use Mic” radiobutton is selected.Or you can use a phone to listen to the same audioby calling (914) 339-0030, Access Code: 742-024-148
  • The Cloud Beckons, But is it Safe? July 2012
  • Introductions Laura Quinn Executive Director Idealware Jeff Hogue Legal Assistance of Western New York What are you hoping to get out of this session?
  • What is The Cloud?
  • LSC Grantees are Using It• 46% said that “some or all of their servers are hosted externally”• 18% said they were using Google Apps for email• 13% said they were using Google Docs
  • The Lure of the CloudLow cost of entryEasy remote accessNo complex infrastructure
  • But What About Security?
  • Cloud Security in the News
  • Technology and Legal EthicsThe ABA is prepared to vote in newmodel rules requiring lawyers to"make reasonable efforts" to prevent"inadvertent or unauthorizeddisclosure of, or unauthorized accessto" confidential client information.This doesn’t preclude the cloud, but itrequires you to think through it’s use.
  • Under Siege To be on the Internet is to be vulnerable to attack. If you’re on the Internet, you’re in The Cloud
  • But We Do Lots of Things on the InternetWe shop onlineWe bank onlineWe post crazythings on Facebook Why is the cloud different? It’s not.
  • How Secure is Your On-Site Data? Do any of these sound familiar? • No one patches computers or is responsible for network security • You haven’t really thought about passwords or permissions • No disaster recovery plans • Staff hasn’t had any security training
  • Myth “We’re a small nonprofit. We’re safe because no one would target us for cyber attack.”
  • FactMany data security breachesare crimes of opportunity.Organizations don’t alwaysconsider the sensitivity of theirdata until it’s exposed.
  • Myth “Our data is safer not in the cloud”
  • A Cloud Data Center
  • Is This Your Server Closet?
  • What Does Security Mean?
  • The Three Pillars of Information Security
  • Confidentiality Information is available only to authorized parties.
  • Integrity Information isn’t modified inappropriately, and that you can track who made what change.
  • Availability Assurance that data is accessible when needed by authorized parties.
  • Also: Physical PossessionWhoever has thedata could, intheory, turn itover to thegovernment
  • What Does Security Mean For You?
  • Rules for Absolute SafetyTurn off your Internetconnection.Allow no one access toyour data and systems. But let’s be realistic…
  • Know What You’re Protecting What kinds of data are you storing, and how sensitive are they? Think about its value on the open market.
  • Red Flags You need extremely tight security to store: • Donor’s credit card numbers. • Scanned images of checks. • Donor’s bank account information.
  • Privilege and WaiverIs storing data in the clouddisclosure that destroys theprivileged nature of data?No, but you have to spend timethinking through the problem.
  • What’s Your Exposure?Consider the impact ofexposure of yourconfidentialinformation, both inmonetary terms andreputation.
  • What’s The Impact of an Outage?How much stafftime could youlose from a shortterm or prolongedoutage?
  • Testing Your On-Site SecurityHave you recently performed a: • Check on whether your systems have been recently patched? • Systems penetration test ? • Employee training on security procedures? • Backup/recovery test?If not, you’d likely increase your security by movingto the cloud.
  • A Multi-Level Security Model
  • Multi-Level Security is the Ideal
  • Physical Security• Guarded facilities• Protection of your hardware and devices• Power redundancy• Co-location (redundant facilities)
  • Network Security• Intrusion prevention• Intrusion detection• Firewalled systems• Network proactive anti-virus protection
  • Transmission SecurityIs data encrypted intransit?Is the networksecure?
  • Access Controls• Ensuring the right people have access to the right data• Physical access to the server• Training on appropriate passwords and security measures
  • Data Protection• Data encryption• Solid backup and restore policies• Ability to purge deleted data• Ability to prevent government entities from getting your data with a subpoena
  • What to Look For in a Vendor
  • Description of Security MechanismsDocumentation of all the facets ofsecurity, and the staff can talkabout it intelligently.Proves information security is onthe “front burner”
  • UptimeDo they provide any guarantee ofuptime? Any historic uptimefigures?Uptime figures are typically in 9s--99%, 99.9% or 99.99% Your connection to the internet may well be the weakest link.
  • Terms of Service What’s in the terms of service in terms of privacy and use of your data? Do they need to tell you if they change their terms of service?
  • Regulatory Compliance: HIPAADoes the vendor supportorganizations that need to becompliant with HIPAA (theHealth Insurance Portabilityand Accountability Act)?
  • Regulatory Compliance: SAS70 and SSAE16 Audit for security standards, hardware, and processes. Statement on Accounting Standards 70 (SAS70) Statement of Standards for Attestation Engagements 16 (SSAE16)
  • Regulatory Compliance: PCI DSS ComplianceIf you’re storing credit cardnumbers, your vendorneeds to be compliant withPCI DSS (Payment CardIndustry Payment DataSecurity Standard)
  • In Summary
  • Your Data Is No Safer Than You Make It Any computer attached to the internet is vulnerable unless you protect it. The cloud isn’t, in of itself, more or less secure
  • Understand the Value of Your Data What is it worth to you? To others? What measures are appropriate to protect it?
  • But Many Vendors Make Your Data Really SafeChoose vendors whoshow they’re seriousabout data protection(not all vendors arecreated equal).Consider a vendor’sregulatory compliance.
  • Questions?