The document discusses key considerations for cloud security across different service models. It outlines that private clouds have the highest level of security responsibility falling on the user, while for public clouds the vendor takes on more security responsibilities like infrastructure, application stack, and some application security. The document also discusses focus areas like encryption, key management, API security, patching, monitoring and more. It emphasizes strategies like centralized standardization and automation for security and continuous deployment for maintenance.

1. Cloud Security
Design Considerations
Kavis Technology Consulting

6. What level of security is required

7. What level of security is required
•
•
•
•
•

8. What level of security is required
•
•
•
•
•
•
•
•
•
•

9. What level of security is required
•
•
•
•
•
•
•
•
•
•

10. What level of security is required
•
•
•
•
•
•
•
•
•

11. Security and Cloud Service Models

13. Private Clouds
http://designyoutrust.com

14. It’s all
You!

15. Public Clouds

16. Vendor supplies …
- Infrastructure security
You
do
this

17. Vendor supplies …
- Application Stack Security
- Infrastructure Security
You
do
this

18. Vendor supplies …
- Application Security
- Application Stack Security
- Infrastructure Security
You
do
this

19. Infrastructure Security
•
•
•
•

20. Applications Stack Security
•
•
•
•

21. Application Security
•
•
•
•
•
•
•
•
•

22. User security
•
•
•

23. Security across all service models
•
•
•
•
•
•
•
•
•
Source:https://cloudsecurityalliance.org/guidance/csaguide.v3.0.pdf

24. Key Security Areas of Focus
•
•
•
•
•
•
•
•
•
•

25. Security Strategies
Centralize
Standardize
Automate

26. Security Actions
Application
Detection
Prevention

27. Policy Enforcement
”Golden” Image
Cloud Servers
Deploy
•
•
•
•
•
•

28. Policy Enforcement
•
•
•
•
•
•

29. Policy Enforcement
•
•
•
•
•
•
•
•
Client Server
Data Store
Deploy
Admin Console
Policies

30. Encryption
•
•
•
•
•
•
•
•
•
Encryption
• Compliance
• Security
Usability
• Complexity
• Performance

31. Encryption
•
•
•
•
•
•
•
•
•
•
•
Encryption
• Compliance
• Security
Usability
• Complexity
• Performance

32. Key Management
•
•
•
•
•
•
•
•
•
Applications
Users
Organizations
Account

33. Web Security
•
•
•
•

35. API Token Management
Do Not Roll Your Own

36. API Token Management

37. API Token Management

38. API Token Management
•
•
•
•
•
•

39. Patch Management
•
•
•
•
•
•
•
•
•

40. Monitoring
 Security
 Performance
 Capacity
 Uptime
 Throughput
 SLA
 User metrics
 Kpis
 Log file analysis

41. Intrusion
Detection
Trouble
Shooting




Logging

42. Source: http://www.thoughtworks.com/continuous-delivery
Continuous Deployments

43. Maintaining Consistent Environments
Automation
Manage
Track
Administer
• Self Provision
• Charge Back
• Access Control
• Policies
• Audits

44. ID Management
Centralized
LDAP
Facade
Entity 1 Entity 2 Entity n
CSP 1 CSP 2 CSP 3
USE CASEs
 Business to Business
 Internal costumers
 Known Customers
Advantages
 Central control
 Roles, and groups
 termination

45. ID Management
deCentralized
USE CASEs
 Business to Consumer
 Open registration
 Large Number of
enrollees
Advantages
 Must accept terms
 Simple integration
with Partners
Source: http://static.springsource.org/spring-social/docs/1.0.x/reference/html/serviceprovider.html

46. Thank You
For details on this topic and others go to my blog
www Kavistechnology com
Images courtesy of www.thinkstockphotos.com