Securing Cloud Services John Rhoton Distinguished Technologist HP EDS CTO Office June 2009

Overview of Cloud Security benefits Security challenges HP Solutions Agenda

Overview of Cloud

Security benefits

Security challenges

HP Solutions

Overview of Cloud Security benefits Security challenges HP Solutions Agenda

Overview of Cloud

Security benefits

Security challenges

HP Solutions

So, What is Cloud Computing? The 451 Group: “The cloud is IT as a Service, delivered by IT resources that are independent of location” Gartner: “Cloud computing is a style of computing where massively scalable IT-related capabilities are provided ‘as a service’ across the Internet to multiple external customers” Forrester: “A pool of abstracted, highly scalable, and managed infrastructure capable of hosting end-customer applications and billed by consumption” Wikipedia: “A style of computing in which dynamically scalable and often virtualized resources are provided as a service over the Internet. Users need not have knowledge of, expertise in, or control over the technology infrastructure "in the cloud" that supports them. ” “ A large pool of easily usable and accessible virtualized resources (such as hardware, development platforms and/or services). These resources can be dynamically reconfigured to adjust to a variable load (scale), allowing also for an optimum resource utilization. This pool of re-sources is typically exploited by a pay-per-use model in which guarantees are offered by the Infrastructure Provider by means of customized SLAs.” Vaquero, Rodero-Merino, Caceres, Lindner

The 451 Group: “The cloud is IT as a Service, delivered by IT resources that are independent of location”

Gartner: “Cloud computing is a style of computing where massively scalable IT-related capabilities are provided ‘as a service’ across the Internet to multiple external customers”

Forrester: “A pool of abstracted, highly scalable, and managed infrastructure capable of hosting end-customer applications and billed by consumption”

Wikipedia: “A style of computing in which dynamically scalable and often virtualized resources are provided as a service over the Internet. Users need not have knowledge of, expertise in, or control over the technology infrastructure "in the cloud" that supports them. ”

Cloud Attributes Off-premise Outside Firewall Delivered over Internet Available on Demand Scalable Elastic Utility billed Multi-tenant Virtualised Available as Service Location independent SOA? Grid? Web 2.0? Private versus Public Cloud

Off-premise

Outside Firewall

Delivered over Internet

Available on Demand

Scalable

Elastic

Utility billed

Multi-tenant

Virtualised

Available as Service

Location independent

SOA?

Grid?

Web 2.0?

Innovation & Impact Innovation Incremental Individually not impressive or not recent Compare Internet TCP/IP, HTTP, HTML, PC Impact IT: New platforms, Service delivery models Business: Capex, Opex, Agility Economic: Entry barriers, Startup speed, Startup numbers Political: Regulation, Compliance June 19, 2009

Innovation

Incremental

Individually not impressive or not recent

Compare Internet

TCP/IP, HTTP, HTML, PC

Impact

IT: New platforms, Service delivery models

Business: Capex, Opex, Agility

Economic: Entry barriers, Startup speed, Startup numbers

Political: Regulation, Compliance

Massive Scale-out and the Cloud 17 Decmeber 2008 2938: The Value of Cloud in the Business Technology Ecosystem Enterprise Class Global class On-premise Hybrid/off-premise 100s -1000s of nodes 10,000+ nodes Proprietary Commodity HW resiliency SW resiliency Max performance Max efficiency Silo’ed Resources Shared Resources Cost-Center Clusters Grids/Cloud Value/ Revenue-Center Static Elastic Shared storage Replicated storage Facility costs Power Usage Efficiency

2938: The Value of Cloud in the Business Technology Ecosystem

Market context A service-centric perspective sheds light on all value chain constituents S S S External services In-house services Cloud services Massive scale-out infrastructure Global-class software Enterprise-class software Dedicated and shared infrastructure Enterprise-class software Dedicated and shared infrastructure 2938: The Value of Cloud in the Business Technology Ecosystem Business users Cloud service provider Hosted / outsourced service provider IT organization internal service provider Business outcome

2938: The Value of Cloud in the Business Technology Ecosystem

Cloud Model Integration Operation Governance Hardware Computation Storage Memory Colocation Real Estate Cooling Power Bandwidth Virtualisation Provisioning Billing Virtualisation Platform Programming Language Development Environment APIs Application CRM UC Email ....... .......

Cloud Landscape Governance Operation Integration Infrastructure Platform Software

Why Cloud Computing? Cost reduction Benefit from economies of scale and experience curve Predictability of spend Avoids cost of over-provisioning Reduction in up-front investment Risk reduction Offload risk or running the data-centre, data protection, and disaster recovery Reduces risk of under-provisioning Focus on core competency Reduce effort and administration related to IT Automatic service evolution Flexibility Roll-out new services, retire old Scale up and down as needed; quickly Faster time to market: Lower barriers to innovation Access from any place, any device, any time

Cost reduction

Benefit from economies of scale and experience curve

Predictability of spend

Avoids cost of over-provisioning

Reduction in up-front investment

Risk reduction

Offload risk or running the data-centre, data protection, and disaster recovery

Reduces risk of under-provisioning

Focus on core competency

Reduce effort and administration related to IT

Automatic service evolution

Flexibility

Roll-out new services, retire old

Scale up and down as needed; quickly

Faster time to market: Lower barriers to innovation

Access from any place, any device, any time

Overview of Cloud Security benefits Security challenges HP Solutions Agenda

Overview of Cloud

Security benefits

Security challenges

HP Solutions

Security Benefits and Opportunities Cloud providers undergo rigorous audits Isolation of customer and employee data Disaster Recovery extensions Centralised monitoring Forensic readiness Password assurance testing Pre-hardened builds Security testing Obfuscation of physical infrastructure June 19, 2009

Cloud providers undergo rigorous audits

Isolation of customer and employee data

Disaster Recovery extensions

Centralised monitoring

Forensic readiness

Password assurance testing

Pre-hardened builds

Security testing

Obfuscation of physical infrastructure

Overview of Cloud Security benefits Security challenges HP Solutions Agenda

Overview of Cloud

Security benefits

Security challenges

HP Solutions

Challenges Governance Compliance Data Privacy Service Availability Vendor Lock-in Latency Identity Management Lock-in Rogue Clouds June 19, 2009

Governance

Compliance

Data Privacy

Service Availability

Vendor Lock-in

Latency

Identity Management

Lock-in

Rogue Clouds

Governance June 19, 2009

Compliance Sarbanes Oxley HIPAA FDA Basel II PCI FISMA GLBA OSHA ISO 27002 June 19, 2009

Sarbanes Oxley

HIPAA

FDA

Basel II

PCI

FISMA

GLBA

OSHA

ISO 27002

Data Privacy June 19, 2009

Resilience Service Availability Integration risks Business Continuity Latency Fault Tolerance June 19, 2009

Service Availability

Integration risks

Business Continuity

Latency

Fault Tolerance

Identity Management Authentication Authorisation Access rights Federation Interoperability Standards XACML, SAML Rapid provisioning Immediate de-provisioning Identity theft June 19, 2009

Authentication

Authorisation

Access rights

Federation

Interoperability

Standards

XACML, SAML

Rapid provisioning

Immediate de-provisioning

Identity theft

Cloud Computing: Models Enterprise Data Storage Service Office Apps On Demand CPUs Printing Service Cloud Provider #1 Cloud Provider #2 Internal Cloud CRM Service … Service 3 Backup Service ILM Service Service Service Service Business Apps/Service Employee User … … … The Internet

Identity in the Cloud: Enterprise Case Enterprise Data Storage Service Office Apps On Demand CPUs Printing Service Cloud Provider #1 Cloud Provider #2 Internal Cloud CRM Service … Service 3 Backup Service ILM Service Service Service Service Business Apps/Service Employee … … … The Internet Identity & Credentials Identity & Credentials Identity & Credentials Identity & Credentials Identity & Credentials Identity & Credentials Identity & Credentials Authentication Authorization Audit Authentication Authorization Audit Authentication Authorization Audit Authentication Authorization Audit User Account Provisioning/ De-provisioning User Account Provisioning/ De-provisioning User Account Provisioning/ De-provisioning User Account Provisioning/ De-provisioning PII Data & Confidential Information PII Data & Confidential Information PII Data & Confidential Information PII Data & Confidential Information IAM Capabilities and Services Can be Outsourced in The Cloud …

Lock-in IaaS Standard Hardware, Software Low Risk PaaS Programming Language, APIs Data Extraction SaaS Data Extraction Functionality, User retraining Assess Vendor viability June 19, 2009

IaaS

Standard Hardware, Software

Low Risk

PaaS

Programming Language,

APIs

Data Extraction

SaaS

Data Extraction

Functionality, User retraining

Assess Vendor viability

Rogue Clouds Shadow IT may circumvent Central IT Suboptimal Resource allocation Disregard Compliance Compromise Information Security June 19, 2009

Shadow IT may circumvent Central IT

Suboptimal Resource allocation

Disregard Compliance

Compromise Information Security

Cloud Security Activity and Standards Cloud Security Alliance ENISA (European Network and Information Security Agency) Cloud Risk Assessment Open Group Jericho Forum SAS 70 NIST Special Publication 853 FIPS 199/200 June 19, 2009

Cloud Security Alliance

ENISA (European Network and Information Security Agency)

Cloud Risk Assessment

Open Group

Jericho Forum

SAS 70

NIST Special Publication 853

FIPS 199/200

Overview of Cloud Security benefits Security challenges HP Solutions Agenda

Overview of Cloud

Security benefits

Security challenges

HP Solutions

An infrastructure utility underpins both dedicated and “as a service” applications Business outcomes Technology-enabled services Internally hosted 2938: The Value of Cloud in the Business Technology Ecosystem Externally hosted Infrastructure as a service Business outcome Cloud Infrastructure Utility Enterprise Infrastructure Utility Enterprise-class applications Global-class cloud services

2938: The Value of Cloud in the Business Technology Ecosystem

HP delivers on the Business Technology Ecosystem A sampling of HP product and services Business outcomes Technology-enabled services 2938: The Value of Cloud in the Business Technology Ecosystem Business outcome Externally hosted Infrastructure as a service Infrastructure Utility homogeneous, centralized design Infrastructure Utility heterogeneous, distributed design Enterprise-class applications Global-class cloud services EDS Application Services Performance / Quality Center Security Center Service Manager Catalog Business Service Automation Insight Orchestration Business Service Management Proliant / Integrity ProCurve Storage Works Insight Dynamics - VSE Proliant BL2x220c StorageWorks ExDS9100 Portable Optimized Datacenter Snapfish, BookPrep, MagCloud Business Availability Center Quality and Security Centers Cloud Assure Concierge Services Project & Portfolio Management

2938: The Value of Cloud in the Business Technology Ecosystem

HP delivers value across the business technology ecosystem Jun 19, 2009 We build it Leading data center design company We power it With leading servers, storage and networking We design it Expertise in application architecture & frameworks We automate it With virtualization and management software We secure it Through HP Secure Advantage program We support it With tens of thousands of IT professionals We govern it HP wrote the books on service management We measure it HP can measure the fiscal impact of services We deliver it Through purchased, financed, outsourced, cloud 2938: The Value of Cloud in the Business Technology Ecosystem

2938: The Value of Cloud in the Business Technology Ecosystem

HP Secure Advantage: Making security a business enabler June 19, 2009 Business Outcomes People and process The secure end-to-end business advantage 3296 HP Secure Advantage Products –– Partners –– Solutions Protect resources Protect data Provide validation Technology Reduce Cost Virtualized Efficient Pre-packaged Scalable HP provides low-cost/high-quality solution delivery combining expert knowledge and security products from the desktop to the data center using proven methodologies with global resources. Reduce Complexity Standardized • Integrated • Consulting • Managed • In/Outsourced • Pre-integrated solutions with major security players , & the HP Secure Advantage portfolio, along with the flexibility to leverage services globally to consult, deploy or manage these solutions, reduces complexity for our customers. Reduce Risk HP uses its internal best practices, developed in HP Labs and HP Services to create and commercialize security solutions and services for customers across the world.

3296 HP Secure Advantage

Reduce Cost

Virtualized

Efficient

Pre-packaged

Scalable

HP Secure Advantage services portfolio Enablement to Management services from Desktop to Datacenter. Endpoint Security Network Security Data Center Security Security Operations Business Continuity & Recovery Risk Management & Compliance Infrastructure Security Governance, Risk & Compliance Mgmt Data Protection & Privacy Mgmt Identity & Access Management Identity & Access Mgmt Data Security Content Security Application Security 3296 HP Secure Advantage Provide validation Protect data Governance, Risk & Compliance Management Infrastructure Security Identity & Access Management Data Protection & Privacy Management Protect resources

3296 HP Secure Advantage

HP Secure Advantage- Product Portfolio -1 3296 HP Secure Advantage Categories Domains HP Secure Advantage Products Infrastructure Security Network Security HP ProCurve Network Access Control HP ProCurve Network Immunity Manager HP ProCurve ONE network security solutions Endpoint Security HP ProtectTools HP Business Service Automation - Client Automation Center HP Secure Document Advantage Family Data Center Security HP Insight Dynamics - VSE HP NetTop HP-UX 11i (CC EAL4+, HIDS) HP Linux (CC EAL4+) HP OpenVMS HP NonStop Safeguard HP Neoview Security Data Protection & Privacy Management Data Security HP Secure Key Manager HP Atalla Key Block, NSP HP ProtectTools Drive Encryption HP Storage Media Encryption Fabric Switch HP XP Disk Array Encryption HP LTO-4 Tape Encryption HP Data Protector HP-UX EVFS HP NonStop Volume Level Encryption HP Medical Archive Solution Content Security HP BladeSystem content security solutions Application Security HP Application Security Center

3296 HP Secure Advantage

HP Secure Advantage – Product Portfolio - 2 3296 HP Secure Advantage Categories Domains HP Secure Advantage Products Governance Risk & Compliance Mgmt Risk Management & Compliance HP Compliance Log Warehouse HP TRIM (e-Discovery) HP Integrated Archival Platform (ILM/archiving for Email, Database, File) HP Business Service Automation - Data Center Automation Center (Server Automation, Network Automation) HP Medical Archive Solution HP Dragon HP Application Security Center Security Operations HP Business Service Automation - Data Center Automation Center (Server Automation, Network Automation, Live Network, Release Control) and Client Automation Center HP IT Service Management (Asset Manager, Decision Center etc) HP UCMDB, DDM HP Proliant Essentials Vulnerability & Patch Management Pack HP Systems Insight Manager HP Compliance Log Warehouse Business Continuity& Recovery HP Business Service Management Identity & Access Management Identity & Access Management HP ProCurve Identity Driven Manager HP Icewall HP-UX, Linux, NonStop etc

3296 HP Secure Advantage

HP Secure Advantage Solutions HP Servers, Storage, Networking, PC’s, Printers HP Software – HP Application Center, Business Service Automation, Change Management Services and Support Assessment, Deployment, hosting, managed services HP Secure Advantage Comprehensive solutions consisting of HP hardware, software, services and expertise to mitigate risk Better business outcomes 06/19/09 © 2009 Hewlett-Packard Development Company, L.P. Leveraging 37 years’ experience of delivering secure transactions across the world for 1000s of customers 3296 HP Secure Advantage

3296 HP Secure Advantage

Practical advice Plan! Prepare! Assess risks Application audit/inventory Begin with non-sensitive data Consider disaster-recovery extensions Encrypt sensitive data June 19, 2009

Plan! Prepare!

Assess risks

Application audit/inventory

Begin with non-sensitive data

Consider disaster-recovery extensions

Encrypt sensitive data

Summary „ Cloud Computing“ means different things to different people That doesn‘t stop us from implementing it Cloud Computing has many benefits Some Enterprise advantages can also be covered through Private Clouds There are security challenges around Cloud Computing But also some benefits Cloud Computing is still work-in-progress Privacy, Service-levels, Interoperabilty It‘s possible to get started in the Enteprise today The most critical challenge is to make the existing environment future-proof

„ Cloud Computing“ means different things to different people

That doesn‘t stop us from implementing it

Cloud Computing has many benefits

Some Enterprise advantages can also be covered through Private Clouds

There are security challenges around Cloud Computing

But also some benefits

Cloud Computing is still work-in-progress

Privacy, Service-levels, Interoperabilty

It‘s possible to get started in the Enteprise today

The most critical challenge is to make the existing environment future-proof

More information Presentation will be posted to: http://www.slideshare.net/rhoton Additional Resources http://www.hp.com/go/cloud http://www.hp.com/go/security Any other questions? http://www.linkedin.com/in/rhoton

Presentation will be posted to:

http://www.slideshare.net/rhoton

Additional Resources

http://www.hp.com/go/cloud

http://www.hp.com/go/security

Any other questions?

http://www.linkedin.com/in/rhoton