Achieving Security Assurance and     Compliance in the Cloud         Ray Sugiarto, CSA Indonesia         Founder, chapter ...
Cloud: Ushering in “IT Spring”Cloud – a simple ideaCompute as a utilityAlign technology costs with usageChallenges our ass...
The Revolution Has Tinder Social networking, blogging and mircoblogging  Egalitarianism of media and communications  Mobil...
What is Cloud Computing?Compute as a utility: third major era of computingCloud enabled by Moore’s Law Hyperconnectivity S...
2011-2014: The Hybrid Enterprise                                                                   private clouds         ...
Cloud Forcing Key IssuesCritical mass of separation between data owners anddata processorsAnonymity of geography of data c...
What are the Trust Issues?Will my cloud provider be transparent aboutgovernance and operational issues?Will I be considere...
Key Problems of Tomorrow Keeping pace with cloud changes Globally incompatible legislation and policy Non-standard Private...
About the Cloud SecurityAlliance Global, not-for-profit organization Over 23,000 individual members, 100 corporate members...
HOW DO WE BUILD THE “TRUSTED                        CLOUD?”                Copyright © 2011 Cloud Security Alliance   www....
Here’s How… Strategy Education Security Framework Assessment Build for the Future               Copyright © 2011 Cloud Sec...
Strategy IT Architecture supporting Hybrid enterprise  Federated IdM  Service Oriented Architecture “loose coupling” princ...
EDUCATION• Classes in Feb and May in Indonesia by   AdvancedTechpac               Copyright © 2011 Cloud Security Alliance...
CSA Guidance Research Popular best practices for securing cloud computing                                                 ...
Guidance Highlights – 1/2 Governance, ERM: Secure the cloud before procurement – contracts, SLAs, architecture Governance,...
Guidance Highlights – 2/2BCM/DR: provider redundancy vs. your ownDC Ops: provisioning, patching, loggingEncryption: encryp...
Certificate of Cloud SecurityKnowledge (CCSK) Benchmark of cloud security competency Measures mastery of CSA guidance and ...
Classes in Indonesia, Jakarta•• First class was done in Nov 20• New class is targeted for 09 Feb 2012 at   Cyber 2 support...
Training Courses  CCSK BasicOne day course to enable student to pass CCSK  CCSK PlusTwo day course includes practical clou...
Upcoming Conferences CSA Summit Korea, Sept. 29, Seoul CSA Summit Europe, Oct. 10, London (with RSA Europe) CSA Congress, ...
SECURITY FRAMEWORK           Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
CSA Reference Model                       CSA Cloud Reference                       Model                           IaaS (...
Cloud Controls Matrix Controls derived from guidance Mapped to familiar frameworks: ISO 27001, COBIT, PCI, HIPAA, FISMA, F...
ASSESSMENT     Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Assessment Responsibility        Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Consensus Assessment Initiative Research tools and processes to perform shared assessments of cloud providers Integrated w...
CSA STAR RegistryCSA STAR (Security, Trust and Assurance Registry)Public Registry of Cloud Provider self assessmentsBased ...
BUILD FORTHE FUTURE       Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
CSA GRC StackFamily of 4 research projects  Cloud Controls Matrix  Consensus Assessments  Initiative  Cloud Audit  Cloud T...
CloudAuditOpen standard and API to automate provider auditassertionsChange audit from data gathering to data analysisNeces...
Cloud Trust Protocol (CTP)Developed by CSC, transferred to CSAOpen standard and API to verify control assertions“Question ...
CloudSIRT Consensus research for emergency response in Cloud Enhance community’s ability to respond to incidents Standardi...
Trusted Cloud Initiative Comprehensive Cloud Security Reference Architecture Secure & interoperable Identity in the cloud ...
Reference Model Structure          TCI Reference Architecture        Copyright © 2011 Cloud Security Alliance   www.clouds...
Security as a Service Information Security Industry re-invented Define Security as a Service Articulate solution categorie...
Data Governance ProjectSurvey of current Cloud Provider data governance practicesin the market (e.g. backup, encryption, s...
What Might Cloud 2.0 Look Like? Less centralized than you think: cloud brokering, SOA, REST, evade energy costs, grid Regu...
Going to the CloudSecurely Challenges remain More tools available than you think Waiting not an option Many types of cloud...
ContactHelp Us Secure Cloud Computing   www.cloudsecurityalliance.org   info@cloudsecurityalliance.org   LinkedIn: www.lin...
Training arm for Apccor in Indonesia – organizer of CCSKclasses and cloud related eventsOther certification classes and tra...
THANK YOU! Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Upcoming SlideShare
Loading in...5
×

CCSK, cloud security framework, Indonesia

2,474

Published on

Need a copy let me know ,drop a mail to ccsk@advancedtechpac.com
Attend our ccsk class in Singapore in May 2012

Published in: Technology, Business

Transcript of "CCSK, cloud security framework, Indonesia"

  1. 1. Achieving Security Assurance and Compliance in the Cloud Ray Sugiarto, CSA Indonesia Founder, chapter in formation 0815 167 2882 BBM 2142176F Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  2. 2. Cloud: Ushering in “IT Spring”Cloud – a simple ideaCompute as a utilityAlign technology costs with usageChallenges our assumptions abouteverything  Barriers to market entry in any industry  Organizational structure and business planning  Investment, venture capital, Research & Development  Driving a new macroeconomic reality Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org 
  3. 3. The Revolution Has Tinder Social networking, blogging and mircoblogging Egalitarianism of media and communications Mobile computing Empowering the citizens Cloud computing Egalitarianism of ITWhat can’t this change?Timing is everything Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  4. 4. What is Cloud Computing?Compute as a utility: third major era of computingCloud enabled by Moore’s Law Hyperconnectivity SOA Provider scaleKey characteristics Elastic & on-demand Multi-tenancy Metered serviceIaaS may track energy costs Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  5. 5. 2011-2014: The Hybrid Enterprise private clouds public clouds Extended Virtual Data Center enterprise Cloud + Mobile Notional boundary organizational Dispersal of applications cloud of users boundary Dispersal of data Dispersal of users Dispersal of endpoint devices 5 Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  6. 6. Cloud Forcing Key IssuesCritical mass of separation between data owners anddata processorsAnonymity of geography of data centers & devicesAnonymity of providerTransient provider relationshipsPhysical controls must be replaced by virtual controlsIdentity management has a key role to playCloud WILL drive change in the security status quoReset button for security ecosystem Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  7. 7. What are the Trust Issues?Will my cloud provider be transparent aboutgovernance and operational issues?Will I be considered compliant?Do I know where my data is?Will a lack of standards drive unexpectedobsolescence?Is my provider really better at security than me?Are the hackers waiting for me in the cloud?Will I get fired? Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  8. 8. Key Problems of Tomorrow Keeping pace with cloud changes Globally incompatible legislation and policy Non-standard Private & Public clouds Lack of continuous Risk Management & Compliance monitoring Incomplete Identity Management implementations Haphazard response to security incidents Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  9. 9. About the Cloud SecurityAlliance Global, not-for-profit organization Over 23,000 individual members, 100 corporate members, 50 chapters Building best practices and a trusted cloud ecosystem Agile philosophy, rapid development of applied research GRC: Balance compliance with risk management Reference models: build using existing standards Identity: a key foundation of a functioning cloud economy Champion interoperability Enable innovation Advocacy of prudent public policy “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.” Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  10. 10. HOW DO WE BUILD THE “TRUSTED CLOUD?” Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  11. 11. Here’s How… Strategy Education Security Framework Assessment Build for the Future Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  12. 12. Strategy IT Architecture supporting Hybrid enterprise Federated IdM Service Oriented Architecture “loose coupling” principles Consider cloud as an option to any new IT initiative What are the cost differences? What are the feature/functionality differences? Does the application support different cloud deployments and multiple providers? Risk Management Sensitivity of application and data, new risks introduced by cloud, risk tolerance levels Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  13. 13. EDUCATION• Classes in Feb and May in Indonesia by AdvancedTechpac Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  14. 14. CSA Guidance Research Popular best practices for securing cloud computing Governing the Cloud Flagship research project V2.1 released 12/2009 V3 research underway, targeting Q3 2011 release Operating in the Cloud wiki.cloudsecurityalliance.or g/guidanceGuidance > 100kdownloads:cloudsecurityalliance.org/guidance Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  15. 15. Guidance Highlights – 1/2 Governance, ERM: Secure the cloud before procurement – contracts, SLAs, architecture Governance, ERM: Know provider’s third parties, BCM/DR, financial viability, employee vetting Legal: Plan for provider termination & return of assets Compliance: Identify data location when possible ILM: Persistence, Protection Portability & Interoperability: SOA “loose coupling” principles Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  16. 16. Guidance Highlights – 2/2BCM/DR: provider redundancy vs. your ownDC Ops: provisioning, patching, loggingEncryption: encrypt data when possible, segregate key mgtfrom cloud providerAppSec: Adapt secure software development lifecycleVirtualization: Harden, rollback, port VM imagesIdM: Federation & standards e.g. SAML, OpenID Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  17. 17. Certificate of Cloud SecurityKnowledge (CCSK) Benchmark of cloud security competency Measures mastery of CSA guidance and ENISA cloud risks whitepaper Understand cloud issues Look for the CCSKs at cloud providers, consulting partners Online web-based examination www.cloudsecurityalliance.org/certifyme Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  18. 18. Classes in Indonesia, Jakarta•• First class was done in Nov 20• New class is targeted for 09 Feb 2012 at Cyber 2 supported by CBN one of the oldest ISPs in Indonesia rd• Planned 3 class is in May 2012 or may be bring forward to April depend on demand• Join us as below for those in Indonesia :• http://www.facebook.com/groups/ccskindonesia/ Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  19. 19. Training Courses CCSK BasicOne day course to enable student to pass CCSK CCSK PlusTwo day course includes practical cloud lab work GRC Stack TrainingOne day course to use GRC Stack components PCI/DSS In the CloudAchieving PCI compliance in cloud computing http://cloudsecurityalliance.org/education/training/ Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  20. 20. Upcoming Conferences CSA Summit Korea, Sept. 29, Seoul CSA Summit Europe, Oct. 10, London (with RSA Europe) CSA Congress, Nov. 16-17, Orlando CSA Summit RSA, Feb. 27, 2012, San Francisco SecureCloud 2012 (partnership with ENISA) Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  21. 21. SECURITY FRAMEWORK Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  22. 22. CSA Reference Model CSA Cloud Reference Model IaaS (Compute & storage) is the foundation PaaS (Rapid application dev) adds middleware to IaaS SaaS represents complete applications on top of PaaS Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  23. 23. Cloud Controls Matrix Controls derived from guidance Mapped to familiar frameworks: ISO 27001, COBIT, PCI, HIPAA, FISMA, FedRAMP Rated as applicable to S- P-I Customer vs Provider role Help bridge the “cloud gap” for IT & IT auditors Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  24. 24. ASSESSMENT Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  25. 25. Assessment Responsibility Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  26. 26. Consensus Assessment Initiative Research tools and processes to perform shared assessments of cloud providers Integrated with Controls Matrix Version 1 CAI Questionnaire released Oct 2010, approximately 140 provider questions to identify presence of security controls or practices Use to assess cloud providers today, procurement negotiation, contract inclusion, quantify SLAs www.cloudsecurityalliance.org/cai.html Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  27. 27. CSA STAR RegistryCSA STAR (Security, Trust and Assurance Registry)Public Registry of Cloud Provider self assessmentsBased on Consensus Assessments Initiative Questionnaire Provider may substitute documented Cloud Controls Matrix complianceVoluntary industry action promoting transparencyFree market competition to provide quality assessments Provider may elect to provide assessments from third partiesAvailable October 2011 Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  28. 28. BUILD FORTHE FUTURE Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  29. 29. CSA GRC StackFamily of 4 research projects Cloud Controls Matrix Consensus Assessments Initiative Cloud Audit Cloud Trust ProtocolTools for governance, riskand compliancemanagement Private, CommunityEnabling automation and Control Providercontinuous monitoring of Requiremen Assertion ts sGRC Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  30. 30. CloudAuditOpen standard and API to automate provider auditassertionsChange audit from data gathering to data analysisNecessary to provide audit & assurance at the scaledemanded by cloud providersUses Cloud Controls Matrix as controls namespaceUse to instrument cloud for continuous controls monitoring Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  31. 31. Cloud Trust Protocol (CTP)Developed by CSC, transferred to CSAOpen standard and API to verify control assertions“Question and Answer” asynchronous protocol, leveragesSCAP (Secure Content Automation Protocol)Integrates with Cloud AuditNow we have all the components for continuous controlsmonitoring Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  32. 32. CloudSIRT Consensus research for emergency response in Cloud Enhance community’s ability to respond to incidents Standardized processes Supplemental best practices for SIRTs Hosted Community of Cloud SIRTs www.cloudsecurityalliance.org/cloudsirt.html Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  33. 33. Trusted Cloud Initiative Comprehensive Cloud Security Reference Architecture Secure & interoperable Identity in the cloud Getting SaaS, PaaS to be “Relying Parties” for corporate directories Scalable federation Outline responsibilities for Identity Providers Assemble reference architectures with existing standards www.cloudsecurityalliance.org/trustedcloud.html Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  34. 34. Reference Model Structure TCI Reference Architecture Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  35. 35. Security as a Service Information Security Industry re-invented Define Security as a Service Articulate solution categories within Security as a Service Guidance for adoption of Security as a Service Align with other CSA research Develop deliverables as a proposed 14th domain within CSA Guidance Version 3. www.cloudsecurityalliance.org/secaas.html Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  36. 36. Data Governance ProjectSurvey of current Cloud Provider data governance practicesin the market (e.g. backup, encryption, secure deletion, etc.)Structure based on Domain 5: Information Lifecycle MgtProject co-sponsored by CSA Silicon Valley and CSASingaporeTarget Sept. 2011 Report releaseCharter and participation info to be posted on CSA website1st week of August. Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  37. 37. What Might Cloud 2.0 Look Like? Less centralized than you think: cloud brokering, SOA, REST, evade energy costs, grid Regulated – if we don’t do it ourselves Disruptive technologies, e.g. format preserving encryption, new secure hypervisors, Identity Management everywhere New cloud business app models Greater policy harmonization (maritime law?) 4 of 10 biggest IT companies of 2020 do not exist Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  38. 38. Going to the CloudSecurely Challenges remain More tools available than you think Waiting not an option Many types of clouds Identify IT options appropriate for specific cloud Leverage business drivers & risk management Be Agile! Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  39. 39. ContactHelp Us Secure Cloud Computing www.cloudsecurityalliance.org info@cloudsecurityalliance.org LinkedIn: www.linkedin.com/groups?gid=1864210 Twitter: @cloudsa Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  40. 40. Training arm for Apccor in Indonesia – organizer of CCSKclasses and cloud related eventsOther certification classes and trainings Need more info call to Rosi, Felicia, Ray +6221 4176 6679 or email to ccsk@advancedtechpac.com Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  41. 41. THANK YOU! Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org

×