Cloud Security
Major Hayden, Rackspace
Why are we here today?
Cloud Security // ISACA San Antonio 2013-09-24 2
Who am I?
 Chief Security Architect at Rackspace
 Red Hat Certified Architect and MySQL DBA
 Five years of cloud operat...
Today’s big three
1. An understandable and repeatable definition of cloud
really does exist (and I’ll help you learn it)
2...
What is cloud hosting?
Cloud Security // ISACA San Antonio 2013-09-24 5
Cloud hosting is a shift from
managing computers
to utilizing
computing resources
Cloud Security // ISACA San Antonio 2013...
Cloud Security // ISACA San Antonio 2013-09-24 7
Cloud Security // ISACA San Antonio 2013-09-24 8
Colocation Dedicated Managed Cloud
Cloud Security // ISACA San Antonio 2013-09-24 9
Colocation Dedicated Managed Cloud
Cloud Security // ISACA San Antonio 2013-09-24 10
Colocation Dedicated Managed Cloud
Cloud Security // ISACA San Antonio 2013-09-24 11
Colocation Dedicated Managed Cloud
Key points
 Resources are always available
 Pay for what you use
 Fewer fixed costs, more variable costs
 Maintain bus...
Cloud hosting
brings new challenges
Cloud Security // ISACA San Antonio 2013-09-24 13
Homes vs. Apartments
Cloud Security // ISACA San Antonio 2013-09-24 14
Flickr: atelier_tee Flickr: oldtasty
Key points
 Can’t choose your neighbors
 Fluctuating performance
 Stay within the confines of the system
 Service prov...
Cattle vs. Pets
(Credit goes to Gavin McCance at CERN for this analogy)
Cloud Security // ISACA San Antonio 2013-09-24 16
Key points
 Rely on automation
 Use configuration management
 Build in redundancy based on business needs
Cloud Securit...
Cloud types:
Public, Private, and Hybrid
Cloud Security // ISACA San Antonio 2013-09-24 18
Benefits
 Public: easily expandable and cheap
 Private: host with provider or host internally,
fewer noisy neighbor issu...
Let’s go through
your questions
Cloud Security // ISACA San Antonio 2013-09-24 20
What due diligence should
a company perform when
selecting cloud services?
Cloud Security // ISACA San Antonio 2013-09-24 ...
Due diligence
 Easy answer: Assess a cloud provider just as you
would any other provider of IT services
 Look for busine...
What are some
good contractual
agreement clauses?
Cloud Security // ISACA San Antonio 2013-09-24 23
Contractual agreements
 Confidentiality and security requirements
 Encryption standards*
 Service description and SLA’s...
What are the risks
if the company
owns the servers?
Cloud Security // ISACA San Antonio 2013-09-24 25
Company-owned server risks
 Similar to self-hosted or vendor-hosted IT
services on dedicated equipment
 IT staff that ma...
Does the internet-facing
nature of public cloud
create additional risks?
Cloud Security // ISACA San Antonio 2013-09-24 27
Public cloud networking risks
 About the same as internet-facing dedicated
hardware
 Some public clouds may have hardwar...
How do I securely store
data in cloud services?
Cloud Security // ISACA San Antonio 2013-09-24 29
Storing data in cloud
 Your data is never fully safe in any storage
 Understand your most probable threats first
 Make ...
Thanks for inviting me!
Q&A?
Cloud Security // ISACA San Antonio 2013-09-24 31
Have more questions later?
major.hayden@rac...
Cloud Security
Major Hayden, Rackspace
Upcoming SlideShare
Loading in …5
×

ISACA Cloud Security Presentation 2013-09-24

565 views

Published on

Delivered for ISACA's San Antonio chapter on September 24th, 2013. Covers cloud security and related questions from IT auditors.

Published in: Technology, Health & Medicine
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
565
On SlideShare
0
From Embeds
0
Number of Embeds
67
Actions
Shares
0
Downloads
14
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide
  • What is cloud hosting?What changes does it bring?How can you host applications in cloud safely?
  • Evolution of water utilities is similar to the evolution of cloud
  • Assemble your own buckets, maintain themSpend time dragging buckets to the river and backAdding water-carrying capacity is hard workAll costs fixed
  • Rent buckets, no maintenanceStill spend time dragging buckets to the river and backAdding water-carrying capacity is slightly less difficultAlmost all costs fixed
  • Rent buckets, no maintenanceSomeone else hauls your buckets to the river and back for youAdding water-carrying capacity depends on bucket vendor’s capacityAlmost all costs variable
  • No more buckets neededWater is transported to a place very close to your homeAdding capacity is quick – just pull more waterAll costs variable
  • ISACA Cloud Security Presentation 2013-09-24

    1. 1. Cloud Security Major Hayden, Rackspace
    2. 2. Why are we here today? Cloud Security // ISACA San Antonio 2013-09-24 2
    3. 3. Who am I?  Chief Security Architect at Rackspace  Red Hat Certified Architect and MySQL DBA  Five years of cloud operations experience  Integrated Slicehost with Rackspace  Launched Rackspace’s Cloud Servers product based on Slicehost technology  Launched Rackspace’s Open Cloud Servers powered by OpenStack Cloud Security // ISACA San Antonio 2013-09-24 3
    4. 4. Today’s big three 1. An understandable and repeatable definition of cloud really does exist (and I’ll help you learn it) 2. There are different cloud deployment strategies and you can secure each of them 3. Cloud hosting risks are very similar to the risks from other IT hosting methods Cloud Security // ISACA San Antonio 2013-09-24 4
    5. 5. What is cloud hosting? Cloud Security // ISACA San Antonio 2013-09-24 5
    6. 6. Cloud hosting is a shift from managing computers to utilizing computing resources Cloud Security // ISACA San Antonio 2013-09-24 6
    7. 7. Cloud Security // ISACA San Antonio 2013-09-24 7
    8. 8. Cloud Security // ISACA San Antonio 2013-09-24 8 Colocation Dedicated Managed Cloud
    9. 9. Cloud Security // ISACA San Antonio 2013-09-24 9 Colocation Dedicated Managed Cloud
    10. 10. Cloud Security // ISACA San Antonio 2013-09-24 10 Colocation Dedicated Managed Cloud
    11. 11. Cloud Security // ISACA San Antonio 2013-09-24 11 Colocation Dedicated Managed Cloud
    12. 12. Key points  Resources are always available  Pay for what you use  Fewer fixed costs, more variable costs  Maintain business focus Cloud Security // ISACA San Antonio 2013-09-24 12
    13. 13. Cloud hosting brings new challenges Cloud Security // ISACA San Antonio 2013-09-24 13
    14. 14. Homes vs. Apartments Cloud Security // ISACA San Antonio 2013-09-24 14 Flickr: atelier_tee Flickr: oldtasty
    15. 15. Key points  Can’t choose your neighbors  Fluctuating performance  Stay within the confines of the system  Service providers can touch your data* Cloud Security // ISACA San Antonio 2013-09-24 15
    16. 16. Cattle vs. Pets (Credit goes to Gavin McCance at CERN for this analogy) Cloud Security // ISACA San Antonio 2013-09-24 16
    17. 17. Key points  Rely on automation  Use configuration management  Build in redundancy based on business needs Cloud Security // ISACA San Antonio 2013-09-24 17
    18. 18. Cloud types: Public, Private, and Hybrid Cloud Security // ISACA San Antonio 2013-09-24 18
    19. 19. Benefits  Public: easily expandable and cheap  Private: host with provider or host internally, fewer noisy neighbor issues, compliance is easier  Hybrid: helpful for bridging into cloud, allows for the workloads to run where they run best Cloud Security // ISACA San Antonio 2013-09-24 19
    20. 20. Let’s go through your questions Cloud Security // ISACA San Antonio 2013-09-24 20
    21. 21. What due diligence should a company perform when selecting cloud services? Cloud Security // ISACA San Antonio 2013-09-24 21
    22. 22. Due diligence  Easy answer: Assess a cloud provider just as you would any other provider of IT services  Look for business practice and security maturity  Test the provider thoroughly ahead of time  Monitor the provider’s actions closely around outages or when receiving support Cloud Security // ISACA San Antonio 2013-09-24 22
    23. 23. What are some good contractual agreement clauses? Cloud Security // ISACA San Antonio 2013-09-24 23
    24. 24. Contractual agreements  Confidentiality and security requirements  Encryption standards*  Service description and SLA’s  Indemnification Cloud Security // ISACA San Antonio 2013-09-24 24
    25. 25. What are the risks if the company owns the servers? Cloud Security // ISACA San Antonio 2013-09-24 25
    26. 26. Company-owned server risks  Similar to self-hosted or vendor-hosted IT services on dedicated equipment  IT staff that maintain the servers will have some level of access to virtual machine data Cloud Security // ISACA San Antonio 2013-09-24 26
    27. 27. Does the internet-facing nature of public cloud create additional risks? Cloud Security // ISACA San Antonio 2013-09-24 27
    28. 28. Public cloud networking risks  About the same as internet-facing dedicated hardware  Some public clouds may have hardware networking devices such as firewalls or load balancers  Other providers might provide a shared firewall or load balancer environment to use Cloud Security // ISACA San Antonio 2013-09-24 28
    29. 29. How do I securely store data in cloud services? Cloud Security // ISACA San Antonio 2013-09-24 29
    30. 30. Storing data in cloud  Your data is never fully safe in any storage  Understand your most probable threats first  Make your data less useful to others  Encryption with digital signatures  Sharding  Tokenization (can help with data transport laws)  Hardware Security Module (HSM) Cloud Security // ISACA San Antonio 2013-09-24 30
    31. 31. Thanks for inviting me! Q&A? Cloud Security // ISACA San Antonio 2013-09-24 31 Have more questions later? major.hayden@rackspace.com http://major.io/
    32. 32. Cloud Security Major Hayden, Rackspace

    ×