SlideShare a Scribd company logo
1 of 166
<Your company>
Rel. 1, Ver. 0 <Date>
<Company>
Business Continuity Plan
By Paul Kirvan, CISA, CSSP, FBCI, CBCP
Emergency notification contacts
Name
Address
Home
Mobile phone
Revisions control page
Date
Summary of changes made
Changes made by (Name)
Purpose
The purpose of this business continuity plan is to prepare
<Company> in the event of extended service outages caused by
factors beyond our control (e.g., natural disasters, man-made
events), and to restore services to the widest extent possible in a
minimum time frame. All <Company> sites are expected to
implement preventive measures whenever possible to minimize
operational disruptions and to recover as rapidly as possible
when an incident occurs.
The plan identifies vulnerabilities and recommends necessary
measures to prevent extended voice communications service
outages. It is a plan that encompasses all <Company> system
sites and operations facilities.Scope
The scope of this plan is limited to <describe>. This is a
business continuity plan, not a daily problem resolution
procedures document.
Plan objectives
· Serves as a guide for the <Company> recovery teams.
· References and points to the location of critical data.
· Provides procedures and resources needed to assist in
recovery.
· Identifies vendors and customers that must be notified in the
event of a disaster.
· Assists in avoiding confusion experienced during a crisis by
documenting, testing and reviewing recovery procedures.
· Identifies alternate sources for supplies, resources and
locations.
· Documents storage, safeguarding and retrieval procedures for
vital records.
Assumptions
· Key people (team leaders or alternates) will be available
following a disaster.
· A national disaster such as nuclear war is beyond the scope of
this plan.
· This document and all vital records are stored in a secure off-
site location and not only survive the disaster but are accessible
immediately following the disaster.
· Each support organization will have its own plan consisting of
unique recovery procedures, critical resource information and
procedures.
Disaster definition
Any loss of utility service (power, water), connectivity (system
sites), or catastrophic event (weather, natural disaster,
vandalism) that causes an interruption in the service provided
by <Company> operations. The plan identifies vulnerabilities
and recommends measures to prevent extended service outages.
Recovery teams
· Emergency management team (EMT)
· Disaster recovery team (DRT)
· IT technical services (IT)
See Appendix A for details on the roles and responsibilities of
each team.
Team member responsibilities
· Each team member will designate an alternate
· All of the members should keep an updated calling list of their
work team members’ work, home, and cell phone numbers both
at home and at work.
· All team members should keep this plan for reference at home
in case the disaster happens after normal work hours. All team
members should familiarize themselves with the contents of this
plan.
Instructions for using the business continuity plan
Invoking the plan
This plan becomes effective when a disaster occurs. Normal
problem management procedures will initiate the plan, and
remain in effect until operations are resumed at the original
location or a replacement location and control is returned to the
appropriate functional management.
Disaster declaration
The senior management team, with input from the EMT, DRT
and IT, is responsible for declaring a disaster and activating the
various recovery teams as outlined in this plan.
In a major disaster situation affecting multiple business units,
the decision to declare a disaster will be determined by
<Company> senior management. The EMT and DRT will
respond based on the directives specified by senior
management.
Notification
Regardless of the disaster circumstances, or the identity of the
person(s) first made aware of the disaster, the EMT and DRT
must be activated immediately in the following cases:
· Two or more systems and/or sites are down concurrently for
three or more hours
· Five or more systems and/or sites are down concurrently for
three or more hours
· Any problem at any system or network facility that would
cause either of the above conditions to be present or there is
certain indication that either of the conditions are about to
occur
External communications
Corporate public relations personnel are designated as the
principal contacts with the media (radio, television, and print),
regulatory agency, government agencies, and other external
organizations following a formal disaster declaration.
Emergency management standards
Data backup policy
Full and incremental backups preserve corporate information
assets and should be performed on a regular basis for audit logs
and files that are irreplaceable, have a high replacement cost, or
are considered critical. Backup media should be stored in a
secure, geographically separate location from the original and
isolated from environmental hazards.
Department-specific data and document retention policies
specify what records must be retained and for how long. All
organizations are accountable for carrying out the provisions of
the instruction for records in their organization.
IT follows these standards for its data backup and archiving:
Tape retention policy
Backup media is stored at locations that are secure, isolated
from environmental hazards, and geographically separate from
the location housing the system.
Billing tapes
· Tapes greater than three years old are destroyed every six
months.
· Tapes less than three years old must be stored locally off-site.
· The system supervisor is responsible for the transition cycle of
tapes.
System image tapes
· A copy of the most current image files must be made at least
once per week.
· This backup must be stored offsite.
· The system supervisor is responsible for this activity.
Off-site storage procedures
· Tapes and disks, and other suitable media are stored in
environmentally secure facilities.
· Tape or disk rotation occurs on a regular schedule coordinated
with the storage vendor.
· Access to backup databases and other data is tested annually.
Emergency management procedures
The following procedures are to be followed by system
operations personnel and other designated <Company>
personnel in the event of an emergency. Where uncertainty
exists, the more reactive action should be followed to provide
maximum protection and personnel safety.
Note:Anyone not recognized by the IT staff as normally having
business in the area must be challenged by the staff who should
then notify security personnel.
These procedures are furnished to <Company> management
personnel to take home for reference. Several pages have been
included to supply emergency contacts.
In the event of any situation where access to a building housing
a system is denied, personnel should report to alternate
locations. Primary and secondary locations are listed below.
Alternate locations Workplace: <Name>
· Attempt to contact your immediate supervisor or management
via telephone. Home and cell phone numbers are included in
this document
Workplace: <Name>
· Attempt to contact your immediate supervisor or management
via telephone. Home and cell phone numbers are included in
this document
Workplace:<Name>
via telephone. Home and cell phone numbers are included in
this document
In the event of a natural disaster
In the event of a major catastrophe affecting <Company>
facility, immediately notify the <Name or title of person>.
Procedure
STEP
ACTION
1
Notify EMT and DRT of pending event, if time permits.
2
If the impending natural disaster can be tracked, begin
preparation of site within 48 hours as follows:
· Deploy portable generators with fuel within 100 miles.
· Deploy support personnel, tower crews, and engineering
within 100 miles.
· Deploy tractor trailers with replacement work space, antennas,
power, computers and phones.
· Facilities department on standby for replacement shelters
· Basic necessities are acquired by support personnel when
deployed:
· Cash for one week
· Food and water for one week
· Gasoline and other fuels
· Supplies, including chainsaws, batteries, rope, flashlights,
medical supplies, etc.
3
24 hours prior to event:
· Create an image of the system and files
· Back up critical system elements
· Verify backup generator fuel status and operation
· Create backups of e-mail, file servers, etc.
· Fuel vehicles and emergency trailers
· Notify senior management
In the event of a fire
If fire or smoke is present in the facility, evaluate the situation,
determine the severity, categorize the fire as major or minor and
take the appropriate action as defined in this section. Call 9-1-1
as soon as possible if the situation warrants it.
· Personnel are to attempt to extinguish minor fires (e.g., single
hardware component or paper fires) using hand-held fire
extinguishers located throughout the facility. Any other fire or
smoke situation will be handled by qualified building personnel
until the local fire department arrives.
· In the event of a major fire, call 9-1-1 and immediately
evacuate the area.
· In the event of any emergency situation, system security, site
security and personal safety are the major concerns. If possible,
the operations supervisor should remain present at the facility
until the fire department has arrived.
· In the event of a major catastrophe affecting the facility,
immediately notify senior management.
Procedure
STEP
ACTION
1
Dial 9-1-1 to contact the fire department.
2
Immediately notify all other personnel in the facility of the
situation and evacuate the area.
3
Alert emergency personnel on:
<PHONE NUMBERS>
Provide them with your name, extension where you can be
reached, building and room number, and the nature of the
emergency. Follow all instructions given.
4
Alert the EMT and DRT.
Note: During non-staffed hours, security personnel will
notify the Senior Executive responsible for the location
directly.
5
Notify Building Security.
Local security personnel will establish security at the location
and not allow access to the site unless notified by the Senior
Executive or his/her designated representative.
6
Contact appropriate vendor personnel to aid in the decision
regarding the protection of equipment if time and circumstance
permit.
7
All personnel evacuating the facilities will meet at their
assigned outside location (assembly point) and follow
instructions given by the designed authority. Under no
circumstances may any personnel leave without the consent of
supervision.
In the event of a network services provider outage
In the event of a network service provider outage to any
location, the guidelines and procedures in this section are to be
followed.
Procedure
STEP
ACTION
1
Notify senior management of outage.
Determine cause of outage and timeframe for its recovery.
2
If outage will be greater than one hour, route all calls via
alternate services.
If it is a major outage and all carriers are down and downtime
will be greater than 12 hours, deploy satellite phones, if
available.
In the event of a flood or water damage
In the event of a flood or broken water pipe within any
computing facilities, the guidelines and procedures in this
section are to be followed.
Procedure
STEP
ACTION
1
Assess the situation and determine if outside assistance is
needed; if this is the case, dial 9-1-1 immediately.
2
Immediately notify all other personnel in the facility of the
situation and be prepared to cease voice operations accordingly.
3
Immediately notify all other personnel in the facility of the
situation and be prepared to cease operations accordingly.
4
Water detected below the raised floor may have different
causes:
· If water is slowly dripping from an air conditioning unit and
not endangering equipment, contact repair personnel
immediately.
· If water is of a major quantity and flooding beneath the floor
(water main break), immediately implement power-down
procedures. While power-down procedures are in progress,
evacuate the area and follow management’s instructions.
Plan review and maintenance
This plan must be reviewed semiannually and exercised on an
annual basis. The test may be in the form of a walk-through,
mock disaster, or component testing. Additionally, with the
dynamic environment present within <Company>, it is
important to review the listing of personnel and phone numbers
contained within the plan regularly.
The hard-copy version of the plan will be stored in a common
location where it can be viewed by site personnel and the EMT
and DRT. Electronic versions will be available via <Company>
network resources as provided by IT. Each recovery team will
have its own directory with change management limited to the
recovery plan coordinator.
Alert/Verification/Declaration phase (x-x hours)Plan checklists
Response and recovery checklists and plan flow diagrams are
presented in the following two sections. The checklists and flow
diagrams may be used by IT members as "quick references"
when implementing the plan or for training purposes.
(
Insert checklists and other relevant procedure documents here.
)
Plan checklists
Initials
Task to be completed
Flow diagrams
(
Insert flow diagrams and other relevant procedure documents
here.
)
Notification of incident affecting the site
On-duty personnel responsibilities
If in-hours:
Upon observation or notification of a potentially serious
situation during working hours at a system/facility, ensure that
personnel on site have enacted standard emergency and
evacuation procedures if appropriate and notify the EMT and
DRT.
If outside hours:
IT personnel should contact the EMT and DRT.
Provide status to EMT and DRT
Contact EMT and/or DRT and provide the following
information when any of the following conditions exist: (See
Appendix B for contact list.)
· Two or more facilities are down concurrently for three or more
hours.
· Any problem at any system or location that would cause the
above condition to be present or there is certain indication that
the above condition is about to occur.
The EMT will provide the following information:
· Location of disaster
· Type of disaster (e.g., fire, hurricane, flood)
· Summarize the damage (e.g., minimal, heavy, total
destruction)
· Meeting location that is a safe distance from the disaster scene
· An estimated timeframe of when a damage assessment group
can enter the facility (if possible)
· The EMT will contact the respective market team leader and
report that a disaster involving voice communications has taken
place.
The EMT and/or DRT will contact the respective <Company>
team leader and report that a disaster has taken place.
Decide course of action
Based on the information obtained, the EMT and/or DRT need
to decide how to respond to the event: mobilize IT,
repair/rebuild existing site (s) with location staff, or relocate to
a new facility.
Inform team members of decision
If a disaster is not declared, the location response team will
continue to address and manage the situation through its
resolution and provide periodic status updates to the EMT/DRT.
If a disaster is declared, the EMT and/or DRT will notify IT
Tech Services immediately for deployment.
Declare a disaster if the situation is not likely to be resolved
within predefined time frames. The person who is authorized to
declare a disaster must also have at least one backup person
who is also authorized to declare a disaster in the event the
primary person is unavailable.
Contact general vendors (see Appendix I)
Disaster declared: Mobilize incident response/Technical
services teams/Report to command center
Once a disaster is declared, the DRT is mobilized. This team
will initiate and coordinate the appropriate recovery actions.
Members assemble at the designated location as quickly as
possible. See Appendix E for emergency locations.
Conduct detailed damage assessment (This may also be
performed prior to declaring a disaster.)
1. Under the direction of local authorities and/or EMT/DRT,
assess the damage to the affected location and/or assets. Include
vendors/providers of installed equipment to ensure that their
expert opinion regarding the condition of the equipment is
determined ASAP.
A. Participate in a briefing on assessment requirements,
reviewing:
(1) Assessment procedures
(2) Gather requirements
(3) Safety and security issues
NOTE: Access to the facility following a fire or potential
chemical contamination will likely be denied for 24 hours or
longer.
B. Document assessment results using assessment and
evaluation forms
contained in Appendix G.
Building access permitting:
· Conduct an on-site inspection of affected areas to assess
damage to essential hardcopy records (files, manuals, contracts,
documentation, etc.) and electronic data.
· Obtain information regarding damage to the facility (s) (e.g.,
environmental conditions, physical structure integrity, furniture,
and fixtures) from the DRT.
2. Develop a restoration priority list, identifying facilities,
vital records and equipment needed for resumption activities
that could be operationally restored and retrieved quickly.
3. Recommendations for required resources.Contact DRT:
Decide whether to continue to business recovery phase
The EMT and DRT gather information regarding the event;
contacts senior management and provides them with detailed
information on status.
Based on the information obtained, senior management decides
whether to continue to the business recovery phase of this plan.
If the situation does not warrant this action, continue to address
the situation at the affected site(s).
Business recovery phase (xx hours - full recovery)
This section documents the steps necessary to activate business
recovery plans to support full restoration of systems or facility
functionality at an alternate/recovery site that would be used for
an extended period of time. Coordinate resources to reconstruct
business operations at the temporary/permanent system location,
and to deactivate recovery teams upon return to normal business
operations.
<Company> system and facility operation requirements
The system and facility configurations for each location are
important to re-establish normal operations. A list for each
location will be included in Appendix F.
Notify IT staff/Coordinate relocation to new facility
See Appendix A for IT staff associated with a new location
being set up as a permanent location (replacement for site).
Secure funding for relocation
Make arrangements in advance with suitable backup location
resources. Make arrangements in advance with local banks,
credit card companies, hotels, office suppliers, food suppliers
and others for emergency support.
Notify EMT and corporate business units of recovery startup
Using the call list in Appendix B, notify the appropriate
company personnel. Inform them of any changes to processes or
procedures, contact information, hours of operation, etc. (This
may be used for media information.)
Operations recovered
Assuming all relevant operations have been recovered to an
alternate site, and employees are in place to support operations,
the company can declare that it is functioning in a normal
manner at the recovery location.
AppendixesAppendix A: <Company> recovery teams
Emergency management team (EMT)
Note: See Appendix B for contact list. Suggested members to
include: senior management, human resources, corporate public
relations, legal, IT services, risk management and operations
Charter:
Responsible for overall coordination of the disaster recovery
effort; evaluation and determining disaster declaration; and
communications with senior management.
Support activities:
The EMT:
· Evaluate which recovery actions should be invoked and
activate the recovery teams
· Evaluate damage assessment findings
· Set restoration priority based on the damage assessment
reports
· Provide senior management with ongoing status information
· Act as a communication channel to corporate teams and major
customers
· Work with vendors and IRT to develop a rebuild/repair
schedule
Disaster recovery team
Note: See Appendix B for contact list
Charter:
Responsible for overall coordination of the disaster recovery
effort; establishment of the emergency command area; and
communications with senior management and the EMT.
Support activities:
· Coordinate with EMT and senior management
· Determine recovery needs
· Establish command center and assembly areas
· Notify all company department heads and advise them to
activate their plan(s) if applicable, based upon the disaster
situation
· If no disaster is declared, take appropriate action to return to
normal operations using regular staff
· Determine if vendors or other teams are needed to assist with
detailed damage assessment
· Prepare post-disaster debriefing report
· Coordinate the development of site-specific recovery plans
and ensure they are updated semi-annually
IT technical services (IT)
Charter
IT will facilitate technology restoration activities.
Support activities
· Upon notification of disaster declaration, review and provide
support as follows:
1. Facilitate technology recovery and restoration activities,
providing guidance on replacement equipment and systems, as
required
2. Coordinate removal of salvageable equipment at disaster site
that may be used for alternate site operations
Appendix B: Recovery team contact lists
Emergency management team (EMT)
Name
Address
Home
Mobile/Cell Phone
Disaster recovery team (DRT)
Name
Address
Home
Mobile/Cell Phone
IT technical services
Name
Address
Home
Mobile/Cell Phone
Appendix C: Emergency numbers
First responders, public utility companies, others
Name
Contact Name
Phone
Appendix D: Contact list
Name
Address
Home
Mobile/Cell Phone
Appendix E: Emergency command center (ECC) locations
Emergency command center - <location name>
Primary: Address
Room XXXX
City, State
Contact: “coordinator of rooms/space - (xxx) xxx-xxxx
Alternate: Address
Room XXX
City, State
Contact: “coordinator of rooms/space - (xxx) xxx-xxxx
Emergency command center - <location name>
Primary: Address
Room XXXX
City, State
Contact: “coordinator of rooms/space - (xxx) xxx-xxxx
Alternate: Address
Room XXX
City, State
Contact: “coordinator of rooms/space -
(xxx) xxx-xxxx
Appendix F: Forms
Incident/disaster form
Upon notification of an incident/disaster situation the on-duty
personnel will make the initial entries into this form. It will
then be forwarded to the ECC, where it will be continually
updated. This document will be the running log until the
incident/disaster has ended and “normal business” has resumed.
TIME AND DATE
_____________________________________________________
___________________
TYPE OF EVENT
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
LOCATION
_____________________________________________________
___________________
_____________________________________________________
___________________
BUILDING ACCESS ISSUES
_____________________________________________________
___________________
_____________________________________________________
___________________
PROJECTED IMPACT TO OPERATIONS
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
RUNNING LOG (ongoing events)
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
_____________________________________________________
___________________
Critical equipment status form
CRITICAL EQUIPMENT STATUS
ASSESSMENT AND EVALUATION FORM
Recovery team:
__________________________________________
[----------STATUS---------]
EquipmentConditionSalvageComments
1. ___________________ ______________ ______
_________________________
2. ___________________ ______________ ______
_________________________
3. ___________________ ______________ ______
_________________________
4. ___________________ ______________ ______
_________________________
5. ___________________ ______________ ______
_________________________
6. ___________________ ______________ ______
_________________________
7. ___________________ ______________ ______
_________________________
8. ___________________ ______________ ______
_________________________
9. ___________________ ______________ ______
_________________________
10. __________________ ______________ ______
_________________________
11. __________________ ______________ ______
_________________________
12. __________________ ______________ ______
_________________________
13. __________________ ______________ ______
_________________________
14. __________________ ______________ ______
_________________________
15. __________________ ______________ ______
_________________________
Legend
Condition: OK - Undamaged
DBU - Damaged, but usable
DS - Damaged, requires salvage before use
D - Destroyed, requires reconstruction
Appendix G: Building evacuation information
(
Provide evacuation procedures
)
Appendix H: Inventory of primary equipment and network
services
(
Provide list of equipment and network services
)
Appendix I: Inventory of backup equipment and systems
(
Provide list of equipment
)
Appendix J: Approved vendor list
Server and computer equipment suppliers
Company Name
Contact
Work
Mobile phone
Communications and network services suppliers
Company Name
Contact
Work
Mobile phone
1
All Rights Reserved, 2010, TechTarget
<Company> RESTRICTED
Case Study: After reviewing the case studies (Security and
Privacy on Social Networking Sites, Security for social
networking, Social Networking and Security Risks & WP
Security Guide to Social Networks) use the Finding Page
document and answer (A) What are the security and privacy
risks associated with social networking and (B) what are the
issues, procedures & best practices companies should implement
and (C) how else can you minimizing risks?
Internet/Exercise Problem: Enter and surf the term “Disaster
Recovery Testing Services” in search and find 3 companies that
provide those services/tools, then use the Finding Page
document and answer/evaluate (A) what are some of the
tools/services being offered and (B) what are the benefits of
using these outside services versus in-house, how effectively
can they be and (C) after reviewing these templates (Business
Continuity Test Template, BCP-template, T-BC8000-exercise-
template, DR7000-test-lessons-learned & F-DR7000-test-
objectoves-by-team) what are the key components, what’s their
value, usefulness for the organization?
www.pwc.com/security
Navigating security
in the cloud
Advisory Services
Security
Cloud computing is rapidly moving into the
mainstream. The benefits are undeniable, but
look at whether your security needs are met.
The heart of the matter
...............................................................................................
......... 1
An in-depth discussion
...............................................................................................
........ 2
What this means for your business
................................................................................... 10
Contacts
...............................................................................................
............................... 11
Table of contents
1
The heart of the matter
Cloud computing has proved it can deliver lower IT costs,
diminished infrastructure
complexity, and enhanced flexibility. As the technology
advances into the mainstream,
organizations are finding that it also can spur innovation by
lowering the financial
barriers to creating new products and services.
Consider, for instance, a global pharmaceutical company. To
rapidly investigate and
develop new products, this drugmaker needed to quickly spin up
computing burst
capacity to run data – and processor-intensive algorithms for
modeling, simulations, and
visualizations.
After thoughtful consideration, the pharmaceutical company
deployed select R&D
environments to multiple cloud providers. The result? The
cloud’s on-demand, high-
performance computing capabilities have enabled the company
to rapidly deploy new test
environments, which has dramatically reduced the cycle time
from idea to execution. For
instance, the company can provision a 64-machine cluster
computer and complete a
sequence set in 20 minutes – rather than 12 weeks – at a cost of
less than $7. Rapid
delivery of new computing environments has helped this
pharmaceutical company’s
scientists make quick decisions on drug research and has
significantly lowered the cost of
innovation.
The drugmaker’s experience illustrates a newfound power of
cloud computing: A strategic
ability to drive business growth, rather than simply delivering
efficient IT services at a
lower cost.
As the function of cloud computing expands, so does the need
for effective security. Chief
Information Security Officers (CISOs) understand that, while
security for cloud
computing is no different than security controls for any IT
environment, the stakes can be
perilously higher. This is because the possibilities of data loss,
data leakage, service
downtime, regulatory constraints, and risk of intellectual
property theft are amplified in
the cloud model.
Accordingly, significant security hurdles must be cleared before
a business implements
cloud computing. Organizations must first carefully assess
which of its applications and
data are appropriate to move to a cloud environment. The
company also must
strenuously evaluate the capabilities of any potential cloud
services provider, including
factors such as data security and privacy, compliance,
availability, and scalability. At the
same time, it is important to consider the portability of data and
applications to ensure
that organizations can move to a new provider should an
existing vendor fail to deliver
agreed-upon service levels.
As cloud computing matures, organizations are beginning to
understand that its benefits
extend beyond lower IT costs and higher operating efficiencies.
But without careful
planning and consideration of market concerns, these gains can
be overshadowed by
risks.
2
An in-depth discussion
Demand for cloud computing services has been fueled by the
lingering effects of the
global recession, which forced many organizations to trim costs
while meeting increased
customer demands. While this “do more with less” mandate
remains a priority for most
companies, many chief executives have turned their focus to
growth – and to cloud
computing.
Today, business leaders recognize that
the cloud presents a powerful new
opportunity to drive business growth
while meeting the challenges of cost
containment. Its elastic architecture
can spur innovation by lowering the
financial barrier to trying new ideas and
speeding the time to market for new
products and services. Some
companies, in fact, are using the cloud
model to create new lines of business by
partnering with external providers.
Given these benefits, it isn’t surprising
that cloud computing is evolving from
experimental to mainstream. PwC’s
2012 Global State of Information
Security Survey of more than 9,600
security and IT leaders found that four
out of 10 (41%) respondents said their
business already uses cloud services.
Adoption of the cloud is expected to
skyrocket during this decade: Forrester
Research forecasts that the global
market for cloud computing services
will soar from $40.7 billion in 2011 to more than $241 billion in
2020.1
One reason for this growth spike is the continuous maturity of
cloud computing suppliers
and trust of cloud service consumers. Tentative early
implementations of cloud services
have given way to large-scale deployments of business
functions such as customer
relationship management (CRM), talent management, payroll,
and enterprise
communications and collaboration.
Early implementations of cloud computing proved that the
cloud’s pay-as-you-go
structure can trim IT spending and boost agility. It also allows a
business to take
1 Forrester Research, Inc., Sizing the Cloud, April 2011
2%
47%
69%
33%
Do not know
Infrastructure as a Service
Software as a Service
Platform as a Services
Saas leads cloud deployments
41% of respondents to PwC’s 2012 Global
State of Information Security Survey say
they have deployed some form of cloud
computing. Most (69%) use Saas.
3
advantage of up-to-the-minute technologies without prohibitive
up-front investments in
hardware and software.
The cloud model can save money by recapturing the lost value
of underutilized hardware.
Infrastructure resources often sit idle
in most organizations: PCs and servers,
for instance, are used at only 10% of
their processing capacity, while
network storage is utilized at 50%
capacity.
With cloud services, hardware and
applications are used (and paid for) on
demand. The service provider can scale
or add capacity on the fly to adjust to
fluctuations in demand. As noted with
the pharmaceutical company above,
R&D computing resources can be
deployed in a matter of minutes; the
business need not install and configure
new hardware or software.
The cloud model, if executed properly,
also provides built-in redundancy with
no single point of failure. Service level
agreements (SLAs) that formally define
expectations for issues such as
availability, reliability, and
performance can provide flexibility
while decreasing downtime. Cloud
computing also can enable in-network
redundancy with automated recovery
to help eliminate disaster recovery
risks and costs.
The cloud model offers another critical
step toward IT agility: full customer
self-service. This enables businesses to
provision, manage, and terminate
services without involving the service
provider. The result? Speedy, efficient
management of IT services and
functions.
Finally, we are seeing new cloud
solutions that empower employees to
collaborate across departmental
What’s in a cloud? A definition
Despite maturation of the industry, a precise
definition of cloud computing remains
somewhat elusive. To clarify, we will use the
description published by the National Institute
of Standards and Technology (NIST). The
institute defines cloud computing as a model for
enabling convenient, on-demand network access
to a shared pool of configurable computing
resources that can be rapidly provisioned and
released with minimal management effort or
service provider interaction.
Cloud solutions are typically marketed and
described based on the type of services they
deliver. Three of the most common offerings are:
• Software as a service (SaaS): The
consumer employs a web browser to access a
provider’s applications running on a cloud
infrastructure. (Examples: NetSuite,
Salesforce.com, SuccessFactors)
• Platform as a service (PaaS): The
consumer deploys applications on a cloud
provider’s infrastructure but has no control
over the underlying network or servers.
(Examples: Google App Engine, Microsoft
Windows Azure, DotCloud)
• Infrastructure as a service (IaaS): The
consumer provisions resources on the
provider’s infrastructure and can control
operating systems, data, and applications –
but not the underlying infrastructure.
(Examples: Amazon.com EC2, Joyent,
Rackspace.)
Cloud computing is commonly delineated by
deployment model or service model. Today three
deployment models are dominant:
• Public: A public cloud infrastructure is
available to individual consumers or
businesses.
• Private: A private cloud is operated solely
for an organization and can be managed by
the organization or a third-party company,
on site or off site.
• Hybrid: A hybrid cloud comprises a mix of
public and private cloud infrastructures that
are discrete entities but are integrated to
allow interoperability of data and
applications.
4
boundaries, which can improve knowledge sharing and
efficiency in completing projects,
and ultimately boost innovation.
The realities and risks of the cloud
Any organization considering a move to the cloud must
understand both the inherent
shortcomings and strengths of cloud computing to reap its full
potential and value.
Among CISOs, threats to data security and privacy have always
been the dark side of the
cloud. Yet as organizations adopt cloud computing, many are
finding that security
delivered by service providers meets or beats their needs. In
fact, PwC’s 2012 Global State
of Information Security Survey found that 54% of companies
that have implemented
cloud computing report the technology has actually improved
their security posture.
Advanced security capabilities implemented by service
providers have persuaded
corporations, non-profit organizations, and governments to
entrust cloud service vendors
with a widening array of data and applications.
There is perhaps no better indicator of this newfound trust than
the US government’s
adoption of cloud-based solutions for several cabinet-level
agencies, including the
Department of Homeland Security, which is pursuing both
public and private cloud
solutions. In discussing their plans for cloud computing,
government officials cite the cost
savings of up to 10% and fast scalability of the cloud model, but
they also tout the
enhanced security of the cloud. 2
At the same time, standards organizations are focusing on
creating cloud security
guidelines. The NIST and the Cloud Security Alliance (CSA),
for example, have published
new guidance and standards for cloud implementations.
Despite these advances, security leaders are most concerned
about data privacy in the
cloud. Our 2012 Global State of Information Security Survey
found that 32% of
respondents believe the greatest security risk is an uncertain
ability to enforce the cloud
provider security policies. Another worry, cited by 11% of
respondents, is that data may be
stored on servers shared with other companies. Because these
servers can span multiple
geographies, an approach known as multi-tenancy, sensitive
information could be
governed by multiple – and sometimes conflicting –
jurisdictions.
CISOs also are well aware that the threat landscape today is
unparalleled, with
increasingly targeted – and effective – attacks perpetrated by
sophisticated, patient
intruders. The most serious of these threats originate from
organized crime groups and
nation states that have clandestinely launched a new generation
of complex advanced
persistent threats (APTs). At the same time, a growing
movement of “hacktivists”
representing loosely organized groups like Anonymous and
LulzSec are also preying upon
corporations and governments that run afoul of their political
and social convictions.
2 Testimony of Richard A. Spires, Chief Information Officer,
before the House
Committee on Homeland Security Subcommittee, October 6,
2011
http://www.dhs.gov/ynews/testimony/20111006-spires-cloud-
computing.shtm
5
Due to their sheer size, cloud-based service providers are
tempting targets. Cyber
criminals who gain access to a cloud data center can potentially
steal millions of customer
records, as well as valuable intellectual property and trade
secrets. And because cloud
providers often employ a multi-country infrastructure with
servers and employees
scattered across continents, the potential points of vulnerability
are multiplied.
And it’s not just hackers that keep security leaders awake at
night. Employees of cloud
providers, such as privileged system administrators and other
“super users,” may view or
leak sensitive information, potentially damaging a customer’s
security posture and
incurring costly reputational harm.
Similarly, insiders at a cloud consumer can unwittingly expose
the organization to the
same kinds of risk. Often, line of business managers purchase
cloud services without the
approval of IT or security leaders. These managers may mean
well, but they are typically
unaware of – and do not adhere to – security policies.
Another concern has been availability and reliability of
services, since outages can lead to
operational downtime that result in lost revenue or a blemished
reputation. It’s a hazard
that even the most respected cloud providers have occasionally
failed to avoid.
Data classification and data-handling practices employed by
cloud providers also concern
CISOs. Indeed, in several incidents, hackers have guessed user
passwords to gain access
to confidential documents stored in the cloud and then
forwarded those documents to
third parties. In other cases, cloud service providers simply lost
customer data.
Another area of concern is data storage practices. The cloud
model enables data to
bounce swiftly around the world on leased servers in far-flung
geographic locations. This
can be enormously complicated for organizations that must
comply with regulatory and
privacy regulations mandating where information can be stored,
processed, or accessed.
A German company with data residing in the United States, for
instance, is subject to
both US and German privacy and security laws and regulations.
The right data and applications for the cloud
Top-tier cloud service providers have implemented critical
controls and deployed
technologies to defend against these evolving threats. As cloud
security continues to
mature, their efforts have gained the trust of security leaders
and C-suite officers.
Nonetheless, any cloud implementation must be approached
with great caution and
strenuous assessment. Organizations must evaluate their current
infrastructure to
determine which sensitive data and applications should – and
should not – be sent to the
cloud.
PwC believes that moving non-differentiating business function
to the cloud would incur
minimum risk to the organization. This would include, for
example, human resources,
payroll, accounting, and CRM, as well as hosted applications
such as e-mail and web
conferencing.
6
Mission-critical data and intellectual property, however, should
remain within the
locked-down confines of the enterprise. Similarly, regulated
data like credit card
information and healthcare records should be sent to the cloud
only if the cloud supplier
has security controls that match or surpass those required by the
organization and its
regulators. It is imperative to remember that the business, and
not the cloud services
provider, is ultimately responsible for security and ownership of
this data.
When developing a business case to send data or applications to
the cloud, the business-
unit leader should work with IT and security personnel to
determine what data and
applications are appropriate for cloud computing. It also will be
necessary to factor in the
costs of working with IT and security teams to perform initial
and on-going assessments.
Organizations should develop a flexible, adaptable framework
to manage emerging
governance and compliance issues. CISOs should delineate risk
thresholds by working
with the service provider to create common controls that define
who is responsible for
risk, as well as which party owns responsibility for data in
transit and data at rest.
Before an enterprise moves data to the cloud, CISOs must
determine whether personally
identifiable information will be involved and whether
international regulatory laws
regarding export or transport controls are a concern. To that
end, the business must know
what data are subject to regulations such as those included in
the Health Insurance
Portability and Accountability Act (HIPAA), the Gramm-Leach-
Bliley Act, Payment Card
International Data Security Standard (PCI DSS), and the
Sarbanes-Oxley Act.
For data that may be subject to audit, the business must ensure
that the cloud service
provider has the technical capability to identify where, when,
and how data are used. PCI
auditors, for instance, will want to know where data is located,
where it has been, and
whether it has been accessed without record. HIPAA auditors,
on the other hand, will
require a firewall that doesn’t allow outsiders to make
application programming interface
(API) calls to their compute and storage systems, among other
requirements.
Assessing the cloud provider’s capabilities
Once the CIO and business leaders determine which services
and data to send to the
cloud, the CISO must implement the proper controls. Together,
IT and security
executives will then evaluate cloud service providers and their
security capabilities,
understand any gaps in protections, and, finally, select a
provider.
Today there is no standard attestation method or control
framework for cloud computing,
nor is there a one-size-fits-all implementation strategy;
deployment will be unique to
each individual business. To gain confidence in a potential
provider, a business should
perform due diligence using an accepted security control
framework; engaging an
independent adviser to help with this assessment is advisable
for many organizations.
Another option that is gaining favor among cloud consumers is
the use of a cloud broker.
A cloud broker can help IT and security leaders negotiate the
relationship with cloud
providers and manage the use, performance, and delivery of
cloud services. In addition to
7
helping organizations obtain and customize services, cloud
brokers can also help tailor
security capabilities.
Whether using a broker or approaching the cloud independently,
the following controls
are critical:
Contractual agreements: You own the data, so determine what
rights and
recourse you have for security breaches or incidents. Because
you have no control
over the cloud provider’s infrastructure, SLAs, contract
requirements, and provider
documentation play a more important role than in traditional IT
environments.
Access controls: The cloud provider should prove that it has
implemented and
enforces administrative controls to limit employee and
partner/supply chain access
to your information. It also should adequately investigate the
background of
employees who will have access to data.
Certification and third-party audits: Verify that the provider
has some form of
accepted third-party review of security (Statement on Standards
for Attestation
Engagements 16 or ISO 27001 certification, for instance). If
possible, seek
independent reviews of their facilities and operations. (See
sidebar.)
Compliance requirements: Determine whether the supplier
meets your
compliance needs. A critical factor will be the geographic
locations of the provider’s
servers; be aware of laws that impact your data in any country
in which it may reside.
Availability, reliability, and resilience: Enact agreements on
measurable
availability and reliability service levels. Understand your
options if the provider
does not meet agreed-upon levels.
Backup and recovery: In the event of disaster, document
recovery requirements
are in writing; understand a provider’s capabilities before you
engage it.
Decommissioning: Agree that data will be securely deleted
once it is no longer
needed. Also make certain that virtual machines or processes
are securely
decommissioned.
Portability: Determine whether you can easily move data and
applications to
another cloud provider or migrate data and applications back to
an on-premises
environment, if necessary. Before selecting a cloud provider,
make sure that it does
not use specialized or proprietary technologies that would
create vendor lock-in.
In addition, organizations should implement additional data
security controls (such as
information rights management and data leakage prevention) to
ensure that sensitive
data is not inadvertently moved to the cloud. Businesses also
should update their incident
response program to address cloud incidents, and ensure that
vendor agreements require
cloud providers to work with its customers during incidents.
8
An in-depth “secure the cloud” assessment
The next step is to perform a comprehensive risk-based
assessment of the cloud
environment. This overall security evaluation should include
factors such as access
management, security standards, information handling, patch
management, and event
monitoring and investigations.
The goal is to identify gaps in security protections offered by
cloud providers and
determine the most effective means to mitigate the risk to your
data, including
customizing cloud services to your needs or extending internal
security governance
measures to the cloud environment. A secondary objective is to
understand potential
ways data can be compromised and the
likelihood that it will happen.
When assessing cloud service suppliers, you
should apply company-specific risk ratings to
the evaluation. In doing so, pay particularly
close attention to how well a supplier will be
able to follow the letter of your security
policies. We believe that the best model is one
in which all outsourced data are encrypted
both in transit and in storage.
A “secure the cloud” approach should
encompass the following:
Security: The assessment of information
security should include, at a minimum,
data encryption, data storage location,
segregation, risk management, user
access, systems management, and
incident response.
• Privacy: Privacy can be assessed
using the generally accepted privacy
principles audit framework published by
the American Institute of Certified Public
Accountants/Canadian Institute of
Chartered Accountants. Organizations
should also use the privacy guidance that
is appropriate to their industry, such as
the Gramm-Leach-Bliley Act or the
Health Insurance Portability and
Accountability Act.
A new standard for independent
assessments
Independent certification of cloud
supplier capabilities is an uncertain
undertaking because a comprehensive
framework to measure cloud suppliers’
capabilities does not yet exist.
Typically, cloud providers offer self- or
third-party assessment using
independent control frameworks like SAS
70 Type 2 reports. The SAS 70 auditing
statement has been widely used to certify
cloud providers, although it was not
designed for this purpose.
SAS 70 has been replaced by the
Statement on Standards for Attestation
Engagements 16 (SSAE 16). Despite
minor differences, neither extends
beyond controls relevant to financial
reporting.
Other assessment options include the
Federal Information Security
Management Act (FISMA) and ISO
27001. These standards focus primarily
on traditional security issues, however,
and do not include cloud concerns such as
SLAs and multi-tenancy.
The American Institute of Certified Public
Accountants (AICPA) has released a new
standard for assessment of cloud service
providers. The AICPA’s Service
Organization Controls (SOC) reports
create an attestation standard designed to
address broad control considerations,
including security, privacy, availability,
confidentiality, and processing integrity.
SOC reports allow third-party auditors to
report on operational and compliance
controls that are relevant to cloud
services.
9
Scalability: Scalability is assessed by due diligence on aspects
such as load testing,
stress testing, and forecast growth.
Metering: Metering can be assessed by revenue-recognition
testing as well as due
diligence on the integrity and security of metering systems.
Availability: Availability can be measured by investigating
resilience of the
architectural components and reviews of data recovery and
information retrieval
aspects.
Data leakage: The likelihood of unauthorized disclosure of data
can be
examined by a risk assessment that specifically evaluates data-
leakage
vulnerabilities.
While businesses have no single official framework for
attestation of cloud providers, the
US government has developed an authorization framework as
part of its Cloud First
initiative. The framework, known as the Federal Risk and
Authorization Management
Program (FedRAMP), provides a standardized approach to
security assessment,
authorization, and continuous monitoring for cloud products and
services
This unified certification program was designed to achieve
consistent security
authorizations using agreed-upon standards and accredited
third-party assessment
organizations. All new cloud service providers must comply
with this framework, which is
largely based on existing FISMA controls. Cloud vendors that
are already doing business
with government agencies must attain FedRAMP compliance
within two years.
The Department of Homeland Security (DHS) has primary
responsibility for the
FedRAMP initiative. A Joint Authorization Board, which
comprises CIOs from the DHS,
the Department of Defense, and the General Services
Administration, reviews assessment
results conducted by third-party organizations and grants
authorization to service
providers. Once authorized, a cloud service provider is
recognized as meeting federal
security requirements and can be employed by other agencies
without an additional
assessment. This “approve once and use many” approach is
designed to help government
agencies quickly and cost-effectively assess and engage
providers.
FedRAMP illustrates the US government’s commitment to
accelerate the adoption of
cloud computing. Ultimately, FedRAMP will also increase
confidence in the security and
privacy of data stored on the cloud.
10
What this means for your
business
Cloud computing can transform the way you do business. Like
any transformation,
however, a successful cloud strategy requires a new mind-set –
and new tools – to help
ensure that security meets your specific needs.
If you haven’t developed a cloud strategy, now is the time to
start. Yet we urge you to
include security controls and periodic security assessments in
your strategy.
Implementation of a cloud solution demands a thorough analysis
of your business needs,
expected benefits, risks, and the capabilities of the cloud
service provider. We believe this
assessment is best undertaken with the assistance of a trusted
partner with a strong
strategic and technical vision. That is where we can help.
PwC can help you build data protection capabilities that align
with the shifting cloud
environment. We can perform a comprehensive “secure the
cloud” assessment to match
your company’s needs with a service provider’s offerings. Our
team of specialists can help
identify a service provider that is trustworthy, mature, and
capable of handling your
sensitive data and production applications.
With cloud computing, data security is a particularly critical
issue that requires highly
skilled guidance in planning and implementation. PwC is a
recognized, trusted leader in
security consulting with global expertise in the full range of
data protection, privacy, and
compliance solutions.
The benefits of cloud computing are undeniable. We believe it’s
time to get started on a
new strategic path. One that stretches to the clouds.
11
Contacts
To have a deeper conversation on cloud computing security or
on any of the topics
mentioned, please contact:
Gary Loveland
Principal, National Security Leader
[email protected]
John Hunt
Principal, Washington
[email protected]
Brad Bauch
Principal, Houston
[email protected]
Jerry Lewis
Principal, Dallas
[email protected]
Rik Boren
Partner, St. Louis
[email protected]
Mark Lobel
Principal, New York
[email protected]
Kevin Campbell
Partner, Atlanta
[email protected]
Sloane Menkes
Principal, Washington
[email protected]
Michael Compton
Principal, Detroit
[email protected]
Joe Nocera
Principal, Chicago
[email protected]
Shawn Connors
Principal, New York
[email protected]
Chris O’Hara
Principal, San Jose
[email protected]
Scott Evoy
Principal, Boston
[email protected]
Fred Rica
Principal, New York
[email protected]
Joe Greene
Principal, Minneapolis
[email protected]
Sohail Siddiqi
Principal, San Jose
[email protected]
Peter Harries
Principal, Phoenix
[email protected]
Andy Toner
Principal, New York
[email protected]
This content is for general information purposes only, and
should not be used as a substitute for consultation
with professional advisors.
© 2012 PricewaterhouseCoopers LLP. All rights reserved. PwC
refers to the United States member firm, and
may sometimes refer to the PwC network. Each member firm is
a separate legal entity. Please see
www.pwc.com/structure for further details.
mailto:[email protected]
ITEC 437: Disaster Recovery and Enterprise Continuity
Findings Page
Student Name
Class Deliverable Due date:
Information Sought:
Repeat the Question in this assignment
Answer A:
Answer B:
Answer C:
Exercise Comments (Not Graded):
Planning Guide
Cloud Security
SEPTEMBER 2011
Seven Steps for Building Security in the Cloud from
the Ground Up
Why you should read this document:
This guide provides practical information to help you integrate
security planning into your cloud computing initiatives and:
• Makes suggestions and recommendations for
strengthening
data and platform protection in cloud implementations.
• Provides guidance on encryption to protect data.
• Describes the importance of a trusted foundation to secure
platform and infrastructure.
• Explains how to build higher assurance into auditing to
strengthen compliance.
• Discusses extending trust across federated clouds.
Planning Guide
Cloud Security
Seven Steps for Building Security in the Cloud
from the Ground Up
Sponsors of Tomorrow.™
SEPTEMBER 2011
Intel IT Center Planning Guide | Cloud Security2
3 Security in the Cloud:
What It Is (and What It Isn’t)
5 Security Challenges for Cloud Environments
6 Step 1: Start Security Planning Early
10 Step 2: Identify Vulnerabilities for Your
Selected Service(s)
12 Step 3: Four Things an IT Manager Can Do
To Mitigate Security Vulnerabilities
13 Step 4: Protect Data—in Motion, in Process,
and at Rest
15 Step 5: Secure Your Platform
16 Step 6: Extend Trust across Federated Clouds
17 Step 7: Choose the Right Cloud Service Provider
19 Intel Resources for Learning More
Contents
Intel IT Center Planning Guide | Cloud Security3
Cloud Security:
What It Is (and What It Isn’t)
The cloud seems to be on everyone’s mind these days. If you’ve
been considering how to make the leap to cloud computing,
you’ve
also had to start thinking about how to extend security to this
new
technology environment. Despite potential savings in
infrastructure
costsand improved business flexibility, security is
still the number-
one barrier to implementing cloud initiatives for many
companies.
Cloud computing security is a broad topic with hundreds of
considerations—from protecting hardware and platform
technologies
in the data center to enabling regulatory compliance and
defending
cloud access through different end-point devices.
The focus
of this planning guide is to provide you with suggestions and
Cloud Security Is ...
• The response to a familiar set of security challenges that
manifest
differently in the cloud. New technologies and fuzzier
boundaries
surrounding the data center require a different approach.
• A set of policies, technologies, and controls designed to
protect data and infrastructure from attack and enable
regulatory compliance.
• Layered technologies that create a durable security net or
grid.
Security is more effective when layered at each level of the
stack
and integrated into a common management framework.
• The joint responsibility of your organization and its cloud
provider(s).
Depending on the cloud delivery model and services you
deploy,
responsibility for security comes from both parties.
Cloud Security Isn’t …
• A one-size-fits-all solution that can protect all
your IT assets. In
addition to different cloud delivery models, the cloud services
you
deploy will most likely require more than one approach to
security.
• A closed-perimeter approach or a “fill-the-
gap” measure.
Organizations can no longer rely on firewalls as a
single point
of control, and cobbling together security solutions to protect
a single vulnerability may leave you open in places you
don’t suspect.
• Something you can assume is provided at the level you
require
by your cloud service providers. Make sure you spell out and
can
verify what you require.
Security challenges in the cloud are familiar to any IT
manager—loss
of data, threats to the infrastructure, and compliance risk.
What’s
new is the way these threats play out in a cloud environment.
recommendations for strengthening data and platform protection
in
your cloud implementations. The remainder of this guide walks
you
through seven key steps that will help you plan your cloud
security
from the ground up.
Intel IT Center Planning Guide | Cloud Security4
Intel Experience with Cloud Security
Much of the information in this document comes from our
experience working with cloud providers, virtualization and
security solution vendors, OEMs, and large enterprise
customers—
as well as the experience of our own Intel IT building and
deploying
cloud technology.
Intel IT has embarked on a radical five-year
redesign of the Intel
information security architecture. This redesign moves us away
from
a traditional binary trust model to a multitiered trust model with
a
particular emphasis on data and people as the new perimeter.
This
new architecture is designed to support key initiatives such as
cloud
computing as well as IT consumerization.
Our Intel Cloud Builders1 program continues to yield
in-depth
guidance that you can use, including reference architectures,
education, and a forum for discussion of technical issues. In
addition,
Intel’s strategic partnership with McAfee2 provides the
foundation
for a holistic security and compliance management platform to
ensure overall integrity of the cloud infrastructure.
Three Major Trends That Impact
Cloud Security
To manage cloud security in today’s world, you need a
solution that helps you address threats to enterprise
data and infrastructure, including the major trends
you are up against.
• Changing attackers and threats:
Threats are no longer the purview of isolated hackers
looking for personal fame. More and more, organized
crime is driving well-resourced,sophisticated,
targeted
attacks for financial gain.
• Evolving architecture technologies:
With the growth of virtualization, perimeters and
their controls within the data center are in flux,
and
data is no longer easily constrained or physically
isolated and protected.
• Dynamic and challenging regulatory environment:
Organizations—and their IT departments—face
ongoing burdens of legal and regulatory compliance
with increasingly prescriptive demands and the high
penalties for noncompliance or breaches. Examples of
regulations include Sarbanes-Oxley (SOX),
Payment
Card Industry (PCI), and the Health Insurance Portability
and Accountability Act (HIPAA).
1 Intel Cloud Builders is a cross-industry initiative to
help enterprises, telecommunications companies,
and service providers build, enhance, and operate
secure cloud infrastructures.
2 McAfee is a wholly owned subsidiary of Intel.
http://www.intel.com/content/www/us/en/cloud-
computing/cloud-builders-provide-proven-advice.html
Intel IT Center Planning Guide | Cloud Security5
The Cloud Security Alliance, an industry group promoting cloud
computing security best practices and standards, has
identified
seven areas of security risk.3 Three of these apply directly to
our
focus on protecting data and platform: multitenancy, data loss,
and
unknown risk.
Multitenancy and shared technology issues. Clouds deliver
scalable
services that provide computing power for multiple tenants,
whether those tenants are business groups from the same
company
or independent organizations. That means shared
infrastructure—
CPU caches, graphics processing units (GPUs), disk partitions,
memory, and other components—that was never designed for
strong compartmentalization. Even with a virtualization
hypervisor
to mediate access between guest operating systems and physical
resources, there is concern that attackers can gain unauthorized
access and control of your underlying platform
with software-only
isolation mechanisms. Potential compromise of the hypervisor
layer
can in turn lead to a potential compromise of all the shared
physical
resources of the server that it controls, including memory and
data
as well as other virtual machines (VMs) on that server.
Experience at Intel found that virtualization brings with it an
aggregation of risks to the enterprise when consolidating
application components and services of varying
risk profiles onto
a single physical server platform. This is a key limiter faced by
most IT organizations in achieving their virtualization goals—
and
subsequently in moving workloads to the cloud.
Data loss or leakage. Protecting data can be a headache because
of
the number of ways it can be compromised. Some data—
customer,
employee,or financial data, for example—should be
protected
from unauthorized users. But data can also be maliciously
deleted,
altered, or unlinked from its larger context. Loss of data can
damage
your company’s brand and reputation, affect customer and
employee
trust, and have regulatory compliance or competitive
consequences.
Unknown risk. Releasing control of your data to a cloud service
provider has important security ramifications. Without
clearly
understanding the service provider’s security practices, your
company may be open to hidden vulnerabilities and risks. Also,
the complexity of cloud environments may make it tempting for
IT managers to cobble together security measures.
Unfortunately,
that same complexity and the relatively new concept of cloud
computing and related technologies make it
difficult to consider the
full ramifications of any change, and you may be
leaving your cloud
open to new or still undiscovered vulnerabilities.
3 Top Threats to Cloud Computing, v1.0. Cloud Security
Alliance (2010).
https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf
(PDF)
Intel and Best Practices in
Cloud Security
Intel is a member of several industry groups that develop
standards and best practices for security and cloud
computing, such as the Cloud Security Alliance (CSA). For
example, Intel is the nonvoting technical advisor to the
Open Data Center Alliance (ODCA), an independent IT
consortium comprised of global IT leaders who have come
together to provide a unified customer vision
for long-
term data center requirements represented by more than
280 member companies. ODCA released a roadmap of
hardware and software requirements in June 20114 with
the goal of promoting more open and interoperable cloud
and data center solutions. Intel is also an active participant
in the Trusted Computing Group (TCG), formed to develop
and promote open, vendor-neutral standards for trusted
computing building blocks; and the Distributed Management
Task Force (DMTF), a global organization leading the
development, adoption, and promotion of interoperable
management initiatives and standards.
4 Information about the Open Data Center Alliance roadmap can
be found at
opendatacenteralliance.org/publications.
Security Challenges
for Cloud Environments
https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf
http://www.opendatacenteralliance.org/publications
Intel IT Center Planning Guide | Cloud Security6
Yoursecurity profile in the cloud is defined by
what your
organization needs and the workloads you plan to move to the
cloud. The best way to approach cloud security is to integrate it
with your overall cloud planning early in the process. That way
you
can use a threat-based approach to planning for
deployments of
your specific workload(s), the security requirements,
and the specific
cloud delivery model and architecture.
The first step in planning security for your proposed
cloud environment is to thinkabout the
fundamentals: data and platform. Use the
following as a checklist for what you need to know
(at least at a high level) about the specific
deployment you’re planning. The idea
is to understand your risk tolerance, identify the
best deployment models for your specific needs
based on security and compliance
considerations, and detect potential exposure points for
sensitive data and processes. With this information, you will be
in a better position
to understand what your organization really needs.
As you embark on your own cloud initiatives, here are a few of
the
considerations that will affect your risk profile in
the cloud.
• Are your physical compute resources located
on-premises or off-premises?
• What types of assets, resources, and information will
be managed?
• Who manages them and how?
• Which controls are selected, and how are they integrated
into
the overall cloud architecture?
• What compliance issues do you face?
The Fundamentals
Step 1:
Start Security Planning Early
Task Purpose Additional Considerations
Identify the business priorities
for moving the specific
workload(s) to the cloud.
You can more effectively weigh security
concerns once you’ve defined the business
context for what you hope to achieve by
moving workloads to the cloud.
• What drivers make cloud technology a good
option for this workload?
• Do you need to:
o Reduce operational costs?
o Scale seasonally?
o Support remote or mobile workers?
Evaluate the sensitivity
of the asset(s).
This helps you understand the importance of
the data or function. You can make this
evaluation as a rough assessment or follow a
specific valuation process.
• What harm would result if the asset
was compromised?
Intel IT Center Planning Guide | Cloud Security7
Task Purpose Additional Considerations
Map the security workload
to the appropriate cloud
delivery model and
hosting models under
consideration.
Now that you understand the importance
of your asset, you can evaluate the risks
associated with various deployment models.
• Are you considering a private, public, or hybrid cloud
delivery model?
• For a private cloud, will your deployment be:
o On-premises?
o Off-premises with a dedicated or
shared infrastructure?
• For hybrid models, where will the various
components, functions, and data reside?
• How will you mitigate risk within the cloud
delivery model?
Determine whether the
available services are
capable of meeting your
requirements for handling
data, especially for
compliance purposes.
At this point, you need to understand your risk
tolerance for the workload. If you have a cloud
service provider in mind, you can conduct a
more detailed risk assessment.
• What are the specific requirements for
handling
regulated data?
Map the data flow,
especially for public or
hybrid cloud providers.
You need to know how data moves in and out
of the cloud. For specific deployment options,
you should understand how data will flow
between your organization, the cloud services,
and any customers (or other areas).
• Can the provider continue to deliver protection as
the workload continues to evolve?
Intel IT Center Planning Guide | Cloud Security8
Cloud Delivery Models at a Glance
Cloud delivery models used by enterprise organizations
generally fall into three types, each with its own unique
advantages and
disadvantages in terms of security.
Model Description Advantages and Disadvantages
Private • An internal infrastructure that leverages virtualization
technology for the sole use of an enterprise behind
the firewall
• Can be managed by the organization or by a third party
• Located on-premises or off-premises on shared
or
dedicated infrastructure
• Most control over data and platform
• Potential for multitenancy of business units to cause
compliance and security risk
• May lack bursting capabilities when additional
performance or
capacity is required
Public • Resources dynamically provisioned over the Internet,
via
web services, or from a third-party provider
• Located off-premises, typically on a shared
(multitenancy) infrastructure
• May offer dedicated infrastructure as a response to
growing security concerns
• Potential for greater cost savings if infrastructure owned
and
managed by public provider
• Loss of control of data and platform
• Potential for multitenancy with other organizations to
cause
security risk
• Third-party security controls possibly not
transparent (and
may cause unknown risks)
Hybrid • A combination of private and public cloud services
• Organizations that oftenmaintain mission-critical
services privately with the ability to cloud burst for
additional capacity or add selective cloud services for
specific purposes
• Located on-premises and off-premises dependingon
the architecture and specific services
• Often a compromise:
o Retention of control over the most mission-critical
data, but
relinquishing that control when additional capacity or scale
is required during peak or seasonal periods
o May involve retention of control for mission-
critical data at
all times while taking advantage of public cloud provider
services for less sensitive areas
• Potential for complexity to cause unknown vulnerabilities
(and unknown risks)
Intel IT Center Planning Guide | Cloud Security9
Intel Vision for Cloud Security
One key element of the Intel vision for cloud security is to build
in balanced controls instead of designing an environment based
primarily on preventive controls. For example, the architecture
is
designed to dynamically adjust a user’s access privilege as the
level of risk changes, taking into account factors such as
location
and type of device. This new approach is both proactive to
minimize occurrences and reactive to minimize damage if a
breach occurs.
Intel IT uses a hybrid approach that leads with a private cloud
as
the core strategy. In part based on security concerns, we
selectively
use a public cloud for nondifferentiated IT
services such as staffing,
benefits, expense, stock, and travel. We host the
vast majority of
our applications in our private cloud, such as enterprise, user
profile management, productivity, and collaboration
applications.
We expect that more of our applications could burst to public
clouds over time as security and vendor service level
agreements
(SLAs) improve and overall costs, including transition costs,
become
more favorable.
Intel IT Center Planning Guide | Cloud Security10
Spotlight on Cloud
Service Architecture5
There are three types of cloud services: infrastructure
as a service (IaaS), platform as a service (PaaS), and
software as a service (SaaS).
IaaS
• Delivers computer infrastructure as a utility service,
typically in a virtualized environment
• Provides enormous potential for extensibility and scale
PaaS
• Delivers a platform or solution stack on a cloud
infrastructure
• Sits on top of the IaaS architecture and integrates with
development and middleware capabilities as well as
database, messaging, and queuing functions
SaaS
• Delivers applications over the Internet or intranet via
a cloud infrastructure
• Built on underlying IaaS and PaaS layers
Cloud computing, which depends heavily on virtualization to
realize
operational savings and efficiencies, has elastic
boundaries, and
potentially pushes out the perimeter of the enterprise and
security
controls far beyond the data center.
It’s important to recognize that the traditional border behind
which
data and platform are constrained and protected—typically
physical
separation and isolation—is no longer viable for dynamic cloud
architecture models. It’s also important to understand that while
a
fill-the-gap approach may seemto work on a
particular vulnerability,
it may expose unknown vulnerabilities in other areas.
Regardless of the cloud delivery model you choose, your best
approach is to review the specific service
architecture, and then
layer technologies to develop a strong security net that protects
data, applications and platform, and network at all levels.
Step 2: Identify Vulnerabilities
for Your Selected Service(s)
5 Security Guidance for Critical Areas of Focus in Cloud
Computing, v2.1. Cloud Security Alliance (2009).
https://cloudsecurityalliance.org/csaguide.pdf (PDF)
https://cloudsecurityalliance.org/csaguide.pdf
Intel IT Center Planning Guide | Cloud Security11
The Cloud Security Net—Build It from the Ground Up
Because the model for your cloud services may be very
different from other organizations—and indeed may evolve and
change over time—Intel recommends that, in addition to
security
software solutions and application features, you should
strengthen
your security net by protecting data and platform at the most
basic
level—the system hardware. This best practice is built into
Intel’s
own private cloud infrastructure.6
The dynamic perimeter of cloud
computing can expose edge systems
to people and applications more
than most other elements of the
data center architectures—offering
more opportunities for compromise.
Attacks of server infrastructure at
the deepest levels are an emerging
area of risk and increasingly target
the hypervisor, firmware, and BIOS.
The attackers are professionals—
more sophisticated, determined, and
better resourced. The potential for
harm from a single attack in either of
these two areas can be devastating.
The following illustration shows how protection at the hardware
level can enable security deeper in the data center. Compute
resources complement your perimeter controls, enable more
advanced security and compliance capabilities in existing
solutions, and provide needed protection even below the
hypervisor—an area of emerging threat.
Physical Layers at
Risk in the Enterprise
Data Center
Traditional attack target
Personal computing
systems used to run
software locally or on
a cloud infrastructure
(desktops, laptops, and
other mobile devices).
Growing attack target
Departmental and other
systems that interact
inside and outside the
organization (web servers,
portal servers, e-mail
servers, bridges, and routers).
Emerging attack target
Isolated back-end servers
used for virtualization,
database management,
and storage.
6 An Enterprise Private Cloud Architecture and Implementation
Roadmap. [email protected] (2010).
intel.com/content/www/us/en/cloud-computing/cloud-
computing-private-cloud-
roadmap-paper.html (PDF)
Client
Systems
Edge &
Departmental
Systems
Back-End
Systems
http://www.intel.com/content/www/us/en/cloud-
computing/cloud-computing-private-cloud-roadmap-paper.html
http://www.intel.com/content/www/us/en/cloud-
computing/cloud-computing-private-cloud-roadmap-paper.html
Intel IT Center Planning Guide | Cloud Security12
Step 3: Four Things an IT Manager
Can Do To Mitigate Security Vulnerabilities
With protection at the hardware level, you can build trust and
compliance into your data center. This means you can:
• Provide the foundation for a more powerful layered
security net
of solutions and software features
• Put more granular controls closer to where your data lives
and
critical platform services
• Trust that the physical and virtual infrastructure
provisioning
your workloads is reliable
• Trust where your servers are located
• Control where the VMs are distributed
• Complement your audit and compliance requirements (for
the
business unit tenants in your private cloud or as a tenant in a
public cloud)
• Protect confidential data and meet compliance
requirements
Intel IT is enabling new ways to provide the foundation for
cloud
controls that can secure data and workloads. We are adding new
levels of visibility into what is running and who is running it so
you can trust that the infrastructure is reliable and can support
compliance. As Intel continues to move to the cloud, we are
starting
to increase the security level of our environment through greater
understanding of what is running in the environment; what it
should
look like when it is “normal”—not compromised;
strengthened data
protection; and secure access.
Intel recommends prioritizing your security investment through
a
risk assessment to determine the order and timing for building
this
level of trust and compliance into your data center in four areas.
• Encrypt to protect data.
• Establish a trusted foundation to secure the platform and
the infrastructure.
• Build higher assurance into auditing to strengthen
compliance.
• Establish and verify identities before you federate by
controlling
access to trusted clients from trusted systems.
The remainder of this planning guide will look at how advanced
server technologies—in particular, Intel® technologies—can
help
you build trust and compliance into your data center and set the
foundation for cloud security.
Intel IT Center Planning Guide | Cloud Security13
What Types of Data Should
You Encrypt?
Data in motion
• Data in flight over networks (Internet, e-
commerce, mobile
devices, automated teller machines, and so on)
• Data that uses protocols such as Secure Sockets Layer
(SSL), Transport Layer Security (TLS), Internet Protocol
Security (IPsec), Hypertext Transfer Protocol Secure
(HTTPS), FTP, and Secure Shell (SSH)
Data in process
• Transactional data in real time,such as encrypted
fields,
records, rows, or column data in a database
Data at rest
• Files on computers, servers, and removable media
• Data stored using full disk encryption
(FDE) and application-
level models
Step 4: Protect Data—
in Motion, in Process, and at Rest
Encryption is an effective, well-established way to
protect sensitive
data because even if information is lost, it remains unusable.
Encryption is critically important for protecting data covered by
regulations and standards such as the Health Insurance
Portability
and Accountability Act (HIPAA), Sarbanes-Oxley (SOX),
and Payment
Card Industry (PCI). Increasingly, these and other regulations
are
encouraging—and specifying—encryption in certain usage
scenarios.
And the penalties for noncompliance are stiffer than ever.
There are a number of ways to perform encryption, but typically
it
comes with a cost—what is often referred to as a performance
tax.
As an IT manager, you must to be able to justify
the trade-off in
performance with the requirement for secure data.
Intel IT Center Planning Guide | Cloud Security14
Encrypt without the Performance Tax
What if you didn’t have to make a
performance trade-off? Intel
Advanced Encryption Standard7 New Instructions (Intel
AES-NI) is
a set of seven new instructions in the Intel
Xeon® processor 5600
series that eliminate the performance tax by speeding up parts
of the AES algorithm encryption/decryption execution. It makes
encryption practical, stronger, and more efficient for
data in motion,
in process, and at rest.
Benefits of thesehardware-based instruction set
extensions
include the following:
• Improvedperformance. Intel AES-NI can
accelerate performance
3 to 10 times faster than a software-only
AES solution.
• Improved security. The new instructions help address
recently
discovered side-channel attacks on AES. Intel
AES-NI instructions
perform the decryption and encryption more completely at the
hardware level without the need for software lookup tables that
could be susceptible to snooping. Therefore using
AES-NI can
lower the risk of side-channel attacks.
• Multiple usage scenarios. Intel AES-NI can be
used in any
application that uses AES, including network, disk,
and file
encryption solutions.
7 The Advanced Encryption Standard (AES) is a
popular encryption standard first adopted by
the U.S. government in 2001. It is
generally displacingthe older, less secure
Data Encryption Standard (DES) encryption
algorithm and is now widely used to protect
network traffic, personal data, and corporate IT
infrastructures.
Intel IT Center Planning Guide | Cloud Security15
Step 5:
Secure Your Platform
Rootkit attacks are increasing. They are difficult to
detect with
traditional antivirus products and use various methods to remain
undetected. Rootkit attacks infect system components such as
hypervisors and operating systems, and the malware can operate
in the background and spread throughout a cloud environment,
causing increasing damage over time.
The best way to secure your platform is to enable a trusted
foundation—starting with a root of trust at the platform level
and
extending the chain of trust through measured
firmware, BIOS, and
hypervisor virtualization layers. A root of trust hardens the
platform
against attack and is extremely difficult to defeat
or subvert
and substantially reduces the security risks of using a remote or
virtualized infrastructure. It enables a more secure platform for
adding tenants and workloads. Essentially you build protection
into
your hardware to protect your software.
A root of trust helps ensure system integrity within each system.
Integrity checking is considered a key capability for software,
platform, and infrastructure security.8 Intel Trusted Execution
Technology (Intel TXT) checks hypervisor
integrity at start-up by
measuring the code of the hypervisor and comparing it to a
known
good value. Launch is blocked if the measurements do not
match.
The root of trust enables a trusted foundation within your cloud
environment so you can:
• Specify trusted server pools. You can make decisions
about
how much to expose your data and workload based on whether a
trusted pool is established. The most sensitive workloads should
always use a trusted pool.
• Prove host software is good. Although the chain of trust is
a
hardware-based mechanism, you can use the
integrity-checking
data with Governance, Risk Management, and Compliance
(GRC)
or security information and event manager (SIEM) dashboards
for
audit purposes.
• Respond quickly to attack and minimize damage. Detect
attacks more quickly, contain the spread of malware, and reduce
the need to rebuild hypervisors if a compromise is detected.
8 Evolution of Integrity Checking with Intel® Trusted
Execution Technology: An Intel Perspective. [email protected]
(2010). intel.com/content/www/us/en/pc-security/intel-it-
security-
trusted-execution-technology-paper.html
About Intel® TXT
Intel® Trusted Execution Technology (Intel TXT)
protects
against malware, key stealth attacks, and other threats by:
• Establishing a root of trust
• Providing a launch environment signature to enable
trusted software launch and execution
• Providing the trust foundation so that policy engines
can restrict or allow virtual machine (VM) and data
migration based on platform security profiles
• Providing the trust foundation to enable environment
monitoring for auditing function tied to a root of trust
• Enabling an IT manager to verify that the
specific
physical machine in the cloud is running the expected
operating system or hypervisor
http://www.intel.com/content/www/us/en/pc-security/intel-it-
security-trusted-execution-technology-paper.html
http://www.intel.com/content/www/us/en/pc-security/intel-it-
security-trusted-execution-technology-paper.html
Intel IT Center Planning Guide | Cloud Security16
About Intel® ECA 360
Intel® Expressway Cloud Access 360 (Intel ECA 360) provides
secure access for enterprises connecting to and across cloud
applications by:
• Account deprovisioning and account identity
data synchronization
• Enforced context-aware authorization with seamless
single
sign-on (SSO) from multiple devices
• Monitoring user, administrative, and API access activity
• Soft/hard one-time password (OTP) authentication
• Activity reporting for compliance and correlation of cloud
user
activity with on-premises logs for end-to-end
compliance
Step 6: Extend Trust
across Federated Clouds
As cloud computing evolves, the vision of federated clouds—
across
which communications, data, and services can move easily
within
and across several cloud infrastructures—adds another layer of
complexity to your security equation. Intel is working toward
providing solutions that extend trust across federated clouds via
secure gateways between the service provider and the service
consumer with policy enforcement for centrally defined
policies.
Intel Expressway Cloud Access 360 (Intel ECA 360) is a
software
solution designed to control the entire life cycle of secure
access
for enterprises connecting to cloud environments. It serves as a
gateway to broker single sign-on (SSO) access
from the enterprise
into various clouds by authenticating employees against internal
systems such as Active Directory* or other identity management
systems. It records the user activity against these systems, and
the
metrics can be used for audit reporting and monitoring through
an
administrative console. In addition to providing SSO, Intel ECA
360
creates virtual identities built from data in enterprise systems—
such
as human resource applications and the telephone system—that
establish user identity and verify the trusted systems where a
user
comes from.
The gateway can operate as a virtualized instance and can run
either on-premises or at a third-party hosted
or managed service
provider. The gateway can also function as a proxy, where it
performs as a secure token service and point of policy
enforcement,
or in look-aside mode, where it passes on
the identity logicto a third
party to perform the transformations.
Intel’s partnership with McAfee delivers a coordinated security
approach that spans network, servers, databases, storage, and
data,
as well as connecting policies and controls across physical,
virtual,
and cloud infrastructures. The McAfee infrastructure
proactively
identifies and blocks attacks by communicating with
McAfee* Global
Threat Intelligence technology. The foundation of the McAfee
security management platform, McAfee ePolicy Orchestrator*,
is an
open, scalable platform that connects third-party
security solutions
to the infrastructure, strengthening protection and providing
visibility into security, compliance, and risk management
activities.
Intel IT Center Planning Guide | Cloud Security17
Step 7: Choose the Right
Cloud Service Provider
Choosing a cloud service provider is complicated on many
levels—from the cloud delivery model and
architecture to specific
applications. Add to that the countless interdependencies and
relationships, both technological and business-related,
among
vendors. To complicate matters, some companies offer not only
software, but also hardware and services. Nevertheless, you
must
be vigilant about making sure the security you need to protect
your
data and platform are part of the offering.
At the highest level, you need to know if the cloud provider can
provide evidence of data and platform protections for the
services
they provide. Once you are comfortable that your criteria can be
met, you can establish measurable, enforceable SLAs to provide
ongoing verification.
The following is a list9 of additional security considerations to
think
about when choosing a cloud service provider.
9 Adapted and expanded from How to Choose a Cloud
Computing Vendor. Inc.com (November 29, 2010).
inc.com/guides/2010/11/how-to-choose-a-cloud-computing-
vendor.html
Security Selection
Criteria
Considerations
Data center risk management
and security practices
• What are the patch management policies
and procedures?
• How does technology architecture and infrastructure
impact the cloud service provider’s ability to
meet SLAs?
Hardware-based security • Can the cloud service
provider offer trusted pools for your most
sensitive workloads?
• Is encryption a software-only solution?
Technology segmentation • How are systems, data,
networks, management, provisioning, and personnel
segmented?
• Are the controls segregating each layer of the
infrastructure properly integrated so they do not
interfere with each other? For example, investigate
whether the storage compartmentalization can
easily be bypassed by management tools or poor key
management.
• What cloud access and identity protocols
are used?
Attack response and recovery • How are attacks
monitored and documented?
• How quickly can the cloud service provider
respond?
• What recovery methods are used?
System availability
and performance
• How does the cloud service provider handle resource
democratization and dynamism to best predict
proper levels of system availability and
performance through normal business fluctuations?
• How does the cloud service provider measure
performance?
Vendor financial stability • Is the cloud service
provider financially stable?
• How long has the vendor been in business? What
is their current financial standing?
http://www.inc.com/guides/2010/11/how-to-choose-a-cloud-
computing-vendor.html
Intel IT Center Planning Guide | Cloud Security18
Security Selection
Criteria
Considerations
Product long-term strategy • What is the vision
for the service provider’scloud offering?
• Does the cloud service provider have a product
roadmap for their offering? Cloud service
providers
seeking to provide mission-critical services should
embrace the ISO/IEC 27001 standard for
information
security management systems. If the provider has
not achieved ISO/IEC 27001 certification, they
should demonstrate alignment with ISO 27002 practices.
Limits of responsibility • What is the limit of the
cloud service provider’sresponsibility for
security?
• What security responsibilities are expected of
the enterprise?
• What is the legal accountability in a breach?
Compliance capabilities • Does the cloud service
provider have the ability to comply with
regulatoryrequirements that you face?
• Is the cloud service provider able to provide
you with full visibility into compliance-related
activities?
• Can you perform your own audit?
As you and other IT managers continue to explore options for
moving workloads to the cloud, security considerations will
continue to
influence your buying decisions. As a result, cloud
service providers are becoming more aware of
the need for transparency into their
security practices.
Intel IT Center Planning Guide | Cloud Security19
Evolution of Integrity Checking with Intel® Trusted Execution
Technology: An
Intel Perspective
In 2010, Intel began transitioning to a private
cloud environment to improve efficiency and
agility.
The highly virtualized multitenant environment creates new
security challenges, including those
presented by emerging threats such as rootkit attacks.
Intel evaluated Intel TXT as part of its analysis of
technologies that can potentially address these issues.
intel.com/content/www/us/en/pc-security/intel-it-security-
trusted-execution-technology-paper.html
Securing the Enterprise with Intel® AES-NI
This white paper describes AES usage scenarios, performance
implications, and the cryptographic
libraries that ISVs can use to replace basicAES
routines with the Intel AES-NI optimizations.
intel.com/content/www/us/en/enterprise-security/enterprise-
security-aes-ni-white-paper.html
Intel® Advanced Encryption Standard Instructions (AES-NI)
This article by Intel expert Jeffrey Rott is an
in-depth look at using Intel AES-NI, with specific
focus on
the 2010 Intel Core™ processor family and its
performance and security benefits.
http://edc.intel.com/Link.aspx?id=5093
Taking Control of the Cloud for Your Enterprise: Addressing
Security, Visibility, and
Governance Challenges
This white paper is for enterprise security architects and
executives who need to quickly understand
the risks of moving mission-critical data, systems,
and applications to external cloud providers.
The
concept of a dynamic security perimeter is presented to help
explain how to address insecure APIs,
multitenancy, data protection, and tiered access control for the
cloud.
dynamicperimeter.com/download/Taking_Control_of_the_Cloud
/?partnerref=intelsoaesite
Take advantage of proven guidance for building and optimizing
cloud infrastructure. Each reference
architecture is based on real-world IT
requirements and gives detailed instructions on
how to install and
configure a particular cloud solution using Intel
Xeon processor–based servers and
technologies.
Intel® Cloud Builders Guide: Enhancing Server Platform
Security with VMware
intel.com/content/www/us/en/cloud-computing/cloud-
computing-xeon-server-platform-security-
vmware-guide.html
Intel Technologies
for Cloud Security
Intel Cloud
Builders Reference
Architectures
Intel Resources for Learning More
http://www.intel.com/content/www/us/en/pc-security/intel-it-
security-trusted-execution-technology-paper.html
http://www.intel.com/content/www/us/en/pc-security/intel-it-
security-trusted-execution-technology-paper.html
http://www.intel.com/content/www/us/en/pc-security/intel-it-
security-trusted-execution-technology-paper.html
http://www.intel.com/content/www/us/en/enterprise-
security/enterprise-security-aes-ni-white-paper.html
http://www.intel.com/content/www/us/en/enterprise-
security/enterprise-security-aes-ni-white-paper.html
http://edc.intel.com/Link.aspx?id=5093
http://edc.intel.com/Link.aspx?id=5093
http://dynamicperimeter.com/download/Taking_Control_of_the_
Cloud/?partnerref=intelsoaesite
http://dynamicperimeter.com/download/Taking_Control_of_the_
Cloud/?partnerref=intelsoaesite
http://dynamicperimeter.com/download/Taking_Control_of_the_
Cloud/?partnerref=intelsoaesite
http://www.intel.com/content/www/us/en/cloud-
computing/cloud-computing-xeon-server-platform-security-
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx
Your company                                                .docx

More Related Content

Similar to Your company .docx

Introductory PresentationGoals of .docx
Introductory PresentationGoals of .docxIntroductory PresentationGoals of .docx
Introductory PresentationGoals of .docxbagotjesusa
 
Task 1.Complete the BIA table below and use it for the remai
Task 1.Complete the BIA table below and use it for the remaiTask 1.Complete the BIA table below and use it for the remai
Task 1.Complete the BIA table below and use it for the remaialehosickg3
 
Mastering disaster a data center checklist
Mastering disaster a data center checklistMastering disaster a data center checklist
Mastering disaster a data center checklistChris Wick
 
Mastering disaster e book Telehouse
Mastering disaster e book TelehouseMastering disaster e book Telehouse
Mastering disaster e book TelehouseTelehouse
 
Emergency Action Plan
Emergency Action PlanEmergency Action Plan
Emergency Action PlanDavid Knight
 
Information Technology Disaster Planning
Information Technology Disaster PlanningInformation Technology Disaster Planning
Information Technology Disaster Planningguest340570
 
It244 r4 appendix_d1-18-12
It244 r4 appendix_d1-18-12It244 r4 appendix_d1-18-12
It244 r4 appendix_d1-18-12franceco
 
Emergency Response Profile
Emergency Response ProfileEmergency Response Profile
Emergency Response ProfileJoshHammer
 
BCS 307 Lecture 6.pdf
BCS 307 Lecture 6.pdfBCS 307 Lecture 6.pdf
BCS 307 Lecture 6.pdfJohn119649
 
Types of Emergencies
Types of EmergenciesTypes of Emergencies
Types of EmergenciesMireGreyling
 
Pertemuan 15 disaster recovery plan
Pertemuan 15 disaster recovery planPertemuan 15 disaster recovery plan
Pertemuan 15 disaster recovery plannewbie2019
 
Practical_Guide_for_Disaster_Avoidance
Practical_Guide_for_Disaster_AvoidancePractical_Guide_for_Disaster_Avoidance
Practical_Guide_for_Disaster_AvoidanceJoe Soroka
 
Overview of PRefChem Emergency Response Plan.pptx v3.pptx
Overview of PRefChem Emergency Response Plan.pptx v3.pptxOverview of PRefChem Emergency Response Plan.pptx v3.pptx
Overview of PRefChem Emergency Response Plan.pptx v3.pptxShahrulnizamShahMohd2
 
Disaster recovery plan sample 2
Disaster recovery plan sample 2Disaster recovery plan sample 2
Disaster recovery plan sample 2AbenetAsmellash
 
Emergency Preparedness Presentation.pdf
Emergency Preparedness Presentation.pdfEmergency Preparedness Presentation.pdf
Emergency Preparedness Presentation.pdfsursh2
 
Emergency Preparedness Presentation.pdf
Emergency Preparedness Presentation.pdfEmergency Preparedness Presentation.pdf
Emergency Preparedness Presentation.pdfsursh2
 

Similar to Your company .docx (20)

Introductory PresentationGoals of .docx
Introductory PresentationGoals of .docxIntroductory PresentationGoals of .docx
Introductory PresentationGoals of .docx
 
Disaster Recovery
Disaster RecoveryDisaster Recovery
Disaster Recovery
 
Task 1.Complete the BIA table below and use it for the remai
Task 1.Complete the BIA table below and use it for the remaiTask 1.Complete the BIA table below and use it for the remai
Task 1.Complete the BIA table below and use it for the remai
 
Mastering disaster a data center checklist
Mastering disaster a data center checklistMastering disaster a data center checklist
Mastering disaster a data center checklist
 
Mastering disaster e book Telehouse
Mastering disaster e book TelehouseMastering disaster e book Telehouse
Mastering disaster e book Telehouse
 
Emergency Action Plan
Emergency Action PlanEmergency Action Plan
Emergency Action Plan
 
Disaster Recovery Plan
Disaster Recovery PlanDisaster Recovery Plan
Disaster Recovery Plan
 
Information Technology Disaster Planning
Information Technology Disaster PlanningInformation Technology Disaster Planning
Information Technology Disaster Planning
 
It244 r4 appendix_d1-18-12
It244 r4 appendix_d1-18-12It244 r4 appendix_d1-18-12
It244 r4 appendix_d1-18-12
 
Emergency Response Profile
Emergency Response ProfileEmergency Response Profile
Emergency Response Profile
 
BCS 307 Lecture 6.pdf
BCS 307 Lecture 6.pdfBCS 307 Lecture 6.pdf
BCS 307 Lecture 6.pdf
 
PACE-IT, Security+2.8: Disaster Recovery Concepts
PACE-IT, Security+2.8: Disaster Recovery ConceptsPACE-IT, Security+2.8: Disaster Recovery Concepts
PACE-IT, Security+2.8: Disaster Recovery Concepts
 
Types of Emergencies
Types of EmergenciesTypes of Emergencies
Types of Emergencies
 
Pertemuan 15 disaster recovery plan
Pertemuan 15 disaster recovery planPertemuan 15 disaster recovery plan
Pertemuan 15 disaster recovery plan
 
Practical_Guide_for_Disaster_Avoidance
Practical_Guide_for_Disaster_AvoidancePractical_Guide_for_Disaster_Avoidance
Practical_Guide_for_Disaster_Avoidance
 
Overview of PRefChem Emergency Response Plan.pptx v3.pptx
Overview of PRefChem Emergency Response Plan.pptx v3.pptxOverview of PRefChem Emergency Response Plan.pptx v3.pptx
Overview of PRefChem Emergency Response Plan.pptx v3.pptx
 
PACE-IT: Introduction to Safety Practices (part 2)
PACE-IT: Introduction to Safety Practices (part 2)PACE-IT: Introduction to Safety Practices (part 2)
PACE-IT: Introduction to Safety Practices (part 2)
 
Disaster recovery plan sample 2
Disaster recovery plan sample 2Disaster recovery plan sample 2
Disaster recovery plan sample 2
 
Emergency Preparedness Presentation.pdf
Emergency Preparedness Presentation.pdfEmergency Preparedness Presentation.pdf
Emergency Preparedness Presentation.pdf
 
Emergency Preparedness Presentation.pdf
Emergency Preparedness Presentation.pdfEmergency Preparedness Presentation.pdf
Emergency Preparedness Presentation.pdf
 

More from danielfoster65629

ASSIGNMENT 3 POWER, POLITICS, AND CULTURE Due Week 9 and .docx
ASSIGNMENT 3 POWER, POLITICS, AND CULTURE Due Week 9 and .docxASSIGNMENT 3 POWER, POLITICS, AND CULTURE Due Week 9 and .docx
ASSIGNMENT 3 POWER, POLITICS, AND CULTURE Due Week 9 and .docxdanielfoster65629
 
Assignment 3 Organization of a Health Care FacilityDue Week 6 and.docx
Assignment 3 Organization of a Health Care FacilityDue Week 6 and.docxAssignment 3 Organization of a Health Care FacilityDue Week 6 and.docx
Assignment 3 Organization of a Health Care FacilityDue Week 6 and.docxdanielfoster65629
 
Assignment 3 Neuroanatomy ProjectImagine that you are working in .docx
Assignment 3 Neuroanatomy ProjectImagine that you are working in .docxAssignment 3 Neuroanatomy ProjectImagine that you are working in .docx
Assignment 3 Neuroanatomy ProjectImagine that you are working in .docxdanielfoster65629
 
Assignment 3 Network Security Planning - SAFE· Securing a lar.docx
Assignment 3 Network Security Planning - SAFE· Securing a lar.docxAssignment 3 Network Security Planning - SAFE· Securing a lar.docx
Assignment 3 Network Security Planning - SAFE· Securing a lar.docxdanielfoster65629
 
Assignment 3 Mobile Computing and Social Networking Due Week 7 a.docx
Assignment 3 Mobile Computing and Social Networking  Due Week 7 a.docxAssignment 3 Mobile Computing and Social Networking  Due Week 7 a.docx
Assignment 3 Mobile Computing and Social Networking Due Week 7 a.docxdanielfoster65629
 
Assignment 3 Marketing PlanTali GoyaGroup.docx
Assignment 3 Marketing PlanTali GoyaGroup.docxAssignment 3 Marketing PlanTali GoyaGroup.docx
Assignment 3 Marketing PlanTali GoyaGroup.docxdanielfoster65629
 
Assignment 3 Management Accounting Case West Island Products.docx
Assignment 3 Management Accounting Case West Island Products.docxAssignment 3 Management Accounting Case West Island Products.docx
Assignment 3 Management Accounting Case West Island Products.docxdanielfoster65629
 
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDSAs.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDSAs.docxAssignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDSAs.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDSAs.docxdanielfoster65629
 
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDSDue We.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDSDue We.docxAssignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDSDue We.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDSDue We.docxdanielfoster65629
 
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDS Due W.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDS Due W.docxAssignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDS Due W.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDS Due W.docxdanielfoster65629
 
Assignment 3 Knowledge Instrument – Summative Assessment .docx
Assignment 3 Knowledge Instrument – Summative Assessment .docxAssignment 3 Knowledge Instrument – Summative Assessment .docx
Assignment 3 Knowledge Instrument – Summative Assessment .docxdanielfoster65629
 
Assignment 3 Juvenile ProbationIn many ways, juvenile probation i.docx
Assignment 3 Juvenile ProbationIn many ways, juvenile probation i.docxAssignment 3 Juvenile ProbationIn many ways, juvenile probation i.docx
Assignment 3 Juvenile ProbationIn many ways, juvenile probation i.docxdanielfoster65629
 
Assignment 3 Grading CriteriaMaximum PointsDescribe steps take.docx
Assignment 3 Grading CriteriaMaximum PointsDescribe steps take.docxAssignment 3 Grading CriteriaMaximum PointsDescribe steps take.docx
Assignment 3 Grading CriteriaMaximum PointsDescribe steps take.docxdanielfoster65629
 
Assignment 3 Grading CriteriaMaximum PointsEvaluated and expla.docx
Assignment 3 Grading CriteriaMaximum PointsEvaluated and expla.docxAssignment 3 Grading CriteriaMaximum PointsEvaluated and expla.docx
Assignment 3 Grading CriteriaMaximum PointsEvaluated and expla.docxdanielfoster65629
 
Assignment 3 Gender IdentityWe are socialized at every stage in l.docx
Assignment 3 Gender IdentityWe are socialized at every stage in l.docxAssignment 3 Gender IdentityWe are socialized at every stage in l.docx
Assignment 3 Gender IdentityWe are socialized at every stage in l.docxdanielfoster65629
 
Assignment 4 Impressions of Museum or Gallery Exhibit$20The Bro.docx
Assignment 4 Impressions of Museum or Gallery Exhibit$20The Bro.docxAssignment 4 Impressions of Museum or Gallery Exhibit$20The Bro.docx
Assignment 4 Impressions of Museum or Gallery Exhibit$20The Bro.docxdanielfoster65629
 
Assignment 4 Informative Report – DraftChoose a familia.docx
Assignment 4 Informative Report – DraftChoose a familia.docxAssignment 4 Informative Report – DraftChoose a familia.docx
Assignment 4 Informative Report – DraftChoose a familia.docxdanielfoster65629
 
Assignment 4 Excel ProblemsAt the end of each module, you will ap.docx
Assignment 4 Excel ProblemsAt the end of each module, you will ap.docxAssignment 4 Excel ProblemsAt the end of each module, you will ap.docx
Assignment 4 Excel ProblemsAt the end of each module, you will ap.docxdanielfoster65629
 
Assignment 4 Designing Compliance Within the LAN-to-WAN DomainD.docx
Assignment 4 Designing Compliance Within the LAN-to-WAN DomainD.docxAssignment 4 Designing Compliance Within the LAN-to-WAN DomainD.docx
Assignment 4 Designing Compliance Within the LAN-to-WAN DomainD.docxdanielfoster65629
 
Assignment 4 Cultural Information PaperDue in Week 10 and worth.docx
Assignment 4 Cultural Information PaperDue in Week 10 and worth.docxAssignment 4 Cultural Information PaperDue in Week 10 and worth.docx
Assignment 4 Cultural Information PaperDue in Week 10 and worth.docxdanielfoster65629
 

More from danielfoster65629 (20)

ASSIGNMENT 3 POWER, POLITICS, AND CULTURE Due Week 9 and .docx
ASSIGNMENT 3 POWER, POLITICS, AND CULTURE Due Week 9 and .docxASSIGNMENT 3 POWER, POLITICS, AND CULTURE Due Week 9 and .docx
ASSIGNMENT 3 POWER, POLITICS, AND CULTURE Due Week 9 and .docx
 
Assignment 3 Organization of a Health Care FacilityDue Week 6 and.docx
Assignment 3 Organization of a Health Care FacilityDue Week 6 and.docxAssignment 3 Organization of a Health Care FacilityDue Week 6 and.docx
Assignment 3 Organization of a Health Care FacilityDue Week 6 and.docx
 
Assignment 3 Neuroanatomy ProjectImagine that you are working in .docx
Assignment 3 Neuroanatomy ProjectImagine that you are working in .docxAssignment 3 Neuroanatomy ProjectImagine that you are working in .docx
Assignment 3 Neuroanatomy ProjectImagine that you are working in .docx
 
Assignment 3 Network Security Planning - SAFE· Securing a lar.docx
Assignment 3 Network Security Planning - SAFE· Securing a lar.docxAssignment 3 Network Security Planning - SAFE· Securing a lar.docx
Assignment 3 Network Security Planning - SAFE· Securing a lar.docx
 
Assignment 3 Mobile Computing and Social Networking Due Week 7 a.docx
Assignment 3 Mobile Computing and Social Networking  Due Week 7 a.docxAssignment 3 Mobile Computing and Social Networking  Due Week 7 a.docx
Assignment 3 Mobile Computing and Social Networking Due Week 7 a.docx
 
Assignment 3 Marketing PlanTali GoyaGroup.docx
Assignment 3 Marketing PlanTali GoyaGroup.docxAssignment 3 Marketing PlanTali GoyaGroup.docx
Assignment 3 Marketing PlanTali GoyaGroup.docx
 
Assignment 3 Management Accounting Case West Island Products.docx
Assignment 3 Management Accounting Case West Island Products.docxAssignment 3 Management Accounting Case West Island Products.docx
Assignment 3 Management Accounting Case West Island Products.docx
 
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDSAs.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDSAs.docxAssignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDSAs.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDSAs.docx
 
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDSDue We.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDSDue We.docxAssignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDSDue We.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDSDue We.docx
 
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDS Due W.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDS Due W.docxAssignment 3 Legal Ethics, Patients’ Rights, and HIV  AIDS Due W.docx
Assignment 3 Legal Ethics, Patients’ Rights, and HIV AIDS Due W.docx
 
Assignment 3 Knowledge Instrument – Summative Assessment .docx
Assignment 3 Knowledge Instrument – Summative Assessment .docxAssignment 3 Knowledge Instrument – Summative Assessment .docx
Assignment 3 Knowledge Instrument – Summative Assessment .docx
 
Assignment 3 Juvenile ProbationIn many ways, juvenile probation i.docx
Assignment 3 Juvenile ProbationIn many ways, juvenile probation i.docxAssignment 3 Juvenile ProbationIn many ways, juvenile probation i.docx
Assignment 3 Juvenile ProbationIn many ways, juvenile probation i.docx
 
Assignment 3 Grading CriteriaMaximum PointsDescribe steps take.docx
Assignment 3 Grading CriteriaMaximum PointsDescribe steps take.docxAssignment 3 Grading CriteriaMaximum PointsDescribe steps take.docx
Assignment 3 Grading CriteriaMaximum PointsDescribe steps take.docx
 
Assignment 3 Grading CriteriaMaximum PointsEvaluated and expla.docx
Assignment 3 Grading CriteriaMaximum PointsEvaluated and expla.docxAssignment 3 Grading CriteriaMaximum PointsEvaluated and expla.docx
Assignment 3 Grading CriteriaMaximum PointsEvaluated and expla.docx
 
Assignment 3 Gender IdentityWe are socialized at every stage in l.docx
Assignment 3 Gender IdentityWe are socialized at every stage in l.docxAssignment 3 Gender IdentityWe are socialized at every stage in l.docx
Assignment 3 Gender IdentityWe are socialized at every stage in l.docx
 
Assignment 4 Impressions of Museum or Gallery Exhibit$20The Bro.docx
Assignment 4 Impressions of Museum or Gallery Exhibit$20The Bro.docxAssignment 4 Impressions of Museum or Gallery Exhibit$20The Bro.docx
Assignment 4 Impressions of Museum or Gallery Exhibit$20The Bro.docx
 
Assignment 4 Informative Report – DraftChoose a familia.docx
Assignment 4 Informative Report – DraftChoose a familia.docxAssignment 4 Informative Report – DraftChoose a familia.docx
Assignment 4 Informative Report – DraftChoose a familia.docx
 
Assignment 4 Excel ProblemsAt the end of each module, you will ap.docx
Assignment 4 Excel ProblemsAt the end of each module, you will ap.docxAssignment 4 Excel ProblemsAt the end of each module, you will ap.docx
Assignment 4 Excel ProblemsAt the end of each module, you will ap.docx
 
Assignment 4 Designing Compliance Within the LAN-to-WAN DomainD.docx
Assignment 4 Designing Compliance Within the LAN-to-WAN DomainD.docxAssignment 4 Designing Compliance Within the LAN-to-WAN DomainD.docx
Assignment 4 Designing Compliance Within the LAN-to-WAN DomainD.docx
 
Assignment 4 Cultural Information PaperDue in Week 10 and worth.docx
Assignment 4 Cultural Information PaperDue in Week 10 and worth.docxAssignment 4 Cultural Information PaperDue in Week 10 and worth.docx
Assignment 4 Cultural Information PaperDue in Week 10 and worth.docx
 

Recently uploaded

Concurrency Control in Database Management system
Concurrency Control in Database Management systemConcurrency Control in Database Management system
Concurrency Control in Database Management systemChristalin Nelson
 
Oppenheimer Film Discussion for Philosophy and Film
Oppenheimer Film Discussion for Philosophy and FilmOppenheimer Film Discussion for Philosophy and Film
Oppenheimer Film Discussion for Philosophy and FilmStan Meyer
 
Keynote by Prof. Wurzer at Nordex about IP-design
Keynote by Prof. Wurzer at Nordex about IP-designKeynote by Prof. Wurzer at Nordex about IP-design
Keynote by Prof. Wurzer at Nordex about IP-designMIPLM
 
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptxMULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptxAnupkumar Sharma
 
ROLES IN A STAGE PRODUCTION in arts.pptx
ROLES IN A STAGE PRODUCTION in arts.pptxROLES IN A STAGE PRODUCTION in arts.pptx
ROLES IN A STAGE PRODUCTION in arts.pptxVanesaIglesias10
 
The Contemporary World: The Globalization of World Politics
The Contemporary World: The Globalization of World PoliticsThe Contemporary World: The Globalization of World Politics
The Contemporary World: The Globalization of World PoliticsRommel Regala
 
4.16.24 Poverty and Precarity--Desmond.pptx
4.16.24 Poverty and Precarity--Desmond.pptx4.16.24 Poverty and Precarity--Desmond.pptx
4.16.24 Poverty and Precarity--Desmond.pptxmary850239
 
How to do quick user assign in kanban in Odoo 17 ERP
How to do quick user assign in kanban in Odoo 17 ERPHow to do quick user assign in kanban in Odoo 17 ERP
How to do quick user assign in kanban in Odoo 17 ERPCeline George
 
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17Celine George
 
AUDIENCE THEORY -CULTIVATION THEORY - GERBNER.pptx
AUDIENCE THEORY -CULTIVATION THEORY -  GERBNER.pptxAUDIENCE THEORY -CULTIVATION THEORY -  GERBNER.pptx
AUDIENCE THEORY -CULTIVATION THEORY - GERBNER.pptxiammrhaywood
 
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...Postal Advocate Inc.
 
Transaction Management in Database Management System
Transaction Management in Database Management SystemTransaction Management in Database Management System
Transaction Management in Database Management SystemChristalin Nelson
 
EMBODO Lesson Plan Grade 9 Law of Sines.docx
EMBODO Lesson Plan Grade 9 Law of Sines.docxEMBODO Lesson Plan Grade 9 Law of Sines.docx
EMBODO Lesson Plan Grade 9 Law of Sines.docxElton John Embodo
 
Active Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdfActive Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdfPatidar M
 
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...JojoEDelaCruz
 
Activity 2-unit 2-update 2024. English translation
Activity 2-unit 2-update 2024. English translationActivity 2-unit 2-update 2024. English translation
Activity 2-unit 2-update 2024. English translationRosabel UA
 
Influencing policy (training slides from Fast Track Impact)
Influencing policy (training slides from Fast Track Impact)Influencing policy (training slides from Fast Track Impact)
Influencing policy (training slides from Fast Track Impact)Mark Reed
 

Recently uploaded (20)

FINALS_OF_LEFT_ON_C'N_EL_DORADO_2024.pptx
FINALS_OF_LEFT_ON_C'N_EL_DORADO_2024.pptxFINALS_OF_LEFT_ON_C'N_EL_DORADO_2024.pptx
FINALS_OF_LEFT_ON_C'N_EL_DORADO_2024.pptx
 
Concurrency Control in Database Management system
Concurrency Control in Database Management systemConcurrency Control in Database Management system
Concurrency Control in Database Management system
 
Oppenheimer Film Discussion for Philosophy and Film
Oppenheimer Film Discussion for Philosophy and FilmOppenheimer Film Discussion for Philosophy and Film
Oppenheimer Film Discussion for Philosophy and Film
 
Keynote by Prof. Wurzer at Nordex about IP-design
Keynote by Prof. Wurzer at Nordex about IP-designKeynote by Prof. Wurzer at Nordex about IP-design
Keynote by Prof. Wurzer at Nordex about IP-design
 
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptxMULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
 
ROLES IN A STAGE PRODUCTION in arts.pptx
ROLES IN A STAGE PRODUCTION in arts.pptxROLES IN A STAGE PRODUCTION in arts.pptx
ROLES IN A STAGE PRODUCTION in arts.pptx
 
Paradigm shift in nursing research by RS MEHTA
Paradigm shift in nursing research by RS MEHTAParadigm shift in nursing research by RS MEHTA
Paradigm shift in nursing research by RS MEHTA
 
The Contemporary World: The Globalization of World Politics
The Contemporary World: The Globalization of World PoliticsThe Contemporary World: The Globalization of World Politics
The Contemporary World: The Globalization of World Politics
 
4.16.24 Poverty and Precarity--Desmond.pptx
4.16.24 Poverty and Precarity--Desmond.pptx4.16.24 Poverty and Precarity--Desmond.pptx
4.16.24 Poverty and Precarity--Desmond.pptx
 
LEFT_ON_C'N_ PRELIMS_EL_DORADO_2024.pptx
LEFT_ON_C'N_ PRELIMS_EL_DORADO_2024.pptxLEFT_ON_C'N_ PRELIMS_EL_DORADO_2024.pptx
LEFT_ON_C'N_ PRELIMS_EL_DORADO_2024.pptx
 
How to do quick user assign in kanban in Odoo 17 ERP
How to do quick user assign in kanban in Odoo 17 ERPHow to do quick user assign in kanban in Odoo 17 ERP
How to do quick user assign in kanban in Odoo 17 ERP
 
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17
 
AUDIENCE THEORY -CULTIVATION THEORY - GERBNER.pptx
AUDIENCE THEORY -CULTIVATION THEORY -  GERBNER.pptxAUDIENCE THEORY -CULTIVATION THEORY -  GERBNER.pptx
AUDIENCE THEORY -CULTIVATION THEORY - GERBNER.pptx
 
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
 
Transaction Management in Database Management System
Transaction Management in Database Management SystemTransaction Management in Database Management System
Transaction Management in Database Management System
 
EMBODO Lesson Plan Grade 9 Law of Sines.docx
EMBODO Lesson Plan Grade 9 Law of Sines.docxEMBODO Lesson Plan Grade 9 Law of Sines.docx
EMBODO Lesson Plan Grade 9 Law of Sines.docx
 
Active Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdfActive Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdf
 
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
ENG 5 Q4 WEEk 1 DAY 1 Restate sentences heard in one’s own words. Use appropr...
 
Activity 2-unit 2-update 2024. English translation
Activity 2-unit 2-update 2024. English translationActivity 2-unit 2-update 2024. English translation
Activity 2-unit 2-update 2024. English translation
 
Influencing policy (training slides from Fast Track Impact)
Influencing policy (training slides from Fast Track Impact)Influencing policy (training slides from Fast Track Impact)
Influencing policy (training slides from Fast Track Impact)
 

Your company .docx

  • 1. <Your company> Rel. 1, Ver. 0 <Date> <Company> Business Continuity Plan By Paul Kirvan, CISA, CSSP, FBCI, CBCP Emergency notification contacts Name Address Home Mobile phone
  • 2. Revisions control page Date Summary of changes made Changes made by (Name)
  • 3. Purpose The purpose of this business continuity plan is to prepare
  • 4. <Company> in the event of extended service outages caused by factors beyond our control (e.g., natural disasters, man-made events), and to restore services to the widest extent possible in a minimum time frame. All <Company> sites are expected to implement preventive measures whenever possible to minimize operational disruptions and to recover as rapidly as possible when an incident occurs. The plan identifies vulnerabilities and recommends necessary measures to prevent extended voice communications service outages. It is a plan that encompasses all <Company> system sites and operations facilities.Scope The scope of this plan is limited to <describe>. This is a business continuity plan, not a daily problem resolution procedures document. Plan objectives · Serves as a guide for the <Company> recovery teams. · References and points to the location of critical data. · Provides procedures and resources needed to assist in recovery. · Identifies vendors and customers that must be notified in the event of a disaster. · Assists in avoiding confusion experienced during a crisis by documenting, testing and reviewing recovery procedures. · Identifies alternate sources for supplies, resources and locations. · Documents storage, safeguarding and retrieval procedures for vital records. Assumptions · Key people (team leaders or alternates) will be available following a disaster. · A national disaster such as nuclear war is beyond the scope of this plan. · This document and all vital records are stored in a secure off- site location and not only survive the disaster but are accessible immediately following the disaster. · Each support organization will have its own plan consisting of
  • 5. unique recovery procedures, critical resource information and procedures. Disaster definition Any loss of utility service (power, water), connectivity (system sites), or catastrophic event (weather, natural disaster, vandalism) that causes an interruption in the service provided by <Company> operations. The plan identifies vulnerabilities and recommends measures to prevent extended service outages. Recovery teams · Emergency management team (EMT) · Disaster recovery team (DRT) · IT technical services (IT) See Appendix A for details on the roles and responsibilities of each team. Team member responsibilities · Each team member will designate an alternate · All of the members should keep an updated calling list of their work team members’ work, home, and cell phone numbers both at home and at work. · All team members should keep this plan for reference at home in case the disaster happens after normal work hours. All team members should familiarize themselves with the contents of this plan. Instructions for using the business continuity plan Invoking the plan This plan becomes effective when a disaster occurs. Normal problem management procedures will initiate the plan, and remain in effect until operations are resumed at the original location or a replacement location and control is returned to the appropriate functional management.
  • 6. Disaster declaration The senior management team, with input from the EMT, DRT and IT, is responsible for declaring a disaster and activating the various recovery teams as outlined in this plan. In a major disaster situation affecting multiple business units, the decision to declare a disaster will be determined by <Company> senior management. The EMT and DRT will respond based on the directives specified by senior management. Notification Regardless of the disaster circumstances, or the identity of the person(s) first made aware of the disaster, the EMT and DRT must be activated immediately in the following cases: · Two or more systems and/or sites are down concurrently for three or more hours · Five or more systems and/or sites are down concurrently for three or more hours · Any problem at any system or network facility that would cause either of the above conditions to be present or there is certain indication that either of the conditions are about to occur External communications Corporate public relations personnel are designated as the principal contacts with the media (radio, television, and print), regulatory agency, government agencies, and other external organizations following a formal disaster declaration.
  • 7. Emergency management standards Data backup policy Full and incremental backups preserve corporate information assets and should be performed on a regular basis for audit logs and files that are irreplaceable, have a high replacement cost, or are considered critical. Backup media should be stored in a secure, geographically separate location from the original and isolated from environmental hazards. Department-specific data and document retention policies specify what records must be retained and for how long. All organizations are accountable for carrying out the provisions of the instruction for records in their organization. IT follows these standards for its data backup and archiving: Tape retention policy Backup media is stored at locations that are secure, isolated from environmental hazards, and geographically separate from the location housing the system. Billing tapes · Tapes greater than three years old are destroyed every six months. · Tapes less than three years old must be stored locally off-site. · The system supervisor is responsible for the transition cycle of tapes. System image tapes · A copy of the most current image files must be made at least once per week. · This backup must be stored offsite.
  • 8. · The system supervisor is responsible for this activity. Off-site storage procedures · Tapes and disks, and other suitable media are stored in environmentally secure facilities. · Tape or disk rotation occurs on a regular schedule coordinated with the storage vendor. · Access to backup databases and other data is tested annually. Emergency management procedures The following procedures are to be followed by system operations personnel and other designated <Company> personnel in the event of an emergency. Where uncertainty exists, the more reactive action should be followed to provide maximum protection and personnel safety. Note:Anyone not recognized by the IT staff as normally having business in the area must be challenged by the staff who should then notify security personnel. These procedures are furnished to <Company> management personnel to take home for reference. Several pages have been included to supply emergency contacts. In the event of any situation where access to a building housing a system is denied, personnel should report to alternate locations. Primary and secondary locations are listed below. Alternate locations Workplace: <Name> · Attempt to contact your immediate supervisor or management via telephone. Home and cell phone numbers are included in this document Workplace: <Name> · Attempt to contact your immediate supervisor or management
  • 9. via telephone. Home and cell phone numbers are included in this document Workplace:<Name> via telephone. Home and cell phone numbers are included in this document In the event of a natural disaster In the event of a major catastrophe affecting <Company> facility, immediately notify the <Name or title of person>. Procedure STEP ACTION 1 Notify EMT and DRT of pending event, if time permits. 2 If the impending natural disaster can be tracked, begin preparation of site within 48 hours as follows: · Deploy portable generators with fuel within 100 miles. · Deploy support personnel, tower crews, and engineering within 100 miles. · Deploy tractor trailers with replacement work space, antennas, power, computers and phones. · Facilities department on standby for replacement shelters · Basic necessities are acquired by support personnel when deployed: · Cash for one week · Food and water for one week · Gasoline and other fuels · Supplies, including chainsaws, batteries, rope, flashlights, medical supplies, etc.
  • 10. 3 24 hours prior to event: · Create an image of the system and files · Back up critical system elements · Verify backup generator fuel status and operation · Create backups of e-mail, file servers, etc. · Fuel vehicles and emergency trailers · Notify senior management In the event of a fire If fire or smoke is present in the facility, evaluate the situation, determine the severity, categorize the fire as major or minor and take the appropriate action as defined in this section. Call 9-1-1 as soon as possible if the situation warrants it. · Personnel are to attempt to extinguish minor fires (e.g., single hardware component or paper fires) using hand-held fire extinguishers located throughout the facility. Any other fire or smoke situation will be handled by qualified building personnel until the local fire department arrives. · In the event of a major fire, call 9-1-1 and immediately evacuate the area. · In the event of any emergency situation, system security, site security and personal safety are the major concerns. If possible, the operations supervisor should remain present at the facility until the fire department has arrived. · In the event of a major catastrophe affecting the facility, immediately notify senior management. Procedure STEP ACTION
  • 11. 1 Dial 9-1-1 to contact the fire department. 2 Immediately notify all other personnel in the facility of the situation and evacuate the area. 3 Alert emergency personnel on: <PHONE NUMBERS> Provide them with your name, extension where you can be reached, building and room number, and the nature of the emergency. Follow all instructions given. 4 Alert the EMT and DRT. Note: During non-staffed hours, security personnel will notify the Senior Executive responsible for the location directly. 5 Notify Building Security. Local security personnel will establish security at the location and not allow access to the site unless notified by the Senior Executive or his/her designated representative. 6 Contact appropriate vendor personnel to aid in the decision regarding the protection of equipment if time and circumstance permit. 7 All personnel evacuating the facilities will meet at their assigned outside location (assembly point) and follow instructions given by the designed authority. Under no circumstances may any personnel leave without the consent of
  • 12. supervision. In the event of a network services provider outage In the event of a network service provider outage to any location, the guidelines and procedures in this section are to be followed. Procedure STEP ACTION 1 Notify senior management of outage. Determine cause of outage and timeframe for its recovery. 2 If outage will be greater than one hour, route all calls via alternate services. If it is a major outage and all carriers are down and downtime will be greater than 12 hours, deploy satellite phones, if available. In the event of a flood or water damage In the event of a flood or broken water pipe within any computing facilities, the guidelines and procedures in this section are to be followed.
  • 13. Procedure STEP ACTION 1 Assess the situation and determine if outside assistance is needed; if this is the case, dial 9-1-1 immediately. 2 Immediately notify all other personnel in the facility of the situation and be prepared to cease voice operations accordingly. 3 Immediately notify all other personnel in the facility of the situation and be prepared to cease operations accordingly. 4 Water detected below the raised floor may have different causes: · If water is slowly dripping from an air conditioning unit and not endangering equipment, contact repair personnel immediately. · If water is of a major quantity and flooding beneath the floor (water main break), immediately implement power-down procedures. While power-down procedures are in progress, evacuate the area and follow management’s instructions. Plan review and maintenance This plan must be reviewed semiannually and exercised on an annual basis. The test may be in the form of a walk-through, mock disaster, or component testing. Additionally, with the dynamic environment present within <Company>, it is important to review the listing of personnel and phone numbers contained within the plan regularly.
  • 14. The hard-copy version of the plan will be stored in a common location where it can be viewed by site personnel and the EMT and DRT. Electronic versions will be available via <Company> network resources as provided by IT. Each recovery team will have its own directory with change management limited to the recovery plan coordinator. Alert/Verification/Declaration phase (x-x hours)Plan checklists Response and recovery checklists and plan flow diagrams are presented in the following two sections. The checklists and flow diagrams may be used by IT members as "quick references" when implementing the plan or for training purposes. ( Insert checklists and other relevant procedure documents here. ) Plan checklists Initials Task to be completed
  • 15.
  • 16. Flow diagrams ( Insert flow diagrams and other relevant procedure documents here. ) Notification of incident affecting the site On-duty personnel responsibilities If in-hours: Upon observation or notification of a potentially serious situation during working hours at a system/facility, ensure that personnel on site have enacted standard emergency and evacuation procedures if appropriate and notify the EMT and DRT. If outside hours: IT personnel should contact the EMT and DRT. Provide status to EMT and DRT Contact EMT and/or DRT and provide the following information when any of the following conditions exist: (See Appendix B for contact list.)
  • 17. · Two or more facilities are down concurrently for three or more hours. · Any problem at any system or location that would cause the above condition to be present or there is certain indication that the above condition is about to occur. The EMT will provide the following information: · Location of disaster · Type of disaster (e.g., fire, hurricane, flood) · Summarize the damage (e.g., minimal, heavy, total destruction) · Meeting location that is a safe distance from the disaster scene · An estimated timeframe of when a damage assessment group can enter the facility (if possible) · The EMT will contact the respective market team leader and report that a disaster involving voice communications has taken place. The EMT and/or DRT will contact the respective <Company> team leader and report that a disaster has taken place. Decide course of action Based on the information obtained, the EMT and/or DRT need to decide how to respond to the event: mobilize IT, repair/rebuild existing site (s) with location staff, or relocate to a new facility. Inform team members of decision If a disaster is not declared, the location response team will continue to address and manage the situation through its resolution and provide periodic status updates to the EMT/DRT. If a disaster is declared, the EMT and/or DRT will notify IT Tech Services immediately for deployment. Declare a disaster if the situation is not likely to be resolved within predefined time frames. The person who is authorized to
  • 18. declare a disaster must also have at least one backup person who is also authorized to declare a disaster in the event the primary person is unavailable. Contact general vendors (see Appendix I) Disaster declared: Mobilize incident response/Technical services teams/Report to command center Once a disaster is declared, the DRT is mobilized. This team will initiate and coordinate the appropriate recovery actions. Members assemble at the designated location as quickly as possible. See Appendix E for emergency locations. Conduct detailed damage assessment (This may also be performed prior to declaring a disaster.) 1. Under the direction of local authorities and/or EMT/DRT, assess the damage to the affected location and/or assets. Include vendors/providers of installed equipment to ensure that their expert opinion regarding the condition of the equipment is determined ASAP. A. Participate in a briefing on assessment requirements, reviewing: (1) Assessment procedures (2) Gather requirements (3) Safety and security issues NOTE: Access to the facility following a fire or potential chemical contamination will likely be denied for 24 hours or longer. B. Document assessment results using assessment and evaluation forms contained in Appendix G. Building access permitting: · Conduct an on-site inspection of affected areas to assess
  • 19. damage to essential hardcopy records (files, manuals, contracts, documentation, etc.) and electronic data. · Obtain information regarding damage to the facility (s) (e.g., environmental conditions, physical structure integrity, furniture, and fixtures) from the DRT. 2. Develop a restoration priority list, identifying facilities, vital records and equipment needed for resumption activities that could be operationally restored and retrieved quickly. 3. Recommendations for required resources.Contact DRT: Decide whether to continue to business recovery phase The EMT and DRT gather information regarding the event; contacts senior management and provides them with detailed information on status. Based on the information obtained, senior management decides whether to continue to the business recovery phase of this plan. If the situation does not warrant this action, continue to address the situation at the affected site(s). Business recovery phase (xx hours - full recovery) This section documents the steps necessary to activate business recovery plans to support full restoration of systems or facility functionality at an alternate/recovery site that would be used for an extended period of time. Coordinate resources to reconstruct business operations at the temporary/permanent system location, and to deactivate recovery teams upon return to normal business operations. <Company> system and facility operation requirements The system and facility configurations for each location are important to re-establish normal operations. A list for each location will be included in Appendix F. Notify IT staff/Coordinate relocation to new facility See Appendix A for IT staff associated with a new location being set up as a permanent location (replacement for site). Secure funding for relocation
  • 20. Make arrangements in advance with suitable backup location resources. Make arrangements in advance with local banks, credit card companies, hotels, office suppliers, food suppliers and others for emergency support. Notify EMT and corporate business units of recovery startup Using the call list in Appendix B, notify the appropriate company personnel. Inform them of any changes to processes or procedures, contact information, hours of operation, etc. (This may be used for media information.) Operations recovered Assuming all relevant operations have been recovered to an alternate site, and employees are in place to support operations, the company can declare that it is functioning in a normal manner at the recovery location. AppendixesAppendix A: <Company> recovery teams Emergency management team (EMT) Note: See Appendix B for contact list. Suggested members to include: senior management, human resources, corporate public relations, legal, IT services, risk management and operations Charter: Responsible for overall coordination of the disaster recovery effort; evaluation and determining disaster declaration; and communications with senior management. Support activities: The EMT: · Evaluate which recovery actions should be invoked and activate the recovery teams · Evaluate damage assessment findings · Set restoration priority based on the damage assessment reports · Provide senior management with ongoing status information
  • 21. · Act as a communication channel to corporate teams and major customers · Work with vendors and IRT to develop a rebuild/repair schedule Disaster recovery team Note: See Appendix B for contact list Charter: Responsible for overall coordination of the disaster recovery effort; establishment of the emergency command area; and communications with senior management and the EMT. Support activities: · Coordinate with EMT and senior management · Determine recovery needs · Establish command center and assembly areas · Notify all company department heads and advise them to activate their plan(s) if applicable, based upon the disaster situation · If no disaster is declared, take appropriate action to return to normal operations using regular staff · Determine if vendors or other teams are needed to assist with detailed damage assessment · Prepare post-disaster debriefing report · Coordinate the development of site-specific recovery plans and ensure they are updated semi-annually IT technical services (IT) Charter IT will facilitate technology restoration activities. Support activities · Upon notification of disaster declaration, review and provide support as follows: 1. Facilitate technology recovery and restoration activities,
  • 22. providing guidance on replacement equipment and systems, as required 2. Coordinate removal of salvageable equipment at disaster site that may be used for alternate site operations Appendix B: Recovery team contact lists Emergency management team (EMT) Name Address Home Mobile/Cell Phone
  • 23. Disaster recovery team (DRT) Name Address Home Mobile/Cell Phone
  • 25. Appendix C: Emergency numbers First responders, public utility companies, others Name Contact Name Phone Appendix D: Contact list Name Address Home Mobile/Cell Phone
  • 26. Appendix E: Emergency command center (ECC) locations Emergency command center - <location name> Primary: Address Room XXXX City, State Contact: “coordinator of rooms/space - (xxx) xxx-xxxx Alternate: Address Room XXX City, State Contact: “coordinator of rooms/space - (xxx) xxx-xxxx Emergency command center - <location name> Primary: Address Room XXXX City, State
  • 27. Contact: “coordinator of rooms/space - (xxx) xxx-xxxx Alternate: Address Room XXX City, State Contact: “coordinator of rooms/space - (xxx) xxx-xxxx Appendix F: Forms Incident/disaster form Upon notification of an incident/disaster situation the on-duty personnel will make the initial entries into this form. It will then be forwarded to the ECC, where it will be continually updated. This document will be the running log until the incident/disaster has ended and “normal business” has resumed. TIME AND DATE _____________________________________________________ ___________________ TYPE OF EVENT _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________
  • 28. LOCATION _____________________________________________________ ___________________ _____________________________________________________ ___________________ BUILDING ACCESS ISSUES _____________________________________________________ ___________________ _____________________________________________________ ___________________ PROJECTED IMPACT TO OPERATIONS _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ RUNNING LOG (ongoing events) _____________________________________________________
  • 29. ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________ _____________________________________________________ ___________________
  • 30. Critical equipment status form CRITICAL EQUIPMENT STATUS ASSESSMENT AND EVALUATION FORM Recovery team: __________________________________________ [----------STATUS---------] EquipmentConditionSalvageComments 1. ___________________ ______________ ______ _________________________ 2. ___________________ ______________ ______ _________________________ 3. ___________________ ______________ ______ _________________________ 4. ___________________ ______________ ______ _________________________ 5. ___________________ ______________ ______ _________________________ 6. ___________________ ______________ ______ _________________________ 7. ___________________ ______________ ______ _________________________ 8. ___________________ ______________ ______ _________________________ 9. ___________________ ______________ ______ _________________________ 10. __________________ ______________ ______ _________________________ 11. __________________ ______________ ______ _________________________ 12. __________________ ______________ ______ _________________________ 13. __________________ ______________ ______
  • 31. _________________________ 14. __________________ ______________ ______ _________________________ 15. __________________ ______________ ______ _________________________ Legend Condition: OK - Undamaged DBU - Damaged, but usable DS - Damaged, requires salvage before use D - Destroyed, requires reconstruction Appendix G: Building evacuation information ( Provide evacuation procedures ) Appendix H: Inventory of primary equipment and network services ( Provide list of equipment and network services ) Appendix I: Inventory of backup equipment and systems ( Provide list of equipment ) Appendix J: Approved vendor list
  • 32. Server and computer equipment suppliers Company Name Contact Work Mobile phone Communications and network services suppliers Company Name Contact Work Mobile phone
  • 33. 1 All Rights Reserved, 2010, TechTarget <Company> RESTRICTED Case Study: After reviewing the case studies (Security and Privacy on Social Networking Sites, Security for social networking, Social Networking and Security Risks & WP Security Guide to Social Networks) use the Finding Page document and answer (A) What are the security and privacy risks associated with social networking and (B) what are the issues, procedures & best practices companies should implement and (C) how else can you minimizing risks? Internet/Exercise Problem: Enter and surf the term “Disaster Recovery Testing Services” in search and find 3 companies that provide those services/tools, then use the Finding Page document and answer/evaluate (A) what are some of the tools/services being offered and (B) what are the benefits of using these outside services versus in-house, how effectively can they be and (C) after reviewing these templates (Business Continuity Test Template, BCP-template, T-BC8000-exercise-
  • 34. template, DR7000-test-lessons-learned & F-DR7000-test- objectoves-by-team) what are the key components, what’s their value, usefulness for the organization? www.pwc.com/security Navigating security in the cloud Advisory Services Security Cloud computing is rapidly moving into the mainstream. The benefits are undeniable, but look at whether your security needs are met.
  • 35. The heart of the matter ............................................................................................... ......... 1 An in-depth discussion ............................................................................................... ........ 2 What this means for your business ................................................................................... 10 Contacts ............................................................................................... ............................... 11 Table of contents 1 The heart of the matter Cloud computing has proved it can deliver lower IT costs, diminished infrastructure complexity, and enhanced flexibility. As the technology
  • 36. advances into the mainstream, organizations are finding that it also can spur innovation by lowering the financial barriers to creating new products and services. Consider, for instance, a global pharmaceutical company. To rapidly investigate and develop new products, this drugmaker needed to quickly spin up computing burst capacity to run data – and processor-intensive algorithms for modeling, simulations, and visualizations. After thoughtful consideration, the pharmaceutical company deployed select R&D environments to multiple cloud providers. The result? The cloud’s on-demand, high- performance computing capabilities have enabled the company to rapidly deploy new test environments, which has dramatically reduced the cycle time from idea to execution. For instance, the company can provision a 64-machine cluster computer and complete a sequence set in 20 minutes – rather than 12 weeks – at a cost of less than $7. Rapid
  • 37. delivery of new computing environments has helped this pharmaceutical company’s scientists make quick decisions on drug research and has significantly lowered the cost of innovation. The drugmaker’s experience illustrates a newfound power of cloud computing: A strategic ability to drive business growth, rather than simply delivering efficient IT services at a lower cost. As the function of cloud computing expands, so does the need for effective security. Chief Information Security Officers (CISOs) understand that, while security for cloud computing is no different than security controls for any IT environment, the stakes can be perilously higher. This is because the possibilities of data loss, data leakage, service downtime, regulatory constraints, and risk of intellectual property theft are amplified in the cloud model. Accordingly, significant security hurdles must be cleared before a business implements
  • 38. cloud computing. Organizations must first carefully assess which of its applications and data are appropriate to move to a cloud environment. The company also must strenuously evaluate the capabilities of any potential cloud services provider, including factors such as data security and privacy, compliance, availability, and scalability. At the same time, it is important to consider the portability of data and applications to ensure that organizations can move to a new provider should an existing vendor fail to deliver agreed-upon service levels. As cloud computing matures, organizations are beginning to understand that its benefits extend beyond lower IT costs and higher operating efficiencies. But without careful planning and consideration of market concerns, these gains can be overshadowed by risks. 2
  • 39. An in-depth discussion Demand for cloud computing services has been fueled by the lingering effects of the global recession, which forced many organizations to trim costs while meeting increased customer demands. While this “do more with less” mandate remains a priority for most companies, many chief executives have turned their focus to growth – and to cloud computing. Today, business leaders recognize that the cloud presents a powerful new opportunity to drive business growth while meeting the challenges of cost containment. Its elastic architecture can spur innovation by lowering the financial barrier to trying new ideas and speeding the time to market for new products and services. Some companies, in fact, are using the cloud
  • 40. model to create new lines of business by partnering with external providers. Given these benefits, it isn’t surprising that cloud computing is evolving from experimental to mainstream. PwC’s 2012 Global State of Information Security Survey of more than 9,600 security and IT leaders found that four out of 10 (41%) respondents said their business already uses cloud services. Adoption of the cloud is expected to skyrocket during this decade: Forrester Research forecasts that the global market for cloud computing services will soar from $40.7 billion in 2011 to more than $241 billion in 2020.1 One reason for this growth spike is the continuous maturity of cloud computing suppliers and trust of cloud service consumers. Tentative early
  • 41. implementations of cloud services have given way to large-scale deployments of business functions such as customer relationship management (CRM), talent management, payroll, and enterprise communications and collaboration. Early implementations of cloud computing proved that the cloud’s pay-as-you-go structure can trim IT spending and boost agility. It also allows a business to take 1 Forrester Research, Inc., Sizing the Cloud, April 2011 2% 47% 69% 33% Do not know Infrastructure as a Service Software as a Service Platform as a Services Saas leads cloud deployments
  • 42. 41% of respondents to PwC’s 2012 Global State of Information Security Survey say they have deployed some form of cloud computing. Most (69%) use Saas. 3 advantage of up-to-the-minute technologies without prohibitive up-front investments in hardware and software. The cloud model can save money by recapturing the lost value of underutilized hardware. Infrastructure resources often sit idle in most organizations: PCs and servers, for instance, are used at only 10% of their processing capacity, while network storage is utilized at 50% capacity. With cloud services, hardware and applications are used (and paid for) on
  • 43. demand. The service provider can scale or add capacity on the fly to adjust to fluctuations in demand. As noted with the pharmaceutical company above, R&D computing resources can be deployed in a matter of minutes; the business need not install and configure new hardware or software. The cloud model, if executed properly, also provides built-in redundancy with no single point of failure. Service level agreements (SLAs) that formally define expectations for issues such as availability, reliability, and performance can provide flexibility while decreasing downtime. Cloud computing also can enable in-network redundancy with automated recovery
  • 44. to help eliminate disaster recovery risks and costs. The cloud model offers another critical step toward IT agility: full customer self-service. This enables businesses to provision, manage, and terminate services without involving the service provider. The result? Speedy, efficient management of IT services and functions. Finally, we are seeing new cloud solutions that empower employees to collaborate across departmental What’s in a cloud? A definition Despite maturation of the industry, a precise definition of cloud computing remains somewhat elusive. To clarify, we will use the description published by the National Institute of Standards and Technology (NIST). The institute defines cloud computing as a model for enabling convenient, on-demand network access to a shared pool of configurable computing
  • 45. resources that can be rapidly provisioned and released with minimal management effort or service provider interaction. Cloud solutions are typically marketed and described based on the type of services they deliver. Three of the most common offerings are: • Software as a service (SaaS): The consumer employs a web browser to access a provider’s applications running on a cloud infrastructure. (Examples: NetSuite, Salesforce.com, SuccessFactors) • Platform as a service (PaaS): The consumer deploys applications on a cloud provider’s infrastructure but has no control over the underlying network or servers. (Examples: Google App Engine, Microsoft Windows Azure, DotCloud) • Infrastructure as a service (IaaS): The consumer provisions resources on the provider’s infrastructure and can control operating systems, data, and applications – but not the underlying infrastructure. (Examples: Amazon.com EC2, Joyent, Rackspace.) Cloud computing is commonly delineated by deployment model or service model. Today three deployment models are dominant: • Public: A public cloud infrastructure is available to individual consumers or businesses.
  • 46. • Private: A private cloud is operated solely for an organization and can be managed by the organization or a third-party company, on site or off site. • Hybrid: A hybrid cloud comprises a mix of public and private cloud infrastructures that are discrete entities but are integrated to allow interoperability of data and applications. 4 boundaries, which can improve knowledge sharing and efficiency in completing projects, and ultimately boost innovation. The realities and risks of the cloud Any organization considering a move to the cloud must understand both the inherent shortcomings and strengths of cloud computing to reap its full potential and value. Among CISOs, threats to data security and privacy have always been the dark side of the cloud. Yet as organizations adopt cloud computing, many are finding that security
  • 47. delivered by service providers meets or beats their needs. In fact, PwC’s 2012 Global State of Information Security Survey found that 54% of companies that have implemented cloud computing report the technology has actually improved their security posture. Advanced security capabilities implemented by service providers have persuaded corporations, non-profit organizations, and governments to entrust cloud service vendors with a widening array of data and applications. There is perhaps no better indicator of this newfound trust than the US government’s adoption of cloud-based solutions for several cabinet-level agencies, including the Department of Homeland Security, which is pursuing both public and private cloud solutions. In discussing their plans for cloud computing, government officials cite the cost savings of up to 10% and fast scalability of the cloud model, but they also tout the enhanced security of the cloud. 2 At the same time, standards organizations are focusing on creating cloud security
  • 48. guidelines. The NIST and the Cloud Security Alliance (CSA), for example, have published new guidance and standards for cloud implementations. Despite these advances, security leaders are most concerned about data privacy in the cloud. Our 2012 Global State of Information Security Survey found that 32% of respondents believe the greatest security risk is an uncertain ability to enforce the cloud provider security policies. Another worry, cited by 11% of respondents, is that data may be stored on servers shared with other companies. Because these servers can span multiple geographies, an approach known as multi-tenancy, sensitive information could be governed by multiple – and sometimes conflicting – jurisdictions. CISOs also are well aware that the threat landscape today is unparalleled, with increasingly targeted – and effective – attacks perpetrated by sophisticated, patient intruders. The most serious of these threats originate from organized crime groups and
  • 49. nation states that have clandestinely launched a new generation of complex advanced persistent threats (APTs). At the same time, a growing movement of “hacktivists” representing loosely organized groups like Anonymous and LulzSec are also preying upon corporations and governments that run afoul of their political and social convictions. 2 Testimony of Richard A. Spires, Chief Information Officer, before the House Committee on Homeland Security Subcommittee, October 6, 2011 http://www.dhs.gov/ynews/testimony/20111006-spires-cloud- computing.shtm 5 Due to their sheer size, cloud-based service providers are tempting targets. Cyber criminals who gain access to a cloud data center can potentially steal millions of customer records, as well as valuable intellectual property and trade secrets. And because cloud providers often employ a multi-country infrastructure with
  • 50. servers and employees scattered across continents, the potential points of vulnerability are multiplied. And it’s not just hackers that keep security leaders awake at night. Employees of cloud providers, such as privileged system administrators and other “super users,” may view or leak sensitive information, potentially damaging a customer’s security posture and incurring costly reputational harm. Similarly, insiders at a cloud consumer can unwittingly expose the organization to the same kinds of risk. Often, line of business managers purchase cloud services without the approval of IT or security leaders. These managers may mean well, but they are typically unaware of – and do not adhere to – security policies. Another concern has been availability and reliability of services, since outages can lead to operational downtime that result in lost revenue or a blemished reputation. It’s a hazard that even the most respected cloud providers have occasionally failed to avoid.
  • 51. Data classification and data-handling practices employed by cloud providers also concern CISOs. Indeed, in several incidents, hackers have guessed user passwords to gain access to confidential documents stored in the cloud and then forwarded those documents to third parties. In other cases, cloud service providers simply lost customer data. Another area of concern is data storage practices. The cloud model enables data to bounce swiftly around the world on leased servers in far-flung geographic locations. This can be enormously complicated for organizations that must comply with regulatory and privacy regulations mandating where information can be stored, processed, or accessed. A German company with data residing in the United States, for instance, is subject to both US and German privacy and security laws and regulations. The right data and applications for the cloud Top-tier cloud service providers have implemented critical controls and deployed technologies to defend against these evolving threats. As cloud security continues to
  • 52. mature, their efforts have gained the trust of security leaders and C-suite officers. Nonetheless, any cloud implementation must be approached with great caution and strenuous assessment. Organizations must evaluate their current infrastructure to determine which sensitive data and applications should – and should not – be sent to the cloud. PwC believes that moving non-differentiating business function to the cloud would incur minimum risk to the organization. This would include, for example, human resources, payroll, accounting, and CRM, as well as hosted applications such as e-mail and web conferencing. 6 Mission-critical data and intellectual property, however, should remain within the locked-down confines of the enterprise. Similarly, regulated data like credit card
  • 53. information and healthcare records should be sent to the cloud only if the cloud supplier has security controls that match or surpass those required by the organization and its regulators. It is imperative to remember that the business, and not the cloud services provider, is ultimately responsible for security and ownership of this data. When developing a business case to send data or applications to the cloud, the business- unit leader should work with IT and security personnel to determine what data and applications are appropriate for cloud computing. It also will be necessary to factor in the costs of working with IT and security teams to perform initial and on-going assessments. Organizations should develop a flexible, adaptable framework to manage emerging governance and compliance issues. CISOs should delineate risk thresholds by working with the service provider to create common controls that define who is responsible for risk, as well as which party owns responsibility for data in transit and data at rest.
  • 54. Before an enterprise moves data to the cloud, CISOs must determine whether personally identifiable information will be involved and whether international regulatory laws regarding export or transport controls are a concern. To that end, the business must know what data are subject to regulations such as those included in the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach- Bliley Act, Payment Card International Data Security Standard (PCI DSS), and the Sarbanes-Oxley Act. For data that may be subject to audit, the business must ensure that the cloud service provider has the technical capability to identify where, when, and how data are used. PCI auditors, for instance, will want to know where data is located, where it has been, and whether it has been accessed without record. HIPAA auditors, on the other hand, will require a firewall that doesn’t allow outsiders to make application programming interface (API) calls to their compute and storage systems, among other requirements.
  • 55. Assessing the cloud provider’s capabilities Once the CIO and business leaders determine which services and data to send to the cloud, the CISO must implement the proper controls. Together, IT and security executives will then evaluate cloud service providers and their security capabilities, understand any gaps in protections, and, finally, select a provider. Today there is no standard attestation method or control framework for cloud computing, nor is there a one-size-fits-all implementation strategy; deployment will be unique to each individual business. To gain confidence in a potential provider, a business should perform due diligence using an accepted security control framework; engaging an independent adviser to help with this assessment is advisable for many organizations. Another option that is gaining favor among cloud consumers is the use of a cloud broker. A cloud broker can help IT and security leaders negotiate the relationship with cloud providers and manage the use, performance, and delivery of
  • 56. cloud services. In addition to 7 helping organizations obtain and customize services, cloud brokers can also help tailor security capabilities. Whether using a broker or approaching the cloud independently, the following controls are critical: Contractual agreements: You own the data, so determine what rights and recourse you have for security breaches or incidents. Because you have no control over the cloud provider’s infrastructure, SLAs, contract requirements, and provider documentation play a more important role than in traditional IT environments. Access controls: The cloud provider should prove that it has implemented and enforces administrative controls to limit employee and partner/supply chain access
  • 57. to your information. It also should adequately investigate the background of employees who will have access to data. Certification and third-party audits: Verify that the provider has some form of accepted third-party review of security (Statement on Standards for Attestation Engagements 16 or ISO 27001 certification, for instance). If possible, seek independent reviews of their facilities and operations. (See sidebar.) Compliance requirements: Determine whether the supplier meets your compliance needs. A critical factor will be the geographic locations of the provider’s servers; be aware of laws that impact your data in any country in which it may reside. Availability, reliability, and resilience: Enact agreements on measurable availability and reliability service levels. Understand your options if the provider does not meet agreed-upon levels. Backup and recovery: In the event of disaster, document recovery requirements
  • 58. are in writing; understand a provider’s capabilities before you engage it. Decommissioning: Agree that data will be securely deleted once it is no longer needed. Also make certain that virtual machines or processes are securely decommissioned. Portability: Determine whether you can easily move data and applications to another cloud provider or migrate data and applications back to an on-premises environment, if necessary. Before selecting a cloud provider, make sure that it does not use specialized or proprietary technologies that would create vendor lock-in. In addition, organizations should implement additional data security controls (such as information rights management and data leakage prevention) to ensure that sensitive data is not inadvertently moved to the cloud. Businesses also should update their incident response program to address cloud incidents, and ensure that vendor agreements require
  • 59. cloud providers to work with its customers during incidents. 8 An in-depth “secure the cloud” assessment The next step is to perform a comprehensive risk-based assessment of the cloud environment. This overall security evaluation should include factors such as access management, security standards, information handling, patch management, and event monitoring and investigations. The goal is to identify gaps in security protections offered by cloud providers and determine the most effective means to mitigate the risk to your data, including customizing cloud services to your needs or extending internal security governance measures to the cloud environment. A secondary objective is to understand potential ways data can be compromised and the likelihood that it will happen.
  • 60. When assessing cloud service suppliers, you should apply company-specific risk ratings to the evaluation. In doing so, pay particularly close attention to how well a supplier will be able to follow the letter of your security policies. We believe that the best model is one in which all outsourced data are encrypted both in transit and in storage. A “secure the cloud” approach should encompass the following: Security: The assessment of information security should include, at a minimum, data encryption, data storage location, segregation, risk management, user access, systems management, and incident response. • Privacy: Privacy can be assessed using the generally accepted privacy
  • 61. principles audit framework published by the American Institute of Certified Public Accountants/Canadian Institute of Chartered Accountants. Organizations should also use the privacy guidance that is appropriate to their industry, such as the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act. A new standard for independent assessments Independent certification of cloud supplier capabilities is an uncertain undertaking because a comprehensive framework to measure cloud suppliers’ capabilities does not yet exist. Typically, cloud providers offer self- or third-party assessment using independent control frameworks like SAS 70 Type 2 reports. The SAS 70 auditing statement has been widely used to certify cloud providers, although it was not designed for this purpose. SAS 70 has been replaced by the
  • 62. Statement on Standards for Attestation Engagements 16 (SSAE 16). Despite minor differences, neither extends beyond controls relevant to financial reporting. Other assessment options include the Federal Information Security Management Act (FISMA) and ISO 27001. These standards focus primarily on traditional security issues, however, and do not include cloud concerns such as SLAs and multi-tenancy. The American Institute of Certified Public Accountants (AICPA) has released a new standard for assessment of cloud service providers. The AICPA’s Service Organization Controls (SOC) reports create an attestation standard designed to address broad control considerations, including security, privacy, availability, confidentiality, and processing integrity. SOC reports allow third-party auditors to report on operational and compliance controls that are relevant to cloud services. 9 Scalability: Scalability is assessed by due diligence on aspects such as load testing,
  • 63. stress testing, and forecast growth. Metering: Metering can be assessed by revenue-recognition testing as well as due diligence on the integrity and security of metering systems. Availability: Availability can be measured by investigating resilience of the architectural components and reviews of data recovery and information retrieval aspects. Data leakage: The likelihood of unauthorized disclosure of data can be examined by a risk assessment that specifically evaluates data- leakage vulnerabilities. While businesses have no single official framework for attestation of cloud providers, the US government has developed an authorization framework as part of its Cloud First initiative. The framework, known as the Federal Risk and Authorization Management Program (FedRAMP), provides a standardized approach to security assessment,
  • 64. authorization, and continuous monitoring for cloud products and services This unified certification program was designed to achieve consistent security authorizations using agreed-upon standards and accredited third-party assessment organizations. All new cloud service providers must comply with this framework, which is largely based on existing FISMA controls. Cloud vendors that are already doing business with government agencies must attain FedRAMP compliance within two years. The Department of Homeland Security (DHS) has primary responsibility for the FedRAMP initiative. A Joint Authorization Board, which comprises CIOs from the DHS, the Department of Defense, and the General Services Administration, reviews assessment results conducted by third-party organizations and grants authorization to service providers. Once authorized, a cloud service provider is recognized as meeting federal security requirements and can be employed by other agencies without an additional
  • 65. assessment. This “approve once and use many” approach is designed to help government agencies quickly and cost-effectively assess and engage providers. FedRAMP illustrates the US government’s commitment to accelerate the adoption of cloud computing. Ultimately, FedRAMP will also increase confidence in the security and privacy of data stored on the cloud. 10 What this means for your business Cloud computing can transform the way you do business. Like any transformation, however, a successful cloud strategy requires a new mind-set – and new tools – to help ensure that security meets your specific needs. If you haven’t developed a cloud strategy, now is the time to start. Yet we urge you to
  • 66. include security controls and periodic security assessments in your strategy. Implementation of a cloud solution demands a thorough analysis of your business needs, expected benefits, risks, and the capabilities of the cloud service provider. We believe this assessment is best undertaken with the assistance of a trusted partner with a strong strategic and technical vision. That is where we can help. PwC can help you build data protection capabilities that align with the shifting cloud environment. We can perform a comprehensive “secure the cloud” assessment to match your company’s needs with a service provider’s offerings. Our team of specialists can help identify a service provider that is trustworthy, mature, and capable of handling your sensitive data and production applications. With cloud computing, data security is a particularly critical issue that requires highly skilled guidance in planning and implementation. PwC is a recognized, trusted leader in security consulting with global expertise in the full range of data protection, privacy, and
  • 67. compliance solutions. The benefits of cloud computing are undeniable. We believe it’s time to get started on a new strategic path. One that stretches to the clouds. 11 Contacts To have a deeper conversation on cloud computing security or on any of the topics mentioned, please contact: Gary Loveland Principal, National Security Leader [email protected] John Hunt Principal, Washington [email protected] Brad Bauch Principal, Houston
  • 68. [email protected] Jerry Lewis Principal, Dallas [email protected] Rik Boren Partner, St. Louis [email protected] Mark Lobel Principal, New York [email protected] Kevin Campbell Partner, Atlanta [email protected] Sloane Menkes Principal, Washington [email protected] Michael Compton Principal, Detroit [email protected] Joe Nocera Principal, Chicago
  • 69. [email protected] Shawn Connors Principal, New York [email protected] Chris O’Hara Principal, San Jose [email protected] Scott Evoy Principal, Boston [email protected] Fred Rica Principal, New York [email protected] Joe Greene Principal, Minneapolis [email protected] Sohail Siddiqi Principal, San Jose [email protected] Peter Harries Principal, Phoenix [email protected]
  • 70. Andy Toner Principal, New York [email protected] This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors. © 2012 PricewaterhouseCoopers LLP. All rights reserved. PwC refers to the United States member firm, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details. mailto:[email protected] ITEC 437: Disaster Recovery and Enterprise Continuity Findings Page Student Name Class Deliverable Due date: Information Sought: Repeat the Question in this assignment Answer A: Answer B:
  • 71. Answer C: Exercise Comments (Not Graded): Planning Guide Cloud Security SEPTEMBER 2011 Seven Steps for Building Security in the Cloud from the Ground Up Why you should read this document: This guide provides practical information to help you integrate security planning into your cloud computing initiatives and: • Makes suggestions and recommendations for strengthening data and platform protection in cloud implementations. • Provides guidance on encryption to protect data. • Describes the importance of a trusted foundation to secure platform and infrastructure. • Explains how to build higher assurance into auditing to strengthen compliance.
  • 72. • Discusses extending trust across federated clouds. Planning Guide Cloud Security Seven Steps for Building Security in the Cloud from the Ground Up Sponsors of Tomorrow.™ SEPTEMBER 2011 Intel IT Center Planning Guide | Cloud Security2 3 Security in the Cloud: What It Is (and What It Isn’t) 5 Security Challenges for Cloud Environments 6 Step 1: Start Security Planning Early 10 Step 2: Identify Vulnerabilities for Your Selected Service(s) 12 Step 3: Four Things an IT Manager Can Do To Mitigate Security Vulnerabilities 13 Step 4: Protect Data—in Motion, in Process, and at Rest 15 Step 5: Secure Your Platform
  • 73. 16 Step 6: Extend Trust across Federated Clouds 17 Step 7: Choose the Right Cloud Service Provider 19 Intel Resources for Learning More Contents Intel IT Center Planning Guide | Cloud Security3 Cloud Security: What It Is (and What It Isn’t) The cloud seems to be on everyone’s mind these days. If you’ve been considering how to make the leap to cloud computing, you’ve also had to start thinking about how to extend security to this new technology environment. Despite potential savings in infrastructure costsand improved business flexibility, security is still the number- one barrier to implementing cloud initiatives for many companies. Cloud computing security is a broad topic with hundreds of considerations—from protecting hardware and platform technologies in the data center to enabling regulatory compliance and defending cloud access through different end-point devices. The focus of this planning guide is to provide you with suggestions and
  • 74. Cloud Security Is ... • The response to a familiar set of security challenges that manifest differently in the cloud. New technologies and fuzzier boundaries surrounding the data center require a different approach. • A set of policies, technologies, and controls designed to protect data and infrastructure from attack and enable regulatory compliance. • Layered technologies that create a durable security net or grid. Security is more effective when layered at each level of the stack and integrated into a common management framework. • The joint responsibility of your organization and its cloud provider(s). Depending on the cloud delivery model and services you deploy, responsibility for security comes from both parties. Cloud Security Isn’t … • A one-size-fits-all solution that can protect all your IT assets. In addition to different cloud delivery models, the cloud services you deploy will most likely require more than one approach to security. • A closed-perimeter approach or a “fill-the- gap” measure. Organizations can no longer rely on firewalls as a
  • 75. single point of control, and cobbling together security solutions to protect a single vulnerability may leave you open in places you don’t suspect. • Something you can assume is provided at the level you require by your cloud service providers. Make sure you spell out and can verify what you require. Security challenges in the cloud are familiar to any IT manager—loss of data, threats to the infrastructure, and compliance risk. What’s new is the way these threats play out in a cloud environment. recommendations for strengthening data and platform protection in your cloud implementations. The remainder of this guide walks you through seven key steps that will help you plan your cloud security from the ground up. Intel IT Center Planning Guide | Cloud Security4 Intel Experience with Cloud Security Much of the information in this document comes from our experience working with cloud providers, virtualization and security solution vendors, OEMs, and large enterprise customers— as well as the experience of our own Intel IT building and
  • 76. deploying cloud technology. Intel IT has embarked on a radical five-year redesign of the Intel information security architecture. This redesign moves us away from a traditional binary trust model to a multitiered trust model with a particular emphasis on data and people as the new perimeter. This new architecture is designed to support key initiatives such as cloud computing as well as IT consumerization. Our Intel Cloud Builders1 program continues to yield in-depth guidance that you can use, including reference architectures, education, and a forum for discussion of technical issues. In addition, Intel’s strategic partnership with McAfee2 provides the foundation for a holistic security and compliance management platform to ensure overall integrity of the cloud infrastructure. Three Major Trends That Impact Cloud Security To manage cloud security in today’s world, you need a solution that helps you address threats to enterprise data and infrastructure, including the major trends you are up against. • Changing attackers and threats: Threats are no longer the purview of isolated hackers looking for personal fame. More and more, organized crime is driving well-resourced,sophisticated,
  • 77. targeted attacks for financial gain. • Evolving architecture technologies: With the growth of virtualization, perimeters and their controls within the data center are in flux, and data is no longer easily constrained or physically isolated and protected. • Dynamic and challenging regulatory environment: Organizations—and their IT departments—face ongoing burdens of legal and regulatory compliance with increasingly prescriptive demands and the high penalties for noncompliance or breaches. Examples of regulations include Sarbanes-Oxley (SOX), Payment Card Industry (PCI), and the Health Insurance Portability and Accountability Act (HIPAA). 1 Intel Cloud Builders is a cross-industry initiative to help enterprises, telecommunications companies, and service providers build, enhance, and operate secure cloud infrastructures. 2 McAfee is a wholly owned subsidiary of Intel. http://www.intel.com/content/www/us/en/cloud- computing/cloud-builders-provide-proven-advice.html Intel IT Center Planning Guide | Cloud Security5 The Cloud Security Alliance, an industry group promoting cloud computing security best practices and standards, has identified
  • 78. seven areas of security risk.3 Three of these apply directly to our focus on protecting data and platform: multitenancy, data loss, and unknown risk. Multitenancy and shared technology issues. Clouds deliver scalable services that provide computing power for multiple tenants, whether those tenants are business groups from the same company or independent organizations. That means shared infrastructure— CPU caches, graphics processing units (GPUs), disk partitions, memory, and other components—that was never designed for strong compartmentalization. Even with a virtualization hypervisor to mediate access between guest operating systems and physical resources, there is concern that attackers can gain unauthorized access and control of your underlying platform with software-only isolation mechanisms. Potential compromise of the hypervisor layer can in turn lead to a potential compromise of all the shared physical resources of the server that it controls, including memory and data as well as other virtual machines (VMs) on that server. Experience at Intel found that virtualization brings with it an aggregation of risks to the enterprise when consolidating application components and services of varying risk profiles onto a single physical server platform. This is a key limiter faced by most IT organizations in achieving their virtualization goals— and
  • 79. subsequently in moving workloads to the cloud. Data loss or leakage. Protecting data can be a headache because of the number of ways it can be compromised. Some data— customer, employee,or financial data, for example—should be protected from unauthorized users. But data can also be maliciously deleted, altered, or unlinked from its larger context. Loss of data can damage your company’s brand and reputation, affect customer and employee trust, and have regulatory compliance or competitive consequences. Unknown risk. Releasing control of your data to a cloud service provider has important security ramifications. Without clearly understanding the service provider’s security practices, your company may be open to hidden vulnerabilities and risks. Also, the complexity of cloud environments may make it tempting for IT managers to cobble together security measures. Unfortunately, that same complexity and the relatively new concept of cloud computing and related technologies make it difficult to consider the full ramifications of any change, and you may be leaving your cloud open to new or still undiscovered vulnerabilities. 3 Top Threats to Cloud Computing, v1.0. Cloud Security Alliance (2010). https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf (PDF)
  • 80. Intel and Best Practices in Cloud Security Intel is a member of several industry groups that develop standards and best practices for security and cloud computing, such as the Cloud Security Alliance (CSA). For example, Intel is the nonvoting technical advisor to the Open Data Center Alliance (ODCA), an independent IT consortium comprised of global IT leaders who have come together to provide a unified customer vision for long- term data center requirements represented by more than 280 member companies. ODCA released a roadmap of hardware and software requirements in June 20114 with the goal of promoting more open and interoperable cloud and data center solutions. Intel is also an active participant in the Trusted Computing Group (TCG), formed to develop and promote open, vendor-neutral standards for trusted computing building blocks; and the Distributed Management Task Force (DMTF), a global organization leading the development, adoption, and promotion of interoperable management initiatives and standards. 4 Information about the Open Data Center Alliance roadmap can be found at opendatacenteralliance.org/publications. Security Challenges for Cloud Environments https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf http://www.opendatacenteralliance.org/publications
  • 81. Intel IT Center Planning Guide | Cloud Security6 Yoursecurity profile in the cloud is defined by what your organization needs and the workloads you plan to move to the cloud. The best way to approach cloud security is to integrate it with your overall cloud planning early in the process. That way you can use a threat-based approach to planning for deployments of your specific workload(s), the security requirements, and the specific cloud delivery model and architecture. The first step in planning security for your proposed cloud environment is to thinkabout the fundamentals: data and platform. Use the following as a checklist for what you need to know (at least at a high level) about the specific deployment you’re planning. The idea is to understand your risk tolerance, identify the best deployment models for your specific needs based on security and compliance considerations, and detect potential exposure points for sensitive data and processes. With this information, you will be in a better position to understand what your organization really needs. As you embark on your own cloud initiatives, here are a few of the considerations that will affect your risk profile in the cloud. • Are your physical compute resources located on-premises or off-premises?
  • 82. • What types of assets, resources, and information will be managed? • Who manages them and how? • Which controls are selected, and how are they integrated into the overall cloud architecture? • What compliance issues do you face? The Fundamentals Step 1: Start Security Planning Early Task Purpose Additional Considerations Identify the business priorities for moving the specific workload(s) to the cloud. You can more effectively weigh security concerns once you’ve defined the business context for what you hope to achieve by moving workloads to the cloud. • What drivers make cloud technology a good option for this workload? • Do you need to: o Reduce operational costs? o Scale seasonally? o Support remote or mobile workers? Evaluate the sensitivity
  • 83. of the asset(s). This helps you understand the importance of the data or function. You can make this evaluation as a rough assessment or follow a specific valuation process. • What harm would result if the asset was compromised? Intel IT Center Planning Guide | Cloud Security7 Task Purpose Additional Considerations Map the security workload to the appropriate cloud delivery model and hosting models under consideration. Now that you understand the importance of your asset, you can evaluate the risks associated with various deployment models. • Are you considering a private, public, or hybrid cloud delivery model? • For a private cloud, will your deployment be: o On-premises? o Off-premises with a dedicated or shared infrastructure? • For hybrid models, where will the various components, functions, and data reside?
  • 84. • How will you mitigate risk within the cloud delivery model? Determine whether the available services are capable of meeting your requirements for handling data, especially for compliance purposes. At this point, you need to understand your risk tolerance for the workload. If you have a cloud service provider in mind, you can conduct a more detailed risk assessment. • What are the specific requirements for handling regulated data? Map the data flow, especially for public or hybrid cloud providers. You need to know how data moves in and out of the cloud. For specific deployment options, you should understand how data will flow between your organization, the cloud services, and any customers (or other areas). • Can the provider continue to deliver protection as the workload continues to evolve? Intel IT Center Planning Guide | Cloud Security8
  • 85. Cloud Delivery Models at a Glance Cloud delivery models used by enterprise organizations generally fall into three types, each with its own unique advantages and disadvantages in terms of security. Model Description Advantages and Disadvantages Private • An internal infrastructure that leverages virtualization technology for the sole use of an enterprise behind the firewall • Can be managed by the organization or by a third party • Located on-premises or off-premises on shared or dedicated infrastructure • Most control over data and platform • Potential for multitenancy of business units to cause compliance and security risk • May lack bursting capabilities when additional performance or capacity is required Public • Resources dynamically provisioned over the Internet, via web services, or from a third-party provider • Located off-premises, typically on a shared (multitenancy) infrastructure • May offer dedicated infrastructure as a response to
  • 86. growing security concerns • Potential for greater cost savings if infrastructure owned and managed by public provider • Loss of control of data and platform • Potential for multitenancy with other organizations to cause security risk • Third-party security controls possibly not transparent (and may cause unknown risks) Hybrid • A combination of private and public cloud services • Organizations that oftenmaintain mission-critical services privately with the ability to cloud burst for additional capacity or add selective cloud services for specific purposes • Located on-premises and off-premises dependingon the architecture and specific services • Often a compromise: o Retention of control over the most mission-critical data, but relinquishing that control when additional capacity or scale is required during peak or seasonal periods o May involve retention of control for mission- critical data at all times while taking advantage of public cloud provider
  • 87. services for less sensitive areas • Potential for complexity to cause unknown vulnerabilities (and unknown risks) Intel IT Center Planning Guide | Cloud Security9 Intel Vision for Cloud Security One key element of the Intel vision for cloud security is to build in balanced controls instead of designing an environment based primarily on preventive controls. For example, the architecture is designed to dynamically adjust a user’s access privilege as the level of risk changes, taking into account factors such as location and type of device. This new approach is both proactive to minimize occurrences and reactive to minimize damage if a breach occurs. Intel IT uses a hybrid approach that leads with a private cloud as the core strategy. In part based on security concerns, we selectively use a public cloud for nondifferentiated IT services such as staffing, benefits, expense, stock, and travel. We host the vast majority of our applications in our private cloud, such as enterprise, user profile management, productivity, and collaboration applications. We expect that more of our applications could burst to public clouds over time as security and vendor service level agreements
  • 88. (SLAs) improve and overall costs, including transition costs, become more favorable. Intel IT Center Planning Guide | Cloud Security10 Spotlight on Cloud Service Architecture5 There are three types of cloud services: infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS). IaaS • Delivers computer infrastructure as a utility service, typically in a virtualized environment • Provides enormous potential for extensibility and scale PaaS • Delivers a platform or solution stack on a cloud infrastructure • Sits on top of the IaaS architecture and integrates with development and middleware capabilities as well as database, messaging, and queuing functions SaaS • Delivers applications over the Internet or intranet via a cloud infrastructure • Built on underlying IaaS and PaaS layers
  • 89. Cloud computing, which depends heavily on virtualization to realize operational savings and efficiencies, has elastic boundaries, and potentially pushes out the perimeter of the enterprise and security controls far beyond the data center. It’s important to recognize that the traditional border behind which data and platform are constrained and protected—typically physical separation and isolation—is no longer viable for dynamic cloud architecture models. It’s also important to understand that while a fill-the-gap approach may seemto work on a particular vulnerability, it may expose unknown vulnerabilities in other areas. Regardless of the cloud delivery model you choose, your best approach is to review the specific service architecture, and then layer technologies to develop a strong security net that protects data, applications and platform, and network at all levels. Step 2: Identify Vulnerabilities for Your Selected Service(s) 5 Security Guidance for Critical Areas of Focus in Cloud Computing, v2.1. Cloud Security Alliance (2009). https://cloudsecurityalliance.org/csaguide.pdf (PDF) https://cloudsecurityalliance.org/csaguide.pdf
  • 90. Intel IT Center Planning Guide | Cloud Security11 The Cloud Security Net—Build It from the Ground Up Because the model for your cloud services may be very different from other organizations—and indeed may evolve and change over time—Intel recommends that, in addition to security software solutions and application features, you should strengthen your security net by protecting data and platform at the most basic level—the system hardware. This best practice is built into Intel’s own private cloud infrastructure.6 The dynamic perimeter of cloud computing can expose edge systems to people and applications more than most other elements of the data center architectures—offering more opportunities for compromise. Attacks of server infrastructure at the deepest levels are an emerging area of risk and increasingly target the hypervisor, firmware, and BIOS. The attackers are professionals— more sophisticated, determined, and better resourced. The potential for harm from a single attack in either of these two areas can be devastating. The following illustration shows how protection at the hardware level can enable security deeper in the data center. Compute resources complement your perimeter controls, enable more advanced security and compliance capabilities in existing
  • 91. solutions, and provide needed protection even below the hypervisor—an area of emerging threat. Physical Layers at Risk in the Enterprise Data Center Traditional attack target Personal computing systems used to run software locally or on a cloud infrastructure (desktops, laptops, and other mobile devices). Growing attack target Departmental and other systems that interact inside and outside the organization (web servers, portal servers, e-mail servers, bridges, and routers). Emerging attack target Isolated back-end servers used for virtualization, database management, and storage. 6 An Enterprise Private Cloud Architecture and Implementation Roadmap. [email protected] (2010). intel.com/content/www/us/en/cloud-computing/cloud-
  • 92. computing-private-cloud- roadmap-paper.html (PDF) Client Systems Edge & Departmental Systems Back-End Systems http://www.intel.com/content/www/us/en/cloud- computing/cloud-computing-private-cloud-roadmap-paper.html http://www.intel.com/content/www/us/en/cloud- computing/cloud-computing-private-cloud-roadmap-paper.html Intel IT Center Planning Guide | Cloud Security12 Step 3: Four Things an IT Manager Can Do To Mitigate Security Vulnerabilities With protection at the hardware level, you can build trust and compliance into your data center. This means you can: • Provide the foundation for a more powerful layered security net of solutions and software features • Put more granular controls closer to where your data lives and critical platform services
  • 93. • Trust that the physical and virtual infrastructure provisioning your workloads is reliable • Trust where your servers are located • Control where the VMs are distributed • Complement your audit and compliance requirements (for the business unit tenants in your private cloud or as a tenant in a public cloud) • Protect confidential data and meet compliance requirements Intel IT is enabling new ways to provide the foundation for cloud controls that can secure data and workloads. We are adding new levels of visibility into what is running and who is running it so you can trust that the infrastructure is reliable and can support compliance. As Intel continues to move to the cloud, we are starting to increase the security level of our environment through greater understanding of what is running in the environment; what it should look like when it is “normal”—not compromised; strengthened data protection; and secure access. Intel recommends prioritizing your security investment through a risk assessment to determine the order and timing for building this level of trust and compliance into your data center in four areas.
  • 94. • Encrypt to protect data. • Establish a trusted foundation to secure the platform and the infrastructure. • Build higher assurance into auditing to strengthen compliance. • Establish and verify identities before you federate by controlling access to trusted clients from trusted systems. The remainder of this planning guide will look at how advanced server technologies—in particular, Intel® technologies—can help you build trust and compliance into your data center and set the foundation for cloud security. Intel IT Center Planning Guide | Cloud Security13 What Types of Data Should You Encrypt? Data in motion • Data in flight over networks (Internet, e- commerce, mobile devices, automated teller machines, and so on) • Data that uses protocols such as Secure Sockets Layer (SSL), Transport Layer Security (TLS), Internet Protocol Security (IPsec), Hypertext Transfer Protocol Secure (HTTPS), FTP, and Secure Shell (SSH) Data in process
  • 95. • Transactional data in real time,such as encrypted fields, records, rows, or column data in a database Data at rest • Files on computers, servers, and removable media • Data stored using full disk encryption (FDE) and application- level models Step 4: Protect Data— in Motion, in Process, and at Rest Encryption is an effective, well-established way to protect sensitive data because even if information is lost, it remains unusable. Encryption is critically important for protecting data covered by regulations and standards such as the Health Insurance Portability and Accountability Act (HIPAA), Sarbanes-Oxley (SOX), and Payment Card Industry (PCI). Increasingly, these and other regulations are encouraging—and specifying—encryption in certain usage scenarios. And the penalties for noncompliance are stiffer than ever. There are a number of ways to perform encryption, but typically it comes with a cost—what is often referred to as a performance tax. As an IT manager, you must to be able to justify the trade-off in performance with the requirement for secure data.
  • 96. Intel IT Center Planning Guide | Cloud Security14 Encrypt without the Performance Tax What if you didn’t have to make a performance trade-off? Intel Advanced Encryption Standard7 New Instructions (Intel AES-NI) is a set of seven new instructions in the Intel Xeon® processor 5600 series that eliminate the performance tax by speeding up parts of the AES algorithm encryption/decryption execution. It makes encryption practical, stronger, and more efficient for data in motion, in process, and at rest. Benefits of thesehardware-based instruction set extensions include the following: • Improvedperformance. Intel AES-NI can accelerate performance 3 to 10 times faster than a software-only AES solution. • Improved security. The new instructions help address recently discovered side-channel attacks on AES. Intel AES-NI instructions perform the decryption and encryption more completely at the hardware level without the need for software lookup tables that could be susceptible to snooping. Therefore using AES-NI can
  • 97. lower the risk of side-channel attacks. • Multiple usage scenarios. Intel AES-NI can be used in any application that uses AES, including network, disk, and file encryption solutions. 7 The Advanced Encryption Standard (AES) is a popular encryption standard first adopted by the U.S. government in 2001. It is generally displacingthe older, less secure Data Encryption Standard (DES) encryption algorithm and is now widely used to protect network traffic, personal data, and corporate IT infrastructures. Intel IT Center Planning Guide | Cloud Security15 Step 5: Secure Your Platform Rootkit attacks are increasing. They are difficult to detect with traditional antivirus products and use various methods to remain undetected. Rootkit attacks infect system components such as hypervisors and operating systems, and the malware can operate in the background and spread throughout a cloud environment, causing increasing damage over time. The best way to secure your platform is to enable a trusted foundation—starting with a root of trust at the platform level and
  • 98. extending the chain of trust through measured firmware, BIOS, and hypervisor virtualization layers. A root of trust hardens the platform against attack and is extremely difficult to defeat or subvert and substantially reduces the security risks of using a remote or virtualized infrastructure. It enables a more secure platform for adding tenants and workloads. Essentially you build protection into your hardware to protect your software. A root of trust helps ensure system integrity within each system. Integrity checking is considered a key capability for software, platform, and infrastructure security.8 Intel Trusted Execution Technology (Intel TXT) checks hypervisor integrity at start-up by measuring the code of the hypervisor and comparing it to a known good value. Launch is blocked if the measurements do not match. The root of trust enables a trusted foundation within your cloud environment so you can: • Specify trusted server pools. You can make decisions about how much to expose your data and workload based on whether a trusted pool is established. The most sensitive workloads should always use a trusted pool. • Prove host software is good. Although the chain of trust is a hardware-based mechanism, you can use the integrity-checking data with Governance, Risk Management, and Compliance
  • 99. (GRC) or security information and event manager (SIEM) dashboards for audit purposes. • Respond quickly to attack and minimize damage. Detect attacks more quickly, contain the spread of malware, and reduce the need to rebuild hypervisors if a compromise is detected. 8 Evolution of Integrity Checking with Intel® Trusted Execution Technology: An Intel Perspective. [email protected] (2010). intel.com/content/www/us/en/pc-security/intel-it- security- trusted-execution-technology-paper.html About Intel® TXT Intel® Trusted Execution Technology (Intel TXT) protects against malware, key stealth attacks, and other threats by: • Establishing a root of trust • Providing a launch environment signature to enable trusted software launch and execution • Providing the trust foundation so that policy engines can restrict or allow virtual machine (VM) and data migration based on platform security profiles • Providing the trust foundation to enable environment monitoring for auditing function tied to a root of trust • Enabling an IT manager to verify that the specific physical machine in the cloud is running the expected
  • 100. operating system or hypervisor http://www.intel.com/content/www/us/en/pc-security/intel-it- security-trusted-execution-technology-paper.html http://www.intel.com/content/www/us/en/pc-security/intel-it- security-trusted-execution-technology-paper.html Intel IT Center Planning Guide | Cloud Security16 About Intel® ECA 360 Intel® Expressway Cloud Access 360 (Intel ECA 360) provides secure access for enterprises connecting to and across cloud applications by: • Account deprovisioning and account identity data synchronization • Enforced context-aware authorization with seamless single sign-on (SSO) from multiple devices • Monitoring user, administrative, and API access activity • Soft/hard one-time password (OTP) authentication • Activity reporting for compliance and correlation of cloud user activity with on-premises logs for end-to-end compliance Step 6: Extend Trust across Federated Clouds As cloud computing evolves, the vision of federated clouds— across which communications, data, and services can move easily within
  • 101. and across several cloud infrastructures—adds another layer of complexity to your security equation. Intel is working toward providing solutions that extend trust across federated clouds via secure gateways between the service provider and the service consumer with policy enforcement for centrally defined policies. Intel Expressway Cloud Access 360 (Intel ECA 360) is a software solution designed to control the entire life cycle of secure access for enterprises connecting to cloud environments. It serves as a gateway to broker single sign-on (SSO) access from the enterprise into various clouds by authenticating employees against internal systems such as Active Directory* or other identity management systems. It records the user activity against these systems, and the metrics can be used for audit reporting and monitoring through an administrative console. In addition to providing SSO, Intel ECA 360 creates virtual identities built from data in enterprise systems— such as human resource applications and the telephone system—that establish user identity and verify the trusted systems where a user comes from. The gateway can operate as a virtualized instance and can run either on-premises or at a third-party hosted or managed service provider. The gateway can also function as a proxy, where it performs as a secure token service and point of policy enforcement, or in look-aside mode, where it passes on
  • 102. the identity logicto a third party to perform the transformations. Intel’s partnership with McAfee delivers a coordinated security approach that spans network, servers, databases, storage, and data, as well as connecting policies and controls across physical, virtual, and cloud infrastructures. The McAfee infrastructure proactively identifies and blocks attacks by communicating with McAfee* Global Threat Intelligence technology. The foundation of the McAfee security management platform, McAfee ePolicy Orchestrator*, is an open, scalable platform that connects third-party security solutions to the infrastructure, strengthening protection and providing visibility into security, compliance, and risk management activities. Intel IT Center Planning Guide | Cloud Security17 Step 7: Choose the Right Cloud Service Provider Choosing a cloud service provider is complicated on many levels—from the cloud delivery model and architecture to specific applications. Add to that the countless interdependencies and relationships, both technological and business-related, among vendors. To complicate matters, some companies offer not only software, but also hardware and services. Nevertheless, you
  • 103. must be vigilant about making sure the security you need to protect your data and platform are part of the offering. At the highest level, you need to know if the cloud provider can provide evidence of data and platform protections for the services they provide. Once you are comfortable that your criteria can be met, you can establish measurable, enforceable SLAs to provide ongoing verification. The following is a list9 of additional security considerations to think about when choosing a cloud service provider. 9 Adapted and expanded from How to Choose a Cloud Computing Vendor. Inc.com (November 29, 2010). inc.com/guides/2010/11/how-to-choose-a-cloud-computing- vendor.html Security Selection Criteria Considerations Data center risk management and security practices • What are the patch management policies and procedures? • How does technology architecture and infrastructure impact the cloud service provider’s ability to meet SLAs?
  • 104. Hardware-based security • Can the cloud service provider offer trusted pools for your most sensitive workloads? • Is encryption a software-only solution? Technology segmentation • How are systems, data, networks, management, provisioning, and personnel segmented? • Are the controls segregating each layer of the infrastructure properly integrated so they do not interfere with each other? For example, investigate whether the storage compartmentalization can easily be bypassed by management tools or poor key management. • What cloud access and identity protocols are used? Attack response and recovery • How are attacks monitored and documented? • How quickly can the cloud service provider respond? • What recovery methods are used? System availability and performance • How does the cloud service provider handle resource democratization and dynamism to best predict proper levels of system availability and performance through normal business fluctuations? • How does the cloud service provider measure performance? Vendor financial stability • Is the cloud service
  • 105. provider financially stable? • How long has the vendor been in business? What is their current financial standing? http://www.inc.com/guides/2010/11/how-to-choose-a-cloud- computing-vendor.html Intel IT Center Planning Guide | Cloud Security18 Security Selection Criteria Considerations Product long-term strategy • What is the vision for the service provider’scloud offering? • Does the cloud service provider have a product roadmap for their offering? Cloud service providers seeking to provide mission-critical services should embrace the ISO/IEC 27001 standard for information security management systems. If the provider has not achieved ISO/IEC 27001 certification, they should demonstrate alignment with ISO 27002 practices. Limits of responsibility • What is the limit of the cloud service provider’sresponsibility for security? • What security responsibilities are expected of the enterprise? • What is the legal accountability in a breach? Compliance capabilities • Does the cloud service provider have the ability to comply with
  • 106. regulatoryrequirements that you face? • Is the cloud service provider able to provide you with full visibility into compliance-related activities? • Can you perform your own audit? As you and other IT managers continue to explore options for moving workloads to the cloud, security considerations will continue to influence your buying decisions. As a result, cloud service providers are becoming more aware of the need for transparency into their security practices. Intel IT Center Planning Guide | Cloud Security19 Evolution of Integrity Checking with Intel® Trusted Execution Technology: An Intel Perspective In 2010, Intel began transitioning to a private cloud environment to improve efficiency and agility. The highly virtualized multitenant environment creates new security challenges, including those presented by emerging threats such as rootkit attacks. Intel evaluated Intel TXT as part of its analysis of technologies that can potentially address these issues. intel.com/content/www/us/en/pc-security/intel-it-security- trusted-execution-technology-paper.html Securing the Enterprise with Intel® AES-NI This white paper describes AES usage scenarios, performance implications, and the cryptographic
  • 107. libraries that ISVs can use to replace basicAES routines with the Intel AES-NI optimizations. intel.com/content/www/us/en/enterprise-security/enterprise- security-aes-ni-white-paper.html Intel® Advanced Encryption Standard Instructions (AES-NI) This article by Intel expert Jeffrey Rott is an in-depth look at using Intel AES-NI, with specific focus on the 2010 Intel Core™ processor family and its performance and security benefits. http://edc.intel.com/Link.aspx?id=5093 Taking Control of the Cloud for Your Enterprise: Addressing Security, Visibility, and Governance Challenges This white paper is for enterprise security architects and executives who need to quickly understand the risks of moving mission-critical data, systems, and applications to external cloud providers. The concept of a dynamic security perimeter is presented to help explain how to address insecure APIs, multitenancy, data protection, and tiered access control for the cloud. dynamicperimeter.com/download/Taking_Control_of_the_Cloud /?partnerref=intelsoaesite Take advantage of proven guidance for building and optimizing cloud infrastructure. Each reference architecture is based on real-world IT requirements and gives detailed instructions on how to install and configure a particular cloud solution using Intel Xeon processor–based servers and technologies.
  • 108. Intel® Cloud Builders Guide: Enhancing Server Platform Security with VMware intel.com/content/www/us/en/cloud-computing/cloud- computing-xeon-server-platform-security- vmware-guide.html Intel Technologies for Cloud Security Intel Cloud Builders Reference Architectures Intel Resources for Learning More http://www.intel.com/content/www/us/en/pc-security/intel-it- security-trusted-execution-technology-paper.html http://www.intel.com/content/www/us/en/pc-security/intel-it- security-trusted-execution-technology-paper.html http://www.intel.com/content/www/us/en/pc-security/intel-it- security-trusted-execution-technology-paper.html http://www.intel.com/content/www/us/en/enterprise- security/enterprise-security-aes-ni-white-paper.html http://www.intel.com/content/www/us/en/enterprise- security/enterprise-security-aes-ni-white-paper.html http://edc.intel.com/Link.aspx?id=5093 http://edc.intel.com/Link.aspx?id=5093 http://dynamicperimeter.com/download/Taking_Control_of_the_ Cloud/?partnerref=intelsoaesite http://dynamicperimeter.com/download/Taking_Control_of_the_ Cloud/?partnerref=intelsoaesite http://dynamicperimeter.com/download/Taking_Control_of_the_ Cloud/?partnerref=intelsoaesite http://www.intel.com/content/www/us/en/cloud- computing/cloud-computing-xeon-server-platform-security-