![Topics ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Securing The Cloud
Similar to Securing The Cloud (20)
More from george.james
More from george.james (20)
Recently uploaded
Recently uploaded (20)
Securing The Cloud
- 1. Securing the Cloud (Don’t get lost in the fog) Chris Munt M/Gateway Developments Ltd
- 4. Assessing risk What risks are you exposed to?
- 6. Assessing risk Indentify weaknesses
- 7. Assessing risk Can technology help?
- 8. Assessing risk Source: XKCD web comic: http://xkcd.com/
- 9. Assessing risk Lost in the fog of fanciful terms used to describe technology?
- 10. Assessing risk Cyberspace Virtualization Cloud computing Private Cloud Public Cloud Hybrid Cloud Cloudware IaaS, PaaS, SaaS
- 12. Real databases
- 13. Real networks Who’s watching you?
- 14. Assessing risk What about human factors?
- 15. Assessing risk
- 16. Assessing risk
- 17. Assessing risk “ You must change your password every few weeks and it must be constructed from no less than twelve characters which will include a mixture of upper and lower case letters, digits and punctuation characters”
- 18. Assessing risk Security versus Convenience?
- 19. Assessing risk
- 20. Assessing risk Why would anyone want to break your security?
- 21. Assessing risk
- 22. Assessing risk What’s your data worth to you? What’s it worth to someone else?
- 23. Assessing risk Lindisfarne Castle, Holy Island ~1797 by Thomas Girtin (1775–1802)
- 28. Suggest questions to be directed at service provider
- 31. Who administers the systems?
- 32. Governance
- 34. Do you store sensitive information about others?
- 35. Is the supplier subject to external audit in the same way as conventional suppliers of outsourcing solutions?
- 37. Can the Cloud provider sign up to local privacy requirements on behalf of their customers?
- 41. How long will a full recovery take?
- 44. To what extent do you have to account for illegal activity involving your application and/or data?
- 46. What happens if the supplier is taken over by another company?
- 47. How would you get your data back (and port it to another platform) if you needed to?
- 48. Technical view
- 52. More than 6 million transactions per year
- 53. Systems designed by credit card companies
- 54. Annual on-site security audit
- 58. Quarterly system perimeter scans
- 64. Quarterly scans
- 67. PCI Compliance in the Cloud Source: http://cloudsecurity.org
- 70. Perception of risk is as important as actual risk
- 72. ‘ Root index’ stored outside the cloud
- 73. Data in the cloud cannot be related to a particular individual without the ‘root index’.
- 74. Cloud Computing: Securing confidential information PATIENT Patient_ID Name Birth_Date Address ADMISSION Patient_ID Admission_Date Ward Consultant TEST Test_Date Specimen_ID Patient_ID Specimen_Type TEST_RESULT Test_Date Specimen_ID Test_ID Result
- 79. Use customized error pages
- 81. Client credentials passed to server in the clear
- 83. Some compatibility issues with browsers
- 91. Code can be viewed by the client
- 92. Protect against users modifying URLs used in Ajax calls
- 95. Charged by usage
- 97. Be particularly careful with JavaScript
- 98. Keys should only be visible to a ‘proxy layer’ mediating between client and server