SlideShare a Scribd company logo
1 of 11
Download to read offline
Cloud Security Evolution
Jay Harrison
Technical Operations Site Reliability Engineering Manager, EMEA
My credentials
22 years in the industry, a decade in the cloud Technical
Operations & SRE at
● Okta - billion dollar cloud SaaS integrator
● Centrica Hive - IoT company - millions of devices
● EA Games, Playfish - social media games - over a
billion players
Previous talks on this topic at
● AWS London Summit 2018
● Computing Cloud & Infrastructure Summit 2017
● Cloud World Forum 2015
Who am I and why am I here
Leading independent provider of identity for the
enterprise
- 2017 & 2018 Leader, Gartner Magic Quadrant for Access
Management, Worldwide
● Built in the cloud, compatible with on-prem
● Over 6,000 pre-built applications and
infrastructure provider integrations
● Over 6,100 customers, including 21st Century
Fox, Experian, Adobe, Gatwick Airport,
Western Union.
● Hundreds of millions of users & billions of
authentications per month
Evolution of
Cloud Services
Amazon Web Services (AWS) in 2006
Google Cloud Platform (GCP) in 2008
Rackspace Cloud in 2009
Microsoft Azure & OpenStack in 2010
Oracle Cloud Infrastructure v2 in 2018
All started with compute and storage as MVP
All have iterated towards full IaaS, SaaS, PaaS vendors
Compliance is built in - SOC, PCI-DSS, FIPS, ISO, HIPAA
Public cloud services accrued $175.8 billion in revenue
in 2018
… we can be far more secure in the
cloud and achieve a higher level of
assurance at a much lower cost …
- John Brady, FINRA, 2017
Evolution of
Threats
Phone Phreaks & Script Kiddies
Organised Hacker groups
Virus & Malware distributors
Cyber Vandalism
Phishers & Social Engineers
Ransomware & Botnet collectives
Nation State Actors
Ever more sophisticated attacks
With threat actors now able to access data
owned by larger organisations through
smaller businesses within the chain, it’s no
longer enough for enterprises to
understand just their own security set up.
- Chris O’Brien, EclecticIQ, 2018
Distribution of Threats
Victims
● 10% financial industry
● 15% healthcare organisations
● 16% public sector entities
● 43% small business
Tactics
● 4% physical action
● 15% misuse by authorised users
● 21% caused by errors
● 28% malware
● 33% social attack component
● 52% hacking
Actors
● 34% involved internal actors
● 69% involved outsiders
● 23% identified as nation-state or state-affiliated
● 39% organised criminal groups
Commonalities
● 25% for strategic advantage gain (espionage)
● 29% use of stolen credentials
● 32% involved phishing
● 56% took months or longer to discover
● 71% financially motivated
Verizon 2019 Data Breach Investigations Report
Evolution of the
Responses
Dedicated roles
● DevSecOps
● Offensive/Defensive Engineers (Red/Blue Teams)
● Security Data Scientist
● Security and Compliance Analyst
● Security Automation
● Security Architect
● CSO/CISO
Dedicated products
● Security information and event management (SIEM)
● Intrusion Detection/Prevention
● Customer Identity and Access Management (CIAM)
● Penetration & DDOS protection
● Device Trust & Endpoint Protection
● External Audit & Compliance
More and more security frameworks and
regulations require a dedicated security
officer, and it is a best practice in all but the
smallest of organizations.
- Derek Boczenowski, Compass Compliance, 2018
Evolution of
Technology
Cloud vendors know their services & have
the closest integrations
Cloud Vendor Solutions
● AWS Guardduty
● Azure Sentinel
● GCP Cloud Security Scanner
Traditional tools & approaches rarely work
● Unable to cope with scale & pace of change
● Don’t account for new factors
Security as Code
● Automated Policy Governance
● Security configuration under source control
Enterprise Cloud Security is a
big-data problem
- Shannon Leitz, Intuit, 2015
Evolution of
Security Models
The network perimeter can no longer be the
only line of defence
Defence in Depth
● Physical Security
● Secure Hiring Practices
● Secure User Access with MFA
● Secure Local Environments
● Policy, Procedure & Awareness
● Defensive Programming
● Data Encryption at rest and on the wire
● Network Compartmentalisation
● Least Privilege for both users and software
● Vulnerability Management
● Secure OS
● Attack & Intrusion detection
● Monitoring & Alerting
Thanks to the rise of cloud services and
remote working … what matters now is how
people access their resources, no matter
where in the world they come from.
- Yassir Abousselham, Okta, 2018
Evolution of the
Perimeter
Zero trust approach
● People, workloads, and devices are just as
untrustworthy as network traffic
● 81% of data breaches involve stolen/weak
credentials
● 91% of phishing attacks target credentials
● 73% of passwords are duplicates
Authentication and Authorisation
● Pervasive
● Skeptical
● Adaptive
● Contextual
● Automated
● Centralised
Identity is the new perimeter
- John Hawley, CA Technologies, 2012
Security as a
Keystone
It’s not just the remit of Engineering,
CSO/CISO, HR or Building Security
Keys to success
● Detect and resolve issues quickly
● Use native security capabilities wherever possible
● Enlist and enable the entire organisation
● Educate progressively and in simple chunks
● Review policy, procedure and permissions regularly
Security is everyone’s problem
- Robert Reeves, Datical, 2016
Thank you
Questions?

More Related Content

Recently uploaded

WomenInAutomation2024: AI and Automation for eveyone
WomenInAutomation2024: AI and Automation for eveyoneWomenInAutomation2024: AI and Automation for eveyone
WomenInAutomation2024: AI and Automation for eveyoneUiPathCommunity
 
Tecnogravura, Cylinder Engraving for Rotogravure
Tecnogravura, Cylinder Engraving for RotogravureTecnogravura, Cylinder Engraving for Rotogravure
Tecnogravura, Cylinder Engraving for RotogravureAntonio de Llamas
 
Dynamical Context introduction word sensibility orientation
Dynamical Context introduction word sensibility orientationDynamical Context introduction word sensibility orientation
Dynamical Context introduction word sensibility orientationBuild Intuit
 
The Critical Role of Spatial Data in Today's Data Ecosystem
The Critical Role of Spatial Data in Today's Data EcosystemThe Critical Role of Spatial Data in Today's Data Ecosystem
The Critical Role of Spatial Data in Today's Data EcosystemSafe Software
 
Women in Automation 2024: Career session - explore career paths in automation
Women in Automation 2024: Career session - explore career paths in automationWomen in Automation 2024: Career session - explore career paths in automation
Women in Automation 2024: Career session - explore career paths in automationDianaGray10
 
React JS; all concepts. Contains React Features, JSX, functional & Class comp...
React JS; all concepts. Contains React Features, JSX, functional & Class comp...React JS; all concepts. Contains React Features, JSX, functional & Class comp...
React JS; all concepts. Contains React Features, JSX, functional & Class comp...Karmanjay Verma
 
A Glance At The Java Performance Toolbox
A Glance At The Java Performance ToolboxA Glance At The Java Performance Toolbox
A Glance At The Java Performance ToolboxAna-Maria Mihalceanu
 
Generative Artificial Intelligence: How generative AI works.pdf
Generative Artificial Intelligence: How generative AI works.pdfGenerative Artificial Intelligence: How generative AI works.pdf
Generative Artificial Intelligence: How generative AI works.pdfIngrid Airi González
 
Why Agile? - A handbook behind Agile Evolution
Why Agile? - A handbook behind Agile EvolutionWhy Agile? - A handbook behind Agile Evolution
Why Agile? - A handbook behind Agile EvolutionDEEPRAJ PATHAK
 
Landscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdfLandscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdfAarwolf Industries LLC
 
Transcript: Green paths: Learning from publishers’ sustainability journeys - ...
Transcript: Green paths: Learning from publishers’ sustainability journeys - ...Transcript: Green paths: Learning from publishers’ sustainability journeys - ...
Transcript: Green paths: Learning from publishers’ sustainability journeys - ...BookNet Canada
 
full stack practical assignment msc cs.pdf
full stack practical assignment msc cs.pdffull stack practical assignment msc cs.pdf
full stack practical assignment msc cs.pdfHulkTheDevil
 
THE STATE OF STARTUP ECOSYSTEM - INDIA x JAPAN 2023
THE STATE OF STARTUP ECOSYSTEM - INDIA x JAPAN 2023THE STATE OF STARTUP ECOSYSTEM - INDIA x JAPAN 2023
THE STATE OF STARTUP ECOSYSTEM - INDIA x JAPAN 2023Joshua Flannery
 
React Native vs Ionic - The Best Mobile App Framework
React Native vs Ionic - The Best Mobile App FrameworkReact Native vs Ionic - The Best Mobile App Framework
React Native vs Ionic - The Best Mobile App FrameworkPixlogix Infotech
 
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesMuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesManik S Magar
 
Efficiencies in RPA with UiPath and CyberArk Technologies - Session 2
Efficiencies in RPA with UiPath and CyberArk Technologies - Session 2Efficiencies in RPA with UiPath and CyberArk Technologies - Session 2
Efficiencies in RPA with UiPath and CyberArk Technologies - Session 2DianaGray10
 
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...BookNet Canada
 
All These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFAll These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFMichael Gough
 
Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024TopCSSGallery
 
A PowerPoint Presentation on Vikram Lander pptx
A PowerPoint Presentation on Vikram Lander pptxA PowerPoint Presentation on Vikram Lander pptx
A PowerPoint Presentation on Vikram Lander pptxatharvdev2010
 

Recently uploaded (20)

WomenInAutomation2024: AI and Automation for eveyone
WomenInAutomation2024: AI and Automation for eveyoneWomenInAutomation2024: AI and Automation for eveyone
WomenInAutomation2024: AI and Automation for eveyone
 
Tecnogravura, Cylinder Engraving for Rotogravure
Tecnogravura, Cylinder Engraving for RotogravureTecnogravura, Cylinder Engraving for Rotogravure
Tecnogravura, Cylinder Engraving for Rotogravure
 
Dynamical Context introduction word sensibility orientation
Dynamical Context introduction word sensibility orientationDynamical Context introduction word sensibility orientation
Dynamical Context introduction word sensibility orientation
 
The Critical Role of Spatial Data in Today's Data Ecosystem
The Critical Role of Spatial Data in Today's Data EcosystemThe Critical Role of Spatial Data in Today's Data Ecosystem
The Critical Role of Spatial Data in Today's Data Ecosystem
 
Women in Automation 2024: Career session - explore career paths in automation
Women in Automation 2024: Career session - explore career paths in automationWomen in Automation 2024: Career session - explore career paths in automation
Women in Automation 2024: Career session - explore career paths in automation
 
React JS; all concepts. Contains React Features, JSX, functional & Class comp...
React JS; all concepts. Contains React Features, JSX, functional & Class comp...React JS; all concepts. Contains React Features, JSX, functional & Class comp...
React JS; all concepts. Contains React Features, JSX, functional & Class comp...
 
A Glance At The Java Performance Toolbox
A Glance At The Java Performance ToolboxA Glance At The Java Performance Toolbox
A Glance At The Java Performance Toolbox
 
Generative Artificial Intelligence: How generative AI works.pdf
Generative Artificial Intelligence: How generative AI works.pdfGenerative Artificial Intelligence: How generative AI works.pdf
Generative Artificial Intelligence: How generative AI works.pdf
 
Why Agile? - A handbook behind Agile Evolution
Why Agile? - A handbook behind Agile EvolutionWhy Agile? - A handbook behind Agile Evolution
Why Agile? - A handbook behind Agile Evolution
 
Landscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdfLandscape Catalogue 2024 Australia-1.pdf
Landscape Catalogue 2024 Australia-1.pdf
 
Transcript: Green paths: Learning from publishers’ sustainability journeys - ...
Transcript: Green paths: Learning from publishers’ sustainability journeys - ...Transcript: Green paths: Learning from publishers’ sustainability journeys - ...
Transcript: Green paths: Learning from publishers’ sustainability journeys - ...
 
full stack practical assignment msc cs.pdf
full stack practical assignment msc cs.pdffull stack practical assignment msc cs.pdf
full stack practical assignment msc cs.pdf
 
THE STATE OF STARTUP ECOSYSTEM - INDIA x JAPAN 2023
THE STATE OF STARTUP ECOSYSTEM - INDIA x JAPAN 2023THE STATE OF STARTUP ECOSYSTEM - INDIA x JAPAN 2023
THE STATE OF STARTUP ECOSYSTEM - INDIA x JAPAN 2023
 
React Native vs Ionic - The Best Mobile App Framework
React Native vs Ionic - The Best Mobile App FrameworkReact Native vs Ionic - The Best Mobile App Framework
React Native vs Ionic - The Best Mobile App Framework
 
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesMuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
 
Efficiencies in RPA with UiPath and CyberArk Technologies - Session 2
Efficiencies in RPA with UiPath and CyberArk Technologies - Session 2Efficiencies in RPA with UiPath and CyberArk Technologies - Session 2
Efficiencies in RPA with UiPath and CyberArk Technologies - Session 2
 
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
Transcript: New from BookNet Canada for 2024: BNC SalesData and LibraryData -...
 
All These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFAll These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDF
 
Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024
 
A PowerPoint Presentation on Vikram Lander pptx
A PowerPoint Presentation on Vikram Lander pptxA PowerPoint Presentation on Vikram Lander pptx
A PowerPoint Presentation on Vikram Lander pptx
 

Cloud security evolution

  • 1. Cloud Security Evolution Jay Harrison Technical Operations Site Reliability Engineering Manager, EMEA
  • 2. My credentials 22 years in the industry, a decade in the cloud Technical Operations & SRE at ● Okta - billion dollar cloud SaaS integrator ● Centrica Hive - IoT company - millions of devices ● EA Games, Playfish - social media games - over a billion players Previous talks on this topic at ● AWS London Summit 2018 ● Computing Cloud & Infrastructure Summit 2017 ● Cloud World Forum 2015 Who am I and why am I here Leading independent provider of identity for the enterprise - 2017 & 2018 Leader, Gartner Magic Quadrant for Access Management, Worldwide ● Built in the cloud, compatible with on-prem ● Over 6,000 pre-built applications and infrastructure provider integrations ● Over 6,100 customers, including 21st Century Fox, Experian, Adobe, Gatwick Airport, Western Union. ● Hundreds of millions of users & billions of authentications per month
  • 3. Evolution of Cloud Services Amazon Web Services (AWS) in 2006 Google Cloud Platform (GCP) in 2008 Rackspace Cloud in 2009 Microsoft Azure & OpenStack in 2010 Oracle Cloud Infrastructure v2 in 2018 All started with compute and storage as MVP All have iterated towards full IaaS, SaaS, PaaS vendors Compliance is built in - SOC, PCI-DSS, FIPS, ISO, HIPAA Public cloud services accrued $175.8 billion in revenue in 2018 … we can be far more secure in the cloud and achieve a higher level of assurance at a much lower cost … - John Brady, FINRA, 2017
  • 4. Evolution of Threats Phone Phreaks & Script Kiddies Organised Hacker groups Virus & Malware distributors Cyber Vandalism Phishers & Social Engineers Ransomware & Botnet collectives Nation State Actors Ever more sophisticated attacks With threat actors now able to access data owned by larger organisations through smaller businesses within the chain, it’s no longer enough for enterprises to understand just their own security set up. - Chris O’Brien, EclecticIQ, 2018
  • 5. Distribution of Threats Victims ● 10% financial industry ● 15% healthcare organisations ● 16% public sector entities ● 43% small business Tactics ● 4% physical action ● 15% misuse by authorised users ● 21% caused by errors ● 28% malware ● 33% social attack component ● 52% hacking Actors ● 34% involved internal actors ● 69% involved outsiders ● 23% identified as nation-state or state-affiliated ● 39% organised criminal groups Commonalities ● 25% for strategic advantage gain (espionage) ● 29% use of stolen credentials ● 32% involved phishing ● 56% took months or longer to discover ● 71% financially motivated Verizon 2019 Data Breach Investigations Report
  • 6. Evolution of the Responses Dedicated roles ● DevSecOps ● Offensive/Defensive Engineers (Red/Blue Teams) ● Security Data Scientist ● Security and Compliance Analyst ● Security Automation ● Security Architect ● CSO/CISO Dedicated products ● Security information and event management (SIEM) ● Intrusion Detection/Prevention ● Customer Identity and Access Management (CIAM) ● Penetration & DDOS protection ● Device Trust & Endpoint Protection ● External Audit & Compliance More and more security frameworks and regulations require a dedicated security officer, and it is a best practice in all but the smallest of organizations. - Derek Boczenowski, Compass Compliance, 2018
  • 7. Evolution of Technology Cloud vendors know their services & have the closest integrations Cloud Vendor Solutions ● AWS Guardduty ● Azure Sentinel ● GCP Cloud Security Scanner Traditional tools & approaches rarely work ● Unable to cope with scale & pace of change ● Don’t account for new factors Security as Code ● Automated Policy Governance ● Security configuration under source control Enterprise Cloud Security is a big-data problem - Shannon Leitz, Intuit, 2015
  • 8. Evolution of Security Models The network perimeter can no longer be the only line of defence Defence in Depth ● Physical Security ● Secure Hiring Practices ● Secure User Access with MFA ● Secure Local Environments ● Policy, Procedure & Awareness ● Defensive Programming ● Data Encryption at rest and on the wire ● Network Compartmentalisation ● Least Privilege for both users and software ● Vulnerability Management ● Secure OS ● Attack & Intrusion detection ● Monitoring & Alerting Thanks to the rise of cloud services and remote working … what matters now is how people access their resources, no matter where in the world they come from. - Yassir Abousselham, Okta, 2018
  • 9. Evolution of the Perimeter Zero trust approach ● People, workloads, and devices are just as untrustworthy as network traffic ● 81% of data breaches involve stolen/weak credentials ● 91% of phishing attacks target credentials ● 73% of passwords are duplicates Authentication and Authorisation ● Pervasive ● Skeptical ● Adaptive ● Contextual ● Automated ● Centralised Identity is the new perimeter - John Hawley, CA Technologies, 2012
  • 10. Security as a Keystone It’s not just the remit of Engineering, CSO/CISO, HR or Building Security Keys to success ● Detect and resolve issues quickly ● Use native security capabilities wherever possible ● Enlist and enable the entire organisation ● Educate progressively and in simple chunks ● Review policy, procedure and permissions regularly Security is everyone’s problem - Robert Reeves, Datical, 2016