Download to read offline
Cloud security evolution
- 1. Cloud Security Evolution JayHarrison Technical Operations Site Reliability Engineering Manager, EMEA
- 2. My credentials 22 yearsin the industry, a decade in the cloud Technical Operations & SRE at ● Okta - billion dollar cloud SaaS integrator ● Centrica Hive - IoT company - millions of devices ● EA Games, Playfish - social media games - over a billion players Previous talks on this topic at ● AWS London Summit 2018 ● Computing Cloud & Infrastructure Summit 2017 ● Cloud World Forum 2015 Who am I and why am I here Leading independent provider of identity for the enterprise - 2017 & 2018 Leader, Gartner Magic Quadrant for Access Management, Worldwide ● Built in the cloud, compatible with on-prem ● Over 6,000 pre-built applications and infrastructure provider integrations ● Over 6,100 customers, including 21st Century Fox, Experian, Adobe, Gatwick Airport, Western Union. ● Hundreds of millions of users & billions of authentications per month
- 3. Evolution of Cloud Services AmazonWeb Services (AWS) in 2006 Google Cloud Platform (GCP) in 2008 Rackspace Cloud in 2009 Microsoft Azure & OpenStack in 2010 Oracle Cloud Infrastructure v2 in 2018 All started with compute and storage as MVP All have iterated towards full IaaS, SaaS, PaaS vendors Compliance is built in - SOC, PCI-DSS, FIPS, ISO, HIPAA Public cloud services accrued $175.8 billion in revenue in 2018 … we can be far more secure in the cloud and achieve a higher level of assurance at a much lower cost … - John Brady, FINRA, 2017
- 4. Evolution of Threats Phone Phreaks& Script Kiddies Organised Hacker groups Virus & Malware distributors Cyber Vandalism Phishers & Social Engineers Ransomware & Botnet collectives Nation State Actors Ever more sophisticated attacks With threat actors now able to access data owned by larger organisations through smaller businesses within the chain, it’s no longer enough for enterprises to understand just their own security set up. - Chris O’Brien, EclecticIQ, 2018
- 5. Distribution of Threats Victims ●10% financial industry ● 15% healthcare organisations ● 16% public sector entities ● 43% small business Tactics ● 4% physical action ● 15% misuse by authorised users ● 21% caused by errors ● 28% malware ● 33% social attack component ● 52% hacking Actors ● 34% involved internal actors ● 69% involved outsiders ● 23% identified as nation-state or state-affiliated ● 39% organised criminal groups Commonalities ● 25% for strategic advantage gain (espionage) ● 29% use of stolen credentials ● 32% involved phishing ● 56% took months or longer to discover ● 71% financially motivated Verizon 2019 Data Breach Investigations Report
- 6. Evolution of the Responses Dedicatedroles ● DevSecOps ● Offensive/Defensive Engineers (Red/Blue Teams) ● Security Data Scientist ● Security and Compliance Analyst ● Security Automation ● Security Architect ● CSO/CISO Dedicated products ● Security information and event management (SIEM) ● Intrusion Detection/Prevention ● Customer Identity and Access Management (CIAM) ● Penetration & DDOS protection ● Device Trust & Endpoint Protection ● External Audit & Compliance More and more security frameworks and regulations require a dedicated security officer, and it is a best practice in all but the smallest of organizations. - Derek Boczenowski, Compass Compliance, 2018
- 7. Evolution of Technology Cloud vendorsknow their services & have the closest integrations Cloud Vendor Solutions ● AWS Guardduty ● Azure Sentinel ● GCP Cloud Security Scanner Traditional tools & approaches rarely work ● Unable to cope with scale & pace of change ● Don’t account for new factors Security as Code ● Automated Policy Governance ● Security configuration under source control Enterprise Cloud Security is a big-data problem - Shannon Leitz, Intuit, 2015
- 8. Evolution of Security Models Thenetwork perimeter can no longer be the only line of defence Defence in Depth ● Physical Security ● Secure Hiring Practices ● Secure User Access with MFA ● Secure Local Environments ● Policy, Procedure & Awareness ● Defensive Programming ● Data Encryption at rest and on the wire ● Network Compartmentalisation ● Least Privilege for both users and software ● Vulnerability Management ● Secure OS ● Attack & Intrusion detection ● Monitoring & Alerting Thanks to the rise of cloud services and remote working … what matters now is how people access their resources, no matter where in the world they come from. - Yassir Abousselham, Okta, 2018
- 9. Evolution of the Perimeter Zerotrust approach ● People, workloads, and devices are just as untrustworthy as network traffic ● 81% of data breaches involve stolen/weak credentials ● 91% of phishing attacks target credentials ● 73% of passwords are duplicates Authentication and Authorisation ● Pervasive ● Skeptical ● Adaptive ● Contextual ● Automated ● Centralised Identity is the new perimeter - John Hawley, CA Technologies, 2012
- 10. Security as a Keystone It’snot just the remit of Engineering, CSO/CISO, HR or Building Security Keys to success ● Detect and resolve issues quickly ● Use native security capabilities wherever possible ● Enlist and enable the entire organisation ● Educate progressively and in simple chunks ● Review policy, procedure and permissions regularly Security is everyone’s problem - Robert Reeves, Datical, 2016
- 11.