Download as PDF, PPTX
Uploaded byNTEN
The Cloud Beckons, But is it Safe?
This document discusses cloud security and provides guidance on evaluating cloud security options. It begins by introducing the concept of cloud computing and noting both the benefits of cloud services as well as common security concerns. It then discusses how cloud security compares to on-premise security, emphasizing that cloud services can potentially provide stronger security depending on the vendor and services selected. The document provides an overview of different cloud models and factors to consider when evaluating cloud security, such as the sensitivity of data, potential impacts of a security breach or outage, and what to look for in a cloud vendor's security practices and compliance certifications. It stresses the importance of understanding what you are protecting before selecting cloud services.
More Related Content
![HOW TO PREPARE FOR AND RESPOND TO A RANDSOMWARE ATTACK [Webinar]](https://cdn.slidesharecdn.com/ss_thumbnails/ransomwarewebinarfinalpresentation-160324145844-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to The Cloud Beckons, But is it Safe?
The Cloud Beckons, But is it Safe?
- 1. The Cloud Beckons,But is it Safe? April 2012
- 2. The Cloud Beckons, But is it Safe? #12NTCCSec Laura Quinn Michael Enos
- 3. Evaluate This Session! Eachentry is a chance to win an NTEN engraved iPad! or Online at www.nten.org/ntc/eval
- 4. Introductions Laura Quinn Executive Director Idealware Michael Enos Chief Technology Officer, Second Harvest Food Bank of Santa Clara and San Mateo Counties What are you hoping to get out of this session?
- 6. What is TheCloud?
- 7. The Lure ofthe Cloud Low cost of entry Easy remote access No complex infrastructure But what about security?
- 8. How Do YOUFeel About Cloud Security?
- 9.
- 10. Cloud Security inthe News
- 11. Under Siege To be on the Internet is to be vulnerable to attack. If you’re on the Internet, you’re in The Cloud
- 12. But We DoLots of Things on the Internet We shop online We bank online We post crazy things on Facebook Why is the cloud different? It’s not.
- 13. How Secure isYour On-Site Data? Do any of these sound familiar? • No one patches computers or is responsible for network security • You haven’t really thought about passwords or permissions • No disaster recovery plans • Staff hasn’t had any security training
- 14. Myth “We’re a tiny nonprofit. We’re safe because no one would target us for cyber attack.”
- 15. Fact Many data securitybreaches are crimes of opportunity. Organizations don’t always consider the sensitivity of their data until it’s exposed.
- 16. Myth “Our data is safer not in the cloud”
- 17. A Cloud DataCenter
- 18. Is This YourServer Closet?
- 19. What Does SecurityMean?
- 20. The Three Pillarsof Information Security
- 21. Confidentiality Information is available only to authorized parties.
- 22. Integrity Information isn’t modified inappropriately, and that you can track who made what change.
- 23. Availability Assurance that data is accessible when needed by authorized parties.
- 24. Also: Physical Possession Whoeverhas the data could, for instance, turn it over to the government
- 25. How Does ThisApply to the Cloud?
- 26. Cloud Security The useof the term “Cloud” is cloudy! Three general types of clouds: – Software-as-a-Service – Hosted Private Cloud – Co-located Private Cloud All three have different security models
- 27. Software as aService The vendor owns and manages all aspects of the environment. For instance:
- 28. Hosted Private Cloud Thevendor owns and manages the equipment only, but all software is managed by the client. The equipment is on the vendors network. For instance:
- 29. Co-located Private Cloud Thevendor provides the physical environment only in a data center, the client maintains the hardware and the software. For instance:
- 30. What Does SecurityMean For You?
- 31. Rules for AbsoluteSafety Turn off your Internet connection. Allow no one access to your data and systems. But let’s be realistic…
- 32. Know What You’reProtecting What kinds of data are you storing, and how sensitive are they? Think about its value on the open market.
- 33. Red Flags You need extremely tight security to store: • Donor’s credit card numbers. • Scanned images of checks. • Donor’s bank account information.
- 34. What’s Your Exposure? Considerthe impact of exposure of your confidential information, both in monetary terms and reputation.
- 35. What’s The Impactof an Outage? How much staff time could you lose from a short term or prolonged outage?
- 36. Testing Your On-SiteSecurity Have you recently performed a: • Check on whether your systems have been recently patched? • Systems penetration test ? • Employee training on security procedures? • Backup/recovery test? If not, you’d likely increase your security by moving to the cloud.
- 37.
- 38. Multi-Level Security isthe Ideal
- 39. Physical Security • Guardedfacilities • Protection of your hardware and devices • Power redundancy • Co-location (redundant facilities)
- 40. Network Security • Intrusion prevention • Intrusion detection • Firewalled systems • Network proactive anti-virus protection
- 41. Transmission Security Is dataencrypted in transit? Is the network secure?
- 42. Access Controls • Ensuringthe right people have access to the right data • Physical access to the server • Training on appropriate passwords and security measures
- 43. Data Protection • Dataencryption • Solid backup and restore policies • Ability to purge deleted data • Ability to prevent government entities from getting your data with a subpoena
- 44. What to LookFor in a Vendor
- 45. Description of SecurityMechanisms Documentation of all the facets of security, and the staff can talk about it intelligently. Proves information security is on the “front burner”
- 46. Uptime Do they provideany guarantee of uptime? Any historic uptime figures? Uptime figures are typically in 9s-- 99%, 99.9% or 99.99% Your connection to the internet may well be the weakest link.
- 47. Regulatory Compliance: HIPAA Doesthe vendor support organizations that need to be compliant with HIPAA (the Health Insurance Portability and Accountability Act)?
- 48. Regulatory Compliance: SAS70and SSAE16 Audit for security standards, hardware, and processes. Statement on Accounting Standards 70 (SAS70) Statement of Standards for Attestation Engagements 16 (SSAE16)
- 49. Regulatory Compliance: PCIDSS Compliance If you’re storing credit card numbers, your vendor needs to be compliant with PCI DSS (Payment Card Industry Payment Data Security Standard)
- 50.
- 51. Understand the Valueof Your Data What is it worth to you? To others? What measures are appropriate to protect it?
- 52. Your Data IsNo Safer Than You Make It Any computer attached to the internet is vulnerable unless you protect it. The cloud isn’t, in of itself, more or less secure
- 53. But Many VendorsMake Your Data Really Safe Choose vendors who show they’re serious about data protection (not all vendors are created equal). Consider a vendor’s regulatory compliance.
- 54.