Cloud computing provides opportunities for operational efficiency and scalability but also poses security risks. Key security concerns include weak trust boundaries as data is shared, lack of transparency around data collection and monitoring, and inadequate identity and access management. Privacy is also a concern as data moves outside an organization's control and across legal jurisdictions with inconsistent privacy laws. Customers should ask cloud providers detailed questions about their security certifications, data protection practices, key management, and control monitoring to understand how provider addresses these risks.

1. Cloud Computing
Security – The BIG Data
Vasanth Ganesan
MS Telecommunications & Business
University of Maryland, College Park

2. What is Cloud Computing?
Its all about
“Sharing”

3. Like with anything new, the
primary concern is security
RISKS are ALWAYS there!

4. Low
Cloud Security Concerns
High
SaaS
PaaS
IaaS
The Stack
Operational Efficiency
Low
High

5. Security Risks
&
Potential Opportunities

6. What are your main concerns in your
approach to Cloud Computing?
Source: ENISA – An SME Perspective on Cloud, 2009

7. Security
Snap
Copy
Mount
Yesterday Today

8. In Brief – “Data”
• Trust Boundary
• Data Security
• Identity and Access Management (IAM)
• Privacy Considerations
Information Assurance Concerns
CSA Security Guidance v2.1

9. Trust Boundary
• Trust Boundaries have changed with cloud
computing
• Note: Different cloud providers might have
different trust boundaries
• Data barriers
• Need for transparency
Governance
Enterprise Risk Management
Compliance and Audit
Source: Cloud Security and Privacy – Tim Mather

10. Data Security
• Provider’s data collection efforts and monitoring
of such
• Use of encryption
– Data in Transit
– Data at Rest
– Key management is a significant issue
• Data lineage
• Data provenance
• Data remanence Information Lifecycle Management
Encryption and Key Management
Compliance and Audit
Source: Cloud Security and Privacy – Tim Mather

11. Identity and Access Management
• One of the biggest challenges today
• Currently inadequate for Enterprises
• Access Control tool
Identity and Access Management
Traditional security
Compliance and Audit
Source: Cloud Security and Privacy – Tim Mather

12. Privacy Considerations
• Data is no longer static
• Transborder data issues may be exacerbated
– Privacy laws (inconsistent among different
jurisdictions)
• Data governance is weak
– Encryption is not pervasive
– Cloud Providers absolve themselves
– Data remanence still is a “?” Information Lifecycle Management
Traditional security
Compliance and Audit
Source: Cloud Security and Privacy – Tim Mather

13. Then why the Cloud?
Lowers Time to
TCO Market
Focus on
Core Scalability
Business
Flexibility

14. Potential Questions from the Clients
• Does the provider hold certifications such as ISO 27001/2, SAS 70? If
yes, what is the scope of the certifications?
• Does the provider share with the physical location of the servers?
• To what extent are storage, memory and other data traces erased from
the machines before being reallocated to a different customer? i.e. Data
remanence
• Does the provider support the data classification scheme used?
• How does the provider guarantee isolation of resources from other
customers?
• Learn from the Cloud service provider (CSP) about key management. Who
handles and manages the key?
• How does the CSP report on its security management?
• Does the CSP have an analytics tool to monitor your cloud?
• What are the CSP’s control monitoring processes?
• Is your data bound by local jurisdiction?