The document discusses the evolving landscape of cloud security and privacy, particularly from an enterprise perspective on risk and compliance. Key topics include infrastructure security, data security, identity and access management (IAM), and the need for improved audit and compliance frameworks in the context of cloud computing. It emphasizes that while cloud computing offers significant benefits such as cost and scalability, there are considerable challenges related to security responsibilities and data privacy that enterprises must navigate.

1. Cloud Security and Privacy:
An Enterprise Perspective on Risks and Compliance
Tim Mather
Subra Kumaraswamy, Sun
Shahed Latif, KPMG

2. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
What We Do Not Discuss
• Existing aspects of information security
which are not impacted by ‘cloud computing’
• Consumer aspects of cloud computing
2

3. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
What We Do Discuss
• Infrastructure Security
• Network-level
• Host-level
• Application-level
• Data Security
• Identity and Access Management (IAM)
• Privacy Considerations
• Audit & Compliance Considerations
• Security-as-a- [Cloud] Service (SaaS)
• Impact on the Role of Corporate IT
Where Risk Has Changed: ± 3

4. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Components of Information Security
Security Management Services
Management – ACL, hygiene, patching, VA, incident response
Identity services – AAA, federation, provisioning
Information Security – Data
Encryption (transit, rest, processing), lineage, provenance, remanence
Information Security – Infrastructure
Application-level
Host-level
Network-level
4

5. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Cloud Computing: Evolution
5

6. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Cloud Pyramid of Flexibility
6

7. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Infrastructure Security – currently
• Trust boundaries have moved
• Specifically, customers are unsure where those
trust boundaries have moved to
• Established model of network tiers or zones no
longer exists
• Domain model does not fully replicate previous
model
• No viable, scalable model for host-to-host trust
• Data labeling / tagging required at application-
level
• Data separation is logical not physical
7

8. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Infrastructure Security – going forward
• Need for greater transparency regarding
which party (CSP or customer) provides
which security capability
• Inter-relationships between systems,
services, and people needs to be addressed
by identity management
8

9. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Data Security – currently
• Provider’s data collection efforts and
monitoring of such (e.g., IPS, NBA)
• Use of encryption
• Point-to-multipoint data-in-transit an issue
• Data-at-rest possibly not encrypted
• Data being processed definitely not encrypted
• Key management is a significant issue
• Advocated alternative methods (e.g., obfuscation,
redaction, truncation) are nonsense
• Data lineage
• Data provenance
• Data remanence
9

10. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Data Security – going forward
Large-scale multi-entity key management
• Must scale past multi-enterprise to inter-cloud
• Not just hundreds of thousands of systems or even millions of
virtual machine images, but billions of files or objects
• Must not only handle key management lifecycle (per NIST
SP 800-57, Recommendation for Key Management), but also
• Key recovery
• Key archiving
• Key hierarchies / chaining for legal entities
• Fully homomorphic encryption
• Potentially huge boon to cloud computing
• Will increase need for better key management
10

11. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
IAM – currently
• Generally speaking, poor situation today:
• Federated identity widely not available
• Strong authentication available only through
delegation
• Provisioning of user access is proprietary to
provider
• User profiles are limited to “administrator” and
“user”
• Privilege management is coarse, not granular
11

12. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
IAM – going forward
• Emerging identity-as-a-service (IDaaS)
needs to evolve beyond authentication
• SAML, SPML and XACML (especially) need
to be more fully leveraged
• Increasing need for user-to-service and
service-to-service authentication and
authorization (OAuth)
12

13. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Privacy – currently
• Transborder data issues may be exacerbated
• Specifically, where are cloud computing activities
occurring?
• Data governance is weak
• Encryption is not pervasive
• Data remanence receives inadequate attention
• Cusps absolve themselves of privacy concerns:
‘We don’t look at your data’
13

14. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Privacy – going forward
• Privacy laws are inconsistent across
jurisdictions; need global standard
• Need specific requirements for auditing (e.g.,
AICPA/CICA Generally Accepted Privacy Principles
– GAPP)
14

15. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Audit & Compliance – currently
• Effectiveness of current audit frameworks
questionable (e.g., SAS 70 Type II)
• CSP users need to define:
• their control requirements
• understand their CSP’s internal control monitor-
ing processes
• analyze relevant external audit reports
• Issue is assurance of compliance
15

16. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Audit & Compliance – going forward
• Inter-cloud (i.e., cross-CSP) solutions will
demand unified compliance framework
• Volume, multi-tenancy of cloud computing,
demand that CSP compliance programs be
more real-time and have greater coverage
than most traditional compliance programs
16

17. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Security-as-a-Service – currently
• Some offerings mature
• E-mail filtering, archiving
• Web content filtering
• Some offerings still emerging
• (E-mail) eDiscovery
• Identity-as-a-Service (IDaaS)
• Encryption, key management
• Today’s security-as-a-service providers sell
to CSP customers, not CSPs
• None of today’s CSPs offer security-as-a-
service as integrated offering
17

18. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Security-as-a-Service – going forward
• Horizontal integration
• Pure play SaaS providers will broaden offerings
beyond e-mail + Web content filtering
• Vertical integration
• CSPs will offer SaaS as integrated offering
• IDaaS has to scale effectively for cloud
computing to truly take off
• Complexity of key management screams for
SaaS offering
18

19. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Impact on Role of Corporate IT – currently
• Governance issue as internal IT becomes
“consultants” and business analysts to
business units
• Delineation of responsibilities between
providers and customers much more
nebulous than between customers and
outsourcers, collocation facilities, or ASPs
• Cloud computing likely to involve much more
direct business unit interaction with CSPs
than with other providers previously
19

20. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Impact on Role of Corporate IT – going forward
• Relationship between business units and corporate
IT departments vis-à-vis CSPs will shift greater
power to business units from IT
• Number of functions performed today by corporate
IT departments will shift to CSPs, along with
corresponding job positions
• Functions performed by corporate IT departments
will shift from those who do (i.e., practitioners who
build or operate) to those who define and manage
• IT itself will become more of a commodity as
practices and skills are standardized and
automated
20

21. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Conclusions
• Part of customers’ infrastructure security
moves beyond their control
• Provider’s infrastructure security may
(enterprise) or may not (SMB) be less robust
than customers’ expectations
• Data security becomes significantly more
important – yet provider capabilities are
inadequate (except for simple storage which
can be encrypted, and processing of non-
sensitive (unregulated and unclassified) data
21

22. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Conclusions (continued)
• IAM is less than adequate for enterprises –
weak authentication unless delegated back
to customers or federated, weak authoriza-
tion, proprietary provisioning
• Because of above, expect significant
business unit pressure to desensitize or
anonymize data; expect this to become a
chokepoint
• No established standards for obfuscation,
redaction, or truncation
22

23. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
What’s Good about the Cloud?
• A lot! Both for enterprises and SMBs – for
handling of non-sensitive (unregulated and
unclassified) data
• Cost
• Flexibility
• Scalability
• Speed
23

24. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Developments to Watch
• VMware’s vCloud API − submitted to DMTF
• Amazon’s Virtual Private Cloud − hybrid
cloud that extends private cloud through
“cloud bursting”
• Security-as-a-Service offered by CSPs (e.g.,
Amazon’s Multi-Factor Authentication)
• Cloud Security Alliance v2 white paper
• Slow transparency and assurance from CSP
(e.g., ISO 27002-based assurance)
• IT governance framework that blends ITIL,
ISO 27002, CObIT 24

25. © 2009 Tim Mather, Subra Kumaraswamy, Shahed Latif
Cloud Security and Privacy:
An Enterprise Perspective on Risks and Compliance
Continue the discussion on-line at: cloudsecurityandprivacy.com
25