More Related Content
Cloud Security Issues 1.04.10
- 1. Cloud Security andAudit Issues1Rapp Consulting peet.rapp@yahoo.com
- 2. Agenda Cloud Computing 101Reality CheckSecurity IssuesISACA Member ResponsibilitiesWhat’s Missing2Rapp Consulting peet.rapp@yahoo.com
- 3. Cloud Computing 101Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. - NIST Definition of Cloud Computing3Rapp Consulting peet.rapp@yahoo.com
- 4. Cloud Computing 101History - DefinitionsDistributedCentralizedDe-CentralizedRe-CentralizedApplicationsSystem PlatformHardware19702010Per Novell Cloud Presentation 09/094Rapp Consulting peet.rapp@yahoo.com
- 5. Cloud Computing 101History - Definitions5Rapp Consulting peet.rapp@yahoo.com
- 6. Basic Concepts –Cloud Enabling Technologies / FunctionsSOA - XML – APIHypervisorDynamic Partitioning API - Application Programming InterfaceServer OptimizationOS / Application / Data Server MigrationClient CPU/Memory Utilization Monitoring 6Rapp Consulting peet.rapp@yahoo.com
- 7. Basic Concepts –Enabling Technologies Dynamic Partitioning – the variable allocation of cpu processing and memory to multiple OS’s, applications, and data within one serverRapp Consulting peet.rapp@yahoo.com
- 8. Basic Concepts –Cloud Enabling Technologies / FunctionsSOA – XML -APIHypervisorDynamic Partitioning Load Balancing / Server OptimizationOS / Application / Data Server MigrationClient CPU/Memory Utilization Monitoring 8Rapp Consulting peet.rapp@yahoo.com
- 9. Cloud Computing 101History - Definitions9Rapp Consulting peet.rapp@yahoo.com
- 10. Cloud Computing 101ASPsvs SaaSASPs are traditional, single-tenant applications, hosted by a third party.SaaS applications are multi-tenant, user facing, web-based applications hosted by a vendor 10Rapp Consulting peet.rapp@yahoo.com
- 11. Cloud Computing 101History - Definitions11Rapp Consulting peet.rapp@yahoo.com
- 12. Cloud Computing 101PaaSADevelopment Environment (Platform) as a Service. Developer Tool Kits provided. “Pay as you develop/test” business modelRapid Propagation of Software Applications – Low Cost of Entry 12Rapp Consulting peet.rapp@yahoo.com
- 13. Cloud Computing 101IaaSThe“Bare Metal” Infrastructure as a Service Clients provide all OS, security andapplication softwareUsed for quick-implementation, as-needed data processing / data storage13Rapp Consulting peet.rapp@yahoo.com
- 14. Cloud Computing 101- Service Delivery ModelsSaaSSoftware as a ServicePaaSPlatform as a ServiceIaaSInfrastructure as a Service14Rapp Consulting peet.rapp@yahoo.com
- 15. Cloud Deployment ModelsPubliccloudSold to the public, mega-scale infrastructuresPrivate cloud Enterprise-owned or leased to a Single ClientCommunity cloudShared infrastructure for a Specific CommunityHybrid cloudComposition of two or more Cloud Models15Rapp Consulting peet.rapp@yahoo.com
- 16. Cloud Computing 10116Rapp Consulting peet.rapp@yahoo.com
- 17. Cloud Computing 10117Rapp Consulting peet.rapp@yahoo.com
- 18. Reality CheckThe CloudIs and Will HappenCurrent Major Players – IaaS, PaaSAmazon Web Services, ATT, IBM Rackspace, Terramark, SavvisCurrent Major Players - SaaSFaceBook, Salesforce.com, Google (Gmail), Netsuite18Rapp Consulting peet.rapp@yahoo.com
- 19. Reality Check19Rapp Consulting peet.rapp@yahoo.com
- 20. Reality Check20Rapp Consulting peet.rapp@yahoo.com
- 21. Reality Check Spending Forecasts21Rapp Consulting peet.rapp@yahoo.com
- 22. Claimed Cloud ComputingBusiness AdvantagesOptimizes Server UtilizationCost SavingsDynamic ScalabilityTime Savings for New ProgramsRight-sizes your enterpriseOutsources ITTransitions CAPEX to OPEX22Rapp Consulting peet.rapp@yahoo.com
- 23. Excellent Cloud ExamplesNASDAQ/ NYTSalesForce.comSigniantThinLaunch Software Intuit QuickBaseWebroot23Rapp Consulting peet.rapp@yahoo.com
- 24. A Disruptive TechnologyTheCloud Reshuffles the IT deckShrink Wrapped Application s and Enterprise-Sized will migrate to Online Apps, Possibly Open-Sourced OS will tend towards web-partial systemsDesktops and Notebooks Lose Hard DrivesBusinesses’ IT Staffing Requirements Will Drop 24Rapp Consulting peet.rapp@yahoo.com
- 25. Claimed Cloud ComputingBusiness Advantages25Rapp Consulting peet.rapp@yahoo.com
- 26. Current Press StatusTheMajority of Press Coverage supports Service Providers attempting to gain mindshare.Most IT Analysis is very positive about (hyping) the merits of the cloud.Very little is written of Cloud Security or its Audit- ability 26Rapp Consulting peet.rapp@yahoo.com
- 27. The Gartner HypeCurve27Rapp Consulting peet.rapp@yahoo.com
- 28. The Gartner HypeCurve28Rapp Consulting peet.rapp@yahoo.com
- 29. Company/Product Life Cycle:Key to Understanding OpportunitiesPhase IIRapid Market Growth Through Internal Expansion and AcquisitionPhase IVSustained Niche or“Last One Standing”Phase IIIMaturation &ConsolidationPhase IBusiness Start-up & Product RolloutBOutputACDTimeStart-up Capital > Labor/Facilities/Capital > Minimize Cost > Sustained MarketCritical Decisions Made in Phase IIIA: Attempt to go back to Phase II (new market expansion/product improvements)B: Consolidate with competition to grow share in a shrinking marketC: Go/stay private with niche operation and proceed to Phase IVD: Continue to enhance productivity to sustain margins (production improvements/cost takeouts)Moran, Stahl & Boyer29Rapp Consulting peet.rapp@yahoo.com
- 30. Current Press StatusTheMajority of Press Coverage supports Service Providers attempting to gain mindshare.Most IT Analysis is very positive about (hyping) the merits of the cloud.Very little is written of Cloud Security or its Audit- ability 30Rapp Consulting peet.rapp@yahoo.com
- 31. Reality CheckGreatest concernssurrounding cloud adoption at your company (per CIO)Security 45%31Rapp Consulting peet.rapp@yahoo.com
- 32. Security Issues “Cyber Crime in 2008 measured more to be a larger societal loss than illegal drugs.“The main objective of most attackers is to makemoney. The underground prices for stolen bank login accounts range from $10–$1000 (depending on theavailable amount of funds), $0.40–$20 for credit cardnumbers, $1–$8 for online auction site accounts and $4–$30 for email passwords.” Symantec Global Internet Security Threat Report – April 200932Rapp Consulting peet.rapp@yahoo.com
- 33. Security Issues “Cybersecurity risks pose some of the most serious economic and national security challengesof the 21st Century. The digital infrastructure’sarchitecture was driven more by considerations ofinteroperability and efficiency than of security.”White House Cyberspace Security Review May 200933Rapp Consulting peet.rapp@yahoo.com
- 34. Security Issues 34Rapp Consulting peet.rapp@yahoo.com
- 35. Reality CheckGreatest concernssurrounding cloud adoption at your company (per CIO)Security 45%Integration with existing systems 26%Loss of control over data 26%Availability concerns 25%Performance issues 24%IT governance issues 19%Regulatory/compliance concerns 19%35Rapp Consulting peet.rapp@yahoo.com
- 36. Cloud Security &Control Groups ENISACloud Security Alliance – CSAISACADMTFNISTJericho ForumApps.govOWASPRapp Consulting peet.rapp@yahoo.com36
- 37. Cloud Security AllianceMembersRapp Consulting peet.rapp@yahoo.com37
- 38. Cloud Security AllianceMembersRapp Consulting peet.rapp@yahoo.com38
- 39. Cloud Security Alliance39RappConsulting peet.rapp@yahoo.com
- 40. ISACA40Rapp Consulting peet.rapp@yahoo.com
- 41. ENISA41Rapp Consulting peet.rapp@yahoo.com
- 42. DMTF42Rapp Consulting peet.rapp@yahoo.com
- 43. DMTF43Rapp Consulting peet.rapp@yahoo.com
- 44. Security Issues Data LocationSaaS Clients’ data co-mingledForensics Possible?Penetration Detection & Multi-Client UAPublic Cloud-Server Owner – Due Diligence?Data Erasure?44Rapp Consulting peet.rapp@yahoo.com
- 45. Current RegulationsPCI ComplianceStates’PII requirementsSarbanes OxleyHIPAA45Rapp Consulting peet.rapp@yahoo.com
- 46. Current Regulations &Standards46Rapp Consulting peet.rapp@yahoo.com
- 47. ISACA Member Responsibilities – OpportunitiesGreatest concerns surrounding cloud adoption at your company (per CIO)Security 45%Integration with existing systems 26%Loss of control over data 26%Availability concerns 25%Performance issues 24%IT governance issues 19%Regulatory/compliance concerns 19%47Rapp Consulting peet.rapp@yahoo.com
- 48. ISACA Member Responsibilities – Opportunities48Rapp Consulting peet.rapp@yahoo.com
- 49. ISACA Member Responsibilities – OpportunitiesEnsure Organization’s Key Players Aware of Cloud Security IssuesAudit Data / Applications targeted for Cloud ComputingInput / Review Cloud Provider’s SLA AgreementStrengthen internal IAM ProgramRapp Consulting49Rapp Consulting peet.rapp@yahoo.com
- 50. ISACA Member Responsibilities – OpportunitiesEnsure Organization’s Key Players Aware of Cloud Security IssueTarget respected type “A”championsBusiness Application OwnersCorporate AttorneysCxOsHR50Rapp Consulting peet.rapp@yahoo.com
- 51. ISACA Member Responsibilities – OpportunitiesAudit Data/Applications targeted for Cloud ComputingData MappingWhat is the application data’s internal security level? Who are the Data Owners?What Type of Cloud (public, private, etc) is targeted? 51Rapp Consulting peet.rapp@yahoo.com
- 52. ISACA Member Responsibilities – OpportunitiesInput / Review Cloud Provider’s SLAOpen Sourced API’s, etcXACML-based IAM programSecurity Transparency Ownership of DataAudit at WillDR/BC policy and practiceReturn of application and data policy52Rapp Consulting peet.rapp@yahoo.com
- 53. ISACA Member Responsibilities – OpportunitiesEnsure Organization’s Key Players Aware of Cloud Security IssuesAudit Data / Applications targeted for Cloud ComputingInput / Review Cloud Provider’s SLA AgreementStrengthen internal IAM Program53Rapp Consulting peet.rapp@yahoo.com
- 54. ISACA Member Responsibilities – OpportunitiesStrengthen IAM Program54Rapp Consulting peet.rapp@yahoo.com
- 55. ISACA Member Responsibilities – OpportunitiesStrengthen Identity – Access Management ProgramXACML Based IAM programFederated User Access – integrated across both cloud and internal enterpriseAligned with compliance requirementsSSO – (Single Sign On) IAM Security Monitoring – ReportingOppty to implement risk-based provisioningRapp ConsultingRapp Consulting peet.rapp@yahoo.com
- 56. ISACA Member Responsibilities – OpportunitiesKEY TAKE-AWAY #1Cloud Computing should provide organizations sufficient- enough costs-savings to afford investments in required best – practice IS security measures.56Rapp Consulting peet.rapp@yahoo.com
- 57. ISACA Member Responsibilities – OpportunitiesKEY TAKE-AWAY #2Employ the same best-practice audit and risk management principles for cloud computing as you have been trained for and have used (or should be using) your entire career. 57Rapp Consulting peet.rapp@yahoo.com
- 58. ISACA Member Responsibilities – OpportunitiesKey Take Away #3Develop an Overarching Business ImpactAnalysis Moving an Application / Data to the cloud58Rapp Consulting peet.rapp@yahoo.com
- 59. ISACA Member Responsibilities – OpportunitiesCloud computing can be evaluated much in the same way as a new operating system. And yet, it's somethng more as well. It has the usual system services but also some fantastic ones -- unlimited memory, unlimited storage, unlimited network bandwidth, unlimited (and on-demand) scalability and parallelismhttp://www.ddj.com/web-development/220300736?pgno=459Rapp Consulting peet.rapp@yahoo.com
- 60. Claimed Cloud ComputingBusiness Advantages60Rapp Consulting peet.rapp@yahoo.com
- 61. ISACA Member Responsibilities – OpportunitiesThis fundamental difference between probabilistic riskand risk introduced by an intelligent adversary (or adaptive threats) leads to the conclusion that more understanding of the cyber security issues and impactsthat are possible on the electric grid is needed. Indeed,there really is no statistical norm for the behavior of cyber attackers and information systems and components failure, and their potential impacts to grid reliability. NERC - 2009 Long-Term Reliability Assessment61Rapp Consulting peet.rapp@yahoo.com
- 62. ISACA Member Responsibilities – OpportunitiesWhat are the pure goals of auditing?62Rapp Consulting peet.rapp@yahoo.com
- 63. ISACA Member Responsibilities – OpportunitiesWhat are the pure goals of auditing?Transparency and Accountability63Rapp Consulting peet.rapp@yahoo.com
- 64. ISACA Member Responsibilities – OpportunitiesCRM Cloud AppSuppliersInternal EnterpriseERP Cloud AppDistributionResellers64Rapp Consulting peet.rapp@yahoo.com
- 65. ISACA Member Responsibilities – OpportunitiesStock OptCRM Cloud AppHRSuppliersInternal EnterpriseERP Cloud AppCust ServiceDistributionResellersAdvrtz65Rapp Consulting peet.rapp@yahoo.com
- 66. ISACA Member Responsibilities – Opportunities66Rapp Consulting peet.rapp@yahoo.com
- 67. ISACA Member Responsibilities – OpportunitiesThere needs to be rock-solid security, and annual (or when changes occure) audit-to-certification standards developed for Cloud Service Providers (CSPs)67Rapp Consulting peet.rapp@yahoo.com
- 68. What’s NeededThe currentUS military “jeep” 68Rapp Consulting peet.rapp@yahoo.com
- 69. What’s NeededThe HUMVEE’s Replacement:The M-ATV69Rapp Consulting peet.rapp@yahoo.com
- 70. ISACA Member Responsibilities – OpportunitiesSummary –Audit CSP’s Security and DR/BC Policies
- 71. Is CSP promotingbest security practices?
- 72. Upgrade Current InternalIAM program
- 73. Insist on “SAS70”type audit from partners and outsource providers of their cloud enterprises70Rapp Consulting peet.rapp@yahoo.com
- 74. What’s Still NeededCommercialCloud Applications Security Standards.Training & Certification requirements for Individual Cloud Developers Cloud Service ProvidersCloud Security Tool Providers71Rapp Consulting peet.rapp@yahoo.com
- 75. What’s Still NeededBestPractice Standards for Internal Audits of Enterprises Employing Cloud Applications.Combination of the ENISA cloud risk assessment with the financial Shared Assessment programImplement an annual Know Your Client (KYC) type audit/certification for all clients and cloud services providers.72Rapp Consulting peet.rapp@yahoo.com
Editor's Notes
- #7 Extensible Markup Language – Service Oriented Architecture – The basic tools for web-based applications- XML is the basic language for specifying data or documents into web apps. -SOA describes the method of interconnecting various pre-designed applets or application building blocks into one contiguous programHypervisor - A software/hardware platform virtualization system that allows multiple operating systems to run on a host computer concurrently.Dynamic Partitioning - In a symmetric multiprocessing (SMP) system, the ability to reassign processors , memory and I/O to specific applications on the fly without shutting down the machine Application Programming Interface - is an interface in computer science that defines the ways by which an application program may request services from libraries and/or operating systems part of the Service Oriented Architecture
- #9Â Hypervisor - A software/hardware platform virtualization system that allows multiple operating systems to run on a host computer concurrently.Dynamic Partitioning - In a symmetric multiprocessing (SMP) system, the ability to reassign processors , memory and I/O to specific applications on the fly without shutting down the machine Application Programming Interface - is an interface in computer science that defines the ways by which an application program may request services from libraries and/or operating systems part of the Service Oriented Architecture
- #10 Cloud Computing and Cloud Service Providers (CSPs) are recognized as logical extensions of the Internet Service Providers (ISPs) ISP1.0 – ISPs provided internet access to individuals and organizations via dial up or dedicated lines early 1990’sISP2.0 – ISPs provided email, and connectivity to early clients’ web sight servers, primarily promotional information early-mid 1990’sISP3.0 – Cohosting – multiple clients’ webservers connected to broadband access at one facility late-mid1990’sISP 4.0 – the birth of ASPs. Dedicated instances of applications on dedicated servers for each customer. 2000ISP 5.0 ASPs evolved into SaaSs, which are applications based on IaaSs, which are based on PaaSs
- #11 ASP applications are traditional, single-tenant applications, but are hosted by a third party. They are client/server applications with HTML front ends added to allow remote access to the application. They do not make use of SOA-applets. Their user interface may be crude, often slow and upgrades are often no better than what an end user could provide for themselves.SaaS applications are multitenant applications that are hosted by a vendor with expertise in the applications and that have been designed as Net-native applications, employing SOA’ applets and are updated on an ongoing basis.
- #12 Cloud Computing and Cloud Service Providers (CSPs) are recognized as logical extensions of the Internet Service Providers (ISPs) ISP1.0 – ISPs provided internet access to individuals and organizations via dial up or dedicated lines early 1990’sISP2.0 – ISPs provided email, and connectivity to early clients’ web sight servers, primarily promotional information early-mid 1990’sISP3.0 – Cohosting – multiple clients’ webservers connected to broadband access at one facility late-mid1990’sISP 4.0 – the birth of ASPs. Dedicated instances of applications on dedicated servers for each customer. 2000ISP 5.0 ASPs evolved into SaaSs, which are applications based on IaaSs, which are based on PaaSs
- #13 PaaS is a variation of SaaS whereby the development environment is offered as a service. The developers use the building blocks (e.g., predefined blocks of code) of the vendor’s development environment to create their own applications.In a platform-as-a-service (PaaS) model, the vendor offers a development environment to application developers, who develop applications and offer those services through the provider’s platform. The provider typically develops toolkits and standards for development, and channels for distribution and payment. The provider typically receives a payment for providing the platform and the sales and distribution services. This enables rapid propagation of software applications, given the low cost of entry and the leveraging of established channels for customer acquisition.The benefits of PaaS lie in greatly increasing the number of people who can develop, maintain, and deploy web applications. In short, PaaS offers to democratize the development of web applications, allowing many developers a chance to enter the SW apps market.
- #15 In a platform-as-a-service (PaaS) model, the vendor offers a development environment toapplication developers, who develop applications and offer those services through theprovider’s platform. The provider typically develops toolkits and standards for development,and channels for distribution and payment. The provider typically receives a payment forproviding the platform and the sales and distribution services. This enables rapid propagationof software applications, given the low cost of entry and the leveraging of established channelsfor customer acquisition.
- #16Â A public cloud is hosted, operated, and managed by a third-party vendor from one or moredata centers. The service is offered to multiple customers (the cloud is offered to multipletenants) over a common infrastructurePrivate clouds differ from public clouds in that the network, computing, and storageinfrastructure associated with private clouds is dedicated to a single organization and is notshared with any other organizations (i.e., the cloud is dedicated to a single organizationaltenant). As such, a variety of private cloud patterns have emerged:
- #22 According to a May 2008 forecast by Merrill Lynch, the volume of the cloud computing marketopportunity will amount to $160 billion by 2011, including $95 billion in business andproductivity applications and $65 billion in online advertising.†According to a March 2009 forecast by Gartner, worldwide cloud services are on pace to surpass$56.3 billion in 2009, a 21.3% increase from 2008 revenues of $46.4 billion. The market isexpected to reach $150.1 billion in 2013.‡
- #24 In 2008-2009NASDQ and NYT made use of public cloud processing to digitize their entire printer history.Salesforce w/o question the most successful ASP, transitioned to SaaS to better optimize performance and cost savings.Signiant – takes informational data and configures it for delivery to various end-viewer outlets , ie TV, PCs, smart phones, PDA’s with the correct format, correct language dialogue, and targeted advertizing in near real time. They process data in huge bursts.ThinLaunch (partnered with CITRIX) directs users at signon to the determined web browser only – intranet based. Users are able only to view the desktop provided to them. MS Office, email, then applications assigned, and what ever websites assigned.Intuit is a internally hosted excel/access like application.Webroot is one of many web based email security providers
- #40 IAM – most current SaaS have fairly simplistic, non-granular access-privileges program, perhaps three levels (viewer only, user, & admin). Most Cloud offerings include lack of support for federation (single sign-on or SSO), integration with corporate directories, risk-based authentication, scalable identity services, and the extension of clients’ enterprise IAM practices to the CSPMicrosoft’s Azure support basic federation from Active Directory to Microsoft’s cloud services and facilitate user SSO from on-premises Active Directory to Microsoft’s cloud services. Although these cloud-based identity services are lowering the barriers to entry for SMBs, theyare deemed inadequate to meet most enterprise requirements such as custom reporting and compliance management.Encryption - Effectively managing data that is encrypted is extremely complex and troublesome due to the current inadequate capabilities of key management products. For SaaS customers this is within an application-administering-many clients concurrently. Encryption is possible for data in transit, for that at rest, but not during actual processing. Key management in an intra-organizational context is difficult enough; trying to do effective key management in the cloud is frankly beyond current capabilities and will require significant advances in both encryption and key management capabilities to be viable.Data Location – can be anywhere in the world – opens a Pandora’s box of conflicting national laws, regarding
- #41 IAM – most current SaaS have fairly simplistic, non-granular access-privileges program, perhaps three levels (viewer only, user, & admin). Most Cloud offerings include lack of support for federation (single sign-on or SSO), integration with corporate directories, risk-based authentication, scalable identity services, and the extension of clients’ enterprise IAM practices to the CSPMicrosoft’s Azure support basic federation from Active Directory to Microsoft’s cloud services and facilitate user SSO from on-premises Active Directory to Microsoft’s cloud services. Although these cloud-based identity services are lowering the barriers to entry for SMBs, theyare deemed inadequate to meet most enterprise requirements such as custom reporting and compliance management.Encryption - Effectively managing data that is encrypted is extremely complex and troublesome due to the current inadequate capabilities of key management products. For SaaS customers this is within an application-administering-many clients concurrently. Encryption is possible for data in transit, for that at rest, but not during actual processing. Key management in an intra-organizational context is difficult enough; trying to do effective key management in the cloud is frankly beyond current capabilities and will require significant advances in both encryption and key management capabilities to be viable.Data Location – can be anywhere in the world – opens a Pandora’s box of conflicting national laws, regarding
- #42 IAM – most current SaaS have fairly simplistic, non-granular access-privileges program, perhaps three levels (viewer only, user, & admin). Most Cloud offerings include lack of support for federation (single sign-on or SSO), integration with corporate directories, risk-based authentication, scalable identity services, and the extension of clients’ enterprise IAM practices to the CSPMicrosoft’s Azure support basic federation from Active Directory to Microsoft’s cloud services and facilitate user SSO from on-premises Active Directory to Microsoft’s cloud services. Although these cloud-based identity services are lowering the barriers to entry for SMBs, theyare deemed inadequate to meet most enterprise requirements such as custom reporting and compliance management.Encryption - Effectively managing data that is encrypted is extremely complex and troublesome due to the current inadequate capabilities of key management products. For SaaS customers this is within an application-administering-many clients concurrently. Encryption is possible for data in transit, for that at rest, but not during actual processing. Key management in an intra-organizational context is difficult enough; trying to do effective key management in the cloud is frankly beyond current capabilities and will require significant advances in both encryption and key management capabilities to be viable.Data Location – can be anywhere in the world – opens a Pandora’s box of conflicting national laws, regarding
- #43 IAM – most current SaaS have fairly simplistic, non-granular access-privileges program, perhaps three levels (viewer only, user, & admin). Most Cloud offerings include lack of support for federation (single sign-on or SSO), integration with corporate directories, risk-based authentication, scalable identity services, and the extension of clients’ enterprise IAM practices to the CSPMicrosoft’s Azure support basic federation from Active Directory to Microsoft’s cloud services and facilitate user SSO from on-premises Active Directory to Microsoft’s cloud services. Although these cloud-based identity services are lowering the barriers to entry for SMBs, theyare deemed inadequate to meet most enterprise requirements such as custom reporting and compliance management.Encryption - Effectively managing data that is encrypted is extremely complex and troublesome due to the current inadequate capabilities of key management products. For SaaS customers this is within an application-administering-many clients concurrently. Encryption is possible for data in transit, for that at rest, but not during actual processing. Key management in an intra-organizational context is difficult enough; trying to do effective key management in the cloud is frankly beyond current capabilities and will require significant advances in both encryption and key management capabilities to be viable.Data Location – can be anywhere in the world – opens a Pandora’s box of conflicting national laws, regarding
- #44 IAM – most current SaaS have fairly simplistic, non-granular access-privileges program, perhaps three levels (viewer only, user, & admin). Most Cloud offerings include lack of support for federation (single sign-on or SSO), integration with corporate directories, risk-based authentication, scalable identity services, and the extension of clients’ enterprise IAM practices to the CSPMicrosoft’s Azure support basic federation from Active Directory to Microsoft’s cloud services and facilitate user SSO from on-premises Active Directory to Microsoft’s cloud services. Although these cloud-based identity services are lowering the barriers to entry for SMBs, theyare deemed inadequate to meet most enterprise requirements such as custom reporting and compliance management.Encryption - Effectively managing data that is encrypted is extremely complex and troublesome due to the current inadequate capabilities of key management products. For SaaS customers this is within an application-administering-many clients concurrently. Encryption is possible for data in transit, for that at rest, but not during actual processing. Key management in an intra-organizational context is difficult enough; trying to do effective key management in the cloud is frankly beyond current capabilities and will require significant advances in both encryption and key management capabilities to be viable.Data Location – can be anywhere in the world – opens a Pandora’s box of conflicting national laws, regarding
- #45 IAM – most current SaaS have fairly simplistic, non-granular access-privileges program, perhaps three levels (viewer only, user, & admin). Most Cloud offerings include lack of support for federation (single sign-on or SSO), integration with corporate directories, risk-based authentication, scalable identity services, and the extension of clients’ enterprise IAM practices to the CSPMicrosoft’s Azure support basic federation from Active Directory to Microsoft’s cloud services and facilitate user SSO from on-premises Active Directory to Microsoft’s cloud services. Although these cloud-based identity services are lowering the barriers to entry for SMBs, theyare deemed inadequate to meet most enterprise requirements such as custom reporting and compliance management.Encryption - Effectively managing data that is encrypted is extremely complex and troublesome due to the current inadequate capabilities of key management products. For SaaS customers this is within an application-administering-many clients concurrently. Encryption is possible for data in transit, for that at rest, but not during actual processing. Key management in an intra-organizational context is difficult enough; trying to do effective key management in the cloud is frankly beyond current capabilities and will require significant advances in both encryption and key management capabilities to be viable.Data Location – can be anywhere in the world – opens a Pandora’s box of conflicting national laws, regarding
- #48 The cloud oppty is for us to undo the Rodney Dangerfield opinion enterprises typically afford us.The cloud offers ISACA members an unprecedented oppty to positively impact your employer organization. Typically most ISACA members I have met are not “A” type personas. Now you need to become one.We are and could be facing something similar to what our peers at Enron / Worldcom / Tyco were seeing in 2001. Initially the threat will not be from internal to the organization, but will be from a too rapid adoption of cloud technologies. However, if clouds become imbedded into your enterprise without adequate controls, then the internal threats are more likely than ever before. Which will likely then have external threats following.Now is the time to earn your organizational respect. From my research there are many currently-considered best practice IT controls just not in place with CSPs. This is the area and time where you can make a significant impact inot the success of cloud engagements.You can lead two goals – adequate security and audit-ability of the program as well as an avoidance in the use of proprietary tey technologies.chIAM – Research New Best of Breed IAM programs such as Symplified, Ping Identity, Conformity, and TriCipher. For large organizations, with much interdependencies in data /application access between disparate groups, evolve IAM towards the Federation model. Organizations need to implement robust fundamental technologies
- #49 The cloud oppty is for us to undo the Rodney Dangerfield opinion enterprises typically afford us.The cloud offers ISACA members an unprecedented oppty to positively impact your employer organization. Typically most ISACA members I have met are not “A” type personas. Now you need to become one.We are and could be facing something similar to what our peers at Enron / Worldcom / Tyco were seeing in 2001. Initially the threat will not be from internal to the organization, but will be from a too rapid adoption of cloud technologies. However, if clouds become imbedded into your enterprise without adequate controls, then the internal threats are more likely than ever before. Which will likely then have external threats following.Now is the time to earn your organizational respect. From my research there are many currently-considered best practice IT controls just not in place with CSPs. This is the area and time where you can make a significant impact inot the success of cloud engagements.You can lead two goals – adequate security and audit-ability of the program as well as an avoidance in the use of proprietary tey technologies.chIAM – Research New Best of Breed IAM programs such as Symplified, Ping Identity, Conformity, and TriCipher. For large organizations, with much interdependencies in data /application access between disparate groups, evolve IAM towards the Federation model. Organizations need to implement robust fundamental technologies
- #50 Key Players – If you or your manager is not a strong “A” type player, find one or several who are. You can assume the position of a knowledge / strategy resource for this new front person(s). Get them up to date on the cloud technologies and current limitations. Corporate lawyers (Liability issues 201CMR17.0, PCI, HIPIAA), CIOs/CFOs for SOX certification liability and Model Audit Rule, business application owners for data loss. Negative PR liability.Organizations need to implement robust fundamental technologies internally . Especially in the area of IAM. “All clouds are not created equal,” so enterprises need to have a strategy for employing risk-based IAM methods, including strong authentication, automated provisioning, deprovisioning, auditing, and monitoring to address risks that are specific to a CSP.
- #51 There are many A types, who enjoy learning new business technologies especially if it is perceived to be an aid in their career goals. Let them take ownership of this issue. You can be the behind-the-scenes information source advisory. Work with them from the get-go.Feed them information at a level they will understand, perhaps in WSJ-speak. The Cloud Security Alliance is a great source at this level. Bring in an outside Cloud Security authority.You will likely move to the clouds – in time. But attempt to develop a uniformly agreed-upon list of requirements between the company champion/players for the CSP before jumping on. Look to possible leverage the cloud to improve the internal enterprise. Look to require best practice security controls which are now just evolving ieexternalization of authentication and authorization components from applications (loosely coupled) as this can aid in the rapid adoption of cloud-based services including cloud identity services, policy-based authentication, centralized logging, and auditing (e.g., OpenSSO from Sun Microsystems and Microsoft’s Geneva claimsbased authentication framework can help externalize authentication).
- #52Â REVERT to BEST PRACTICE IT Audit PracticesThe first order of business is an internal audit of all the data and applications being considered for Cloud Computing. What data, with what internal security levels are being considered for the Cloud?What are the compliance implications?Who are the data owners?Will these data owners accept these new risks? All this needs to be documented
- #53 Try to find the CSP who will meet your company’s established Enterprise Security level. Do not lower your established security standards.Ask to review the CSPs written internal security policies. Are they current? Are they updated & reviewed annually. They should be tighter than yours. And once gaining a comprehension of the CSP’s agreed-to responsibilities, you will then come to understand the scope of IT system management and monitoring responsibilities that fall on you the customer’s shoulders, including access, change, configuration, patch, and vulnerability management.
- #54 Key Players – If you or your manager is not a strong “A” type player, find one or several who are. You can assume the position of a knowledge / strategy resource for this new front person(s). Get them up to date on the cloud technologies and current limitations. Corporate lawyers (Liability issues 201CMR17.0, PCI, HIPIAA), CIOs/CFOs for SOX certification liability and Model Audit Rule, business application owners for data loss. Negative PR liability.Organizations need to implement robust fundamental technologies internally . Especially in the area of IAM. “All clouds are not created equal,” so enterprises need to have a strategy for employing risk-based IAM methods, including strong authentication, automated provisioning, deprovisioning, auditing, and monitoring to address risks that are specific to a CSP.
- #55 Organizations need to implement robust fundamental technologies in the IAM space - Thru use of SAML, SPML and XACML, achieve Federated user access priviledges across multiple web based and internally hosted applications with SSOs.Most cloud services support at least dual roles (privileges): administrator and end user. It is a normal practice among CSPs to provision the administrator role with administrative privileges. These privileges allow administrators to provision and deprovision identities, basic attributeprofiles, and, in some cases, to set access control policies such as password strength and trusted networks from which connections are accepted.IAM (user access management) is a key control group for many compliance requirements (SOX, HIPIAA, PII etc). For both the customer and CSP, IAM integration considerations at the early stage of service design will help avoid costly retrofitsEnterprise IAM requirements include:• Provisioning of cloud service accounts to users, including administrators.• Provisioning of cloud services for service-to-service integration (e.g., private [internal]cloud integration with a public cloud).• SSO support for users based on federation standards (e.g., SAML supportSupport for internal- and regulatory-policy compliance requirements, includingsegregation of duties using RBAC, rules, or claims-based authentication methodology.RBAC features promote a least-privilege-based access model where a user is granted theright number of privileges required to perform the job. Claims-based methodology enablessome important privacy use cases because it allows for only the user’s entitlements, nother actual identity, to flow with messages, which allows for fine-grained authorizationwithout the requirement to actually embed the user’s identity into messages.• User activity monitoring, logging, and reporting dictated by internal policies andregulatory compliance, such as SOX, PCI, and HIPAA.You should strive for CSP to provide XACML-compliant entitlement management even if thishas not been implemented internally. In your own enterprise. XACML programs will be readily adopted.CSPs should communicate the account management policies including account lock-outs(after many login failures), account provisioning methods, and privilege accountmanagement roles.Enterprises need to have a strategy for employing risk-based IAM methodsincluding strong authentication, automated provisioning, deprovisioning, auditing, andmonitoring to address risks specific to a CSP.If IAM controls can only be provided by the CSP and they are determined to be inadequate for your determined risk and compliance requirements, then your applications and data containing this critical information has no business in the clouds.
- #56 Organizations need to implement robust fundamental technologies - Thru use of SAML, SPML and XACML, achieve Federated user access priviledges across multiple web based and internally hosted applications with SSOs.Most cloud services support at least dual roles (privileges): administrator and end user. It is a normal practice among CSPs to provision the administrator role with administrative privileges. These privileges allow administrators to provision and deprovision identities, basic attributeprofiles, and, in some cases, to set access control policies such as password strength and trusted networks from which connections are accepted.IAM (user access management) is a key control group for many compliance requirements (SOX, HIPIAA, PII etc). For both the customer and CSP, IAM integration considerations at the early stage of service design will help avoid costly retrofitsEnterprise IAM requirements include:• Provisioning of cloud service accounts to users, including administrators.• Provisioning of cloud services for service-to-service integration (e.g., private [internal]cloud integration with a public cloud).• SSO support for users based on federation standards (e.g., SAML supportSupport for internal- and regulatory-policy compliance requirements, includingsegregation of duties using RBAC, rules, or claims-based authentication methodology.RBAC features promote a least-privilege-based access model where a user is granted theright number of privileges required to perform the job. Claims-based methodology enablessome important privacy use cases because it allows for only the user’s entitlements, nother actual identity, to flow with messages, which allows for fine-grained authorizationwithout the requirement to actually embed the user’s identity into messages.• User activity monitoring, logging, and reporting dictated by internal policies andregulatory compliance, such as SOX, PCI, and HIPAA.You should strive for CSP to provide XACML-compliant entitlement management even if thishas not been implemented internally. In your own enterprise. XACML programs will be readily adopted.CSPs should communicate the account management policies including account lock-outs(after many login failures), account provisioning methods, and privilege accountmanagement roles.Enterprises need to have a strategy for employing risk-based IAM methodsincluding strong authentication, automated provisioning, deprovisioning, auditing, andmonitoring to address risks specific to a CSP.If IAM controls can only be provided by the CSP and they are determined to be inadequate for your determined risk and compliance requirements, then your applications and data containing this critical information has no business in the clouds.
- #59 Key Players – If you or your manager is not a strong “A” type player, find one or several who are. You can assume the position of a knowledge / strategy resource for this new front person(s). Get them up to date on the cloud technologies and current limitations. Corporate lawyers (Liability issues 201CMR17.0, PCI, HIPIAA), CIOs/CFOs for SOX certification liability and Model Audit Rule, business application owners for data loss. Negative PR liability.Organizations need to implement robust fundamental technologies internally . Especially in the area of IAM. “All clouds are not created equal,” so enterprises need to have a strategy for employing risk-based IAM methods, including strong authentication, automated provisioning, deprovisioning, auditing, and monitoring to address risks that are specific to a CSP.
- #60 Key Players – If you or your manager is not a strong “A” type player, find one or several who are. You can assume the position of a knowledge / strategy resource for this new front person(s). Get them up to date on the cloud technologies and current limitations. Corporate lawyers (Liability issues 201CMR17.0, PCI, HIPIAA), CIOs/CFOs for SOX certification liability and Model Audit Rule, business application owners for data loss. Negative PR liability.Organizations need to implement robust fundamental technologies internally . Especially in the area of IAM. “All clouds are not created equal,” so enterprises need to have a strategy for employing risk-based IAM methods, including strong authentication, automated provisioning, deprovisioning, auditing, and monitoring to address risks that are specific to a CSP.
- #62 Key Players – If you or your manager is not a strong “A” type player, find one or several who are. You can assume the position of a knowledge / strategy resource for this new front person(s). Get them up to date on the cloud technologies and current limitations. Corporate lawyers (Liability issues 201CMR17.0, PCI, HIPIAA), CIOs/CFOs for SOX certification liability and Model Audit Rule, business application owners for data loss. Negative PR liability.Organizations need to implement robust fundamental technologies internally . Especially in the area of IAM. “All clouds are not created equal,” so enterprises need to have a strategy for employing risk-based IAM methods, including strong authentication, automated provisioning, deprovisioning, auditing, and monitoring to address risks that are specific to a CSP.
- #65 Organizations need to implement robust fundamental technologies In summary – with an understanding of what applications and data are going to the clouds, what are the responsibilities of the CSP and what will be the home enterprise responsibilities, You will be able to develop a comprehensive risk / reward analysis –We are being promised to be saving X amt of dollars taking application A and the xxxxx data to the cloud.IT Security / Audit and the application business managers have determined a likely business impact analysis of Y amount of lillikely business loss, and increase of Z times what we currently except. To reduce the likelihood of this much risk, the cloud security committee has determined A amount to be needed for enhanced cloud security controls within the current enterprise, as well as additional service charges of B amount per processing unit charged.Customers of cloud services should note that a multitenant service delivery model is usually designed with a “one size fits a l” operating principle, which means CSPs typically offer a standard SLA for all customers. Thus, CSPs may not be amenable to providing custom SLAs ifthe standard SLA does not meet your service-level requirements. However, if you are a medium or large enterprise with a sizable budget, a custom SLA may still be feasible.
- #66 Organizations need to implement robust fundamental technologies In summary – with an understanding of what applications and data are going to the clouds, what are the responsibilities of the CSP and what will be the home enterprise responsibilities, You will be able to develop a comprehensive risk / reward analysis –We are being promised to be saving X amt of dollars taking application A and the xxxxx data to the cloud.IT Security / Audit and the application business managers have determined a likely business impact analysis of Y amount of lillikely business loss, and increase of Z times what we currently except. To reduce the likelihood of this much risk, the cloud security committee has determined A amount to be needed for enhanced cloud security controls within the current enterprise, as well as additional service charges of B amount per processing unit charged.Customers of cloud services should note that a multitenant service delivery model is usually designed with a “one size fits a l” operating principle, which means CSPs typically offer a standard SLA for all customers. Thus, CSPs may not be amenable to providing custom SLAs ifthe standard SLA does not meet your service-level requirements. However, if you are a medium or large enterprise with a sizable budget, a custom SLA may still be feasible.
- #67 Organizations need to implement robust fundamental technologies In summary – with an understanding of what applications and data are going to the clouds, what are the responsibilities of the CSP and what will be the home enterprise responsibilities, You will be able to develop a comprehensive risk / reward analysis –We are being promised to be saving X amt of dollars taking application A and the xxxxx data to the cloud.IT Security / Audit and the application business managers have determined a likely business impact analysis of Y amount of lillikely business loss, and increase of Z times what we currently except. To reduce the likelihood of this much risk, the cloud security committee has determined A amount to be needed for enhanced cloud security controls within the current enterprise, as well as additional service charges of B amount per processing unit charged.Customers of cloud services should note that a multitenant service delivery model is usually designed with a “one size fits a l” operating principle, which means CSPs typically offer a standard SLA for all customers. Thus, CSPs may not be amenable to providing custom SLAs ifthe standard SLA does not meet your service-level requirements. However, if you are a medium or large enterprise with a sizable budget, a custom SLA may still be feasible.
- #68 Organizations need to implement robust fundamental technologies In summary – with an understanding of what applications and data are going to the clouds, what are the responsibilities of the CSP and what will be the home enterprise responsibilities, You will be able to develop a comprehensive risk / reward analysis –We are being promised to be saving X amt of dollars taking application A and the xxxxx data to the cloud.IT Security / Audit and the application business managers have determined a likely business impact analysis of Y amount of lillikely business loss, and increase of Z times what we currently except. To reduce the likelihood of this much risk, the cloud security committee has determined A amount to be needed for enhanced cloud security controls within the current enterprise, as well as additional service charges of B amount per processing unit charged.Customers of cloud services should note that a multitenant service delivery model is usually designed with a “one size fits a l” operating principle, which means CSPs typically offer a standard SLA for all customers. Thus, CSPs may not be amenable to providing custom SLAs ifthe standard SLA does not meet your service-level requirements. However, if you are a medium or large enterprise with a sizable budget, a custom SLA may still be feasible.
- #71 Organizations need to implement robust fundamental technologies In summary – with an understanding of what applications and data are going to the clouds, what are the responsibilities of the CSP and what will be the home enterprise responsibilities, You will be able to develop a comprehensive risk / reward analysis –We are being promised to be saving X amt of dollars taking application A and the xxxxx data to the cloud.IT Security / Audit and the application business managers have determined a likely business impact analysis of Y amount of lillikely business loss, and increase of Z times what we currently except. To reduce the likelihood of this much risk, the cloud security committee has determined A amount to be needed for enhanced cloud security controls within the current enterprise, as well as additional service charges of B amount per processing unit charged.Customers of cloud services should note that a multitenant service delivery model is usually designed with a “one size fits a l” operating principle, which means CSPs typically offer a standard SLA for all customers. Thus, CSPs may not be amenable to providing custom SLAs ifthe standard SLA does not meet your service-level requirements. However, if you are a medium or large enterprise with a sizable budget, a custom SLA may still be feasible.