The document discusses the challenges and opportunities in cloud security, emphasizing the need for governance, compliance, and integration across multiple services. It outlines the shared responsibility model and highlights the importance of upskilling in cloud management. Additionally, it presents a case study with various cloud service contracts and potential data breach risks.

1. www.cloudsec.com | #CLOUDSEC
Enabling Cloud Security
– It’s more than just ticking a box

2. #CLOUDSEC
Thecloudlandscape
Source: https://steveblank.files.wordpress.com/2011/02/bessemercloudscape.jpg

3. Side Activities at Venue
“Opportunities and Challenges”

4. #CLOUDSEC
Cloudopportunities Flexibility
On-demand
Services
Rapid
Deployment
AutomationScalability
Availability
Lower TCO

5. #CLOUDSEC
Cloudchallenges Talent &
Expertise
Security
Managing
Multiple
Services
Compliance
Cost
Management
Governance
and Control
Integration

6. “Why cloud hurts”

7. #CLOUDSEC
Theclassiccontracts Requirements
Evaluations
Selection
DeploymentAdoption
Optimisation
Renewal

8. #CLOUDSEC
Standalone services
SLA based services
model
Business workflow
integration
Legacy infrastructure
integration
Data protection and
management
Source: https://www.simple-talk.com/iwritefor/articlefiles/cloud/2011/11/cloud-service-model.png

9. #CLOUDSEC
CSA shared responsibility model

10. #CLOUDSEC
Organisational implications
• Clarity around scope and the primary motivation of moving to the cloud
• Changes to governance models and decision making
• Knowledge of cloud architecture, virtualization, multiple technology
platforms
• Challenge of standardised processes supporting seamless integration across
multiple systems
• Changing skillset from technology management to vendor management
• Upskilling on effective cloud-based systems management

11. #CLOUDSEC
http://cloudacademy.com/blog/wp-content/uploads/2014/07/CMS-in-VPC.jpg

12. #CLOUDSEC
Controls and Questions
295
Supporting
Questions
133
Control
Areas
16
Control
Domains
• Model for enabling active governance
• Enables cloud architecture discussions for business outputs
• Moves cloud decisions from audit assessment to a risk based outcomes

13. “A tale of three instances”

14. #CLOUDSEC
Three cloud projects
• IaaS contracts
• PaaS contracts
• SaaS Contracts
• Finance
• HR Services
• Collaboration
• CRM
• Business Intelligence
Global Bank Healthcare Provider Government Department
Complete Set
295
Questions133 Areas16 Domains
295
Questions
133 Areas
16 Domains
• IaaS contracts
• PaaS contracts
• SaaS Contracts
• Finance
• HR Services
• Collaboration
• Document Mgmt.
• CRM
• GovCloud
• SaaS Contracts
• Document Mgmt.
• Collaboration
• CRM

16. #CLOUDSEC
TheTwelve Data
Breaches
Access
Management
Account
Hijacking
System
Vulnerabilities
Insufficient
Due Diligence
Insecure
Interface
Malicious
Insider
Advanced
Persistent
Threat
Tech
Vulnerabilities
Data Loss
Services
Abuse
Denial of
Service

17. Puneet Kukreja
Partner, Cyber Advisory
Deloitte, Australia
@iPuneetKukreja