Compliance & Privacy in the Cloud

There Is No Spoon:
Compliance & Privacy in
the Cloud
Michael Dahn
MSIA, CISSP

Friday, November 20, 2009

Which Cloud do you mean?

Compliance
Cloud

Technical
Cloud


Compliance Cloud


Compliance Cloud

CA, MA, MN, FL, ...

Technical Cloud

• SPI Model: Software,
Platform, Infrastructure

✓*aaS (Something* as
a Service)


What is Compliance?


Compliance vs Validation

• Compliance is a state of being, like auto
insurance you need to have it continuously

• Validation is
proof of compliance
you do annually


Compliance vs Security


“The Payment Card Industry (PCI)
Data Security Standard (DSS) was
developed to encourage and enhance
cardholder data security and facilitate
the broad adoption of consistent data
security measures globally.”


developed to encourage and enhance Myth 4 - PCI Will Make Us Secure
cardholder data security and facilitate Successful completion of a system
scan or assessment for PCI is but a
snapshot in time. Security exploits are
non-stop and get stronger every day,
which is why PCI compliance efforts
must be a continuous process of
assessment and remediation to ensure
safety of cardholder data.


developed to encourage and enhance Myth 4 - PCI Will Make Us Secure
cardholder data security and facilitate Successful completion of a system
scan or assessment for PCI is but a
snapshot in time. Security exploits are
non-stop and get stronger every day,
which is why PCI compliance efforts
must be a continuous process of
assessment and remediation to ensure
safety of cardholder data.

Compliant
until you're
compromised...


the “Singularity”



• “When falls the Coliseum, Rome shall fall;
And when Rome falls--the World”
- Lord Byron



• “When falls the Coliseum, Rome shall fall;
And when Rome falls--the World”
- Lord Byron
• If someone dies wearing a seat belt, does
that make them useless?


Risk & Transference

• #1 Question everyone has: Liability?
• “You can outsource the work, but you
cannot outsource the responsibility”
• Cloud-sourcing does not transfer risk


There is No Spoon


There is No Spoon

• Can any ﬁrewall be used to segment a
network?


There is No Spoon

network?

✓No! Only a properly conﬁgured ﬁrewall


There is No Spoon

network?

• Can any Cloud be used and achieve
compliance?


There is No Spoon

network?

compliance?

✓Maybe... if considerations are made


There is No Spoon

network?

compliance?

✓Maybe... if considerations are made
• Think beyond technology, checklists, and
compliance. Think Risk.


Problem List


Problems: PCI DSS


Problems: PCI DSS

• Requirement 2.2.1: when creating baseline
conﬁguration standards “only one primary
function per server”


Problems: PCI DSS


✓Virtualization?


Problems: PCI DSS


✓Virtualization?
✓Cloud?


Problems: PCI DSS


✓Virtualization?
✓Cloud?
✓WAF in the cloud?


Problems: PCI DSS


✓Virtualization?
✓Cloud?
✓WAF in the cloud?
• Requirement 11.2 - ASV Scans

Problems: Service Level Agreement

• Uptime/Availability? Yes’ish
• Security? No.
• Compliance? No.
• Assurance of data integrity? No.


Problems: Image Sprawl
12% month-over-month
growth of Amazon
Machine Images (AMI)
in 2008


growth of Amazon
in 2008

• First rule of ﬁght club? Find your data!


growth of Amazon
in 2008

• Second rule of ﬁght club? Find your data
(no really)!


growth of Amazon
in 2008

(no really)!
• Always “ask twice” - how it works? fails?


growth of Amazon
in 2008

(no really)!
• Always “ask twice” - how it works? fails?
• Now assume everything moves


Problems: Audit Logging



• Goals:
✓Alert on suspicious activity? Yes
✓Facilitate a forensic investigation? Maybe



• Goals:
• Are the logs backed up?



• Goals:
• Are the logs backed up?
• Are they accessible 12-18 months later?
✓What if the server is no longer there?


Problems: Forensic Issues

• During peak retail months systems are
scaled up and then down
• Fraud patterns have lead time of 12-18 mo.
• How do you forensically examine a ‘ghost’
server?


Problems: Third-Party Access

Who has
Remote admin
on my server?
• People you give data to
• People you give access to
data
• People who have access to
your data


Problems: Third-Party Access

Who has
Remote admin
on my server?
• People you give data to
• People you give access to
data
• People who have access to
your data
Maintain a written agreement that
includes an acknowledgement that the
... monitor service providers!
service providers are responsible for
PCI DSS compliance status.
the security of cardholder data the
service providers possess.


Problems: Data Destruction

• Where do the following go?
✓Failed hard drive
✓Deleted VM
Who owns the data? You or your cloud?


Problems: Backup?

• Who is backing up?
• How is it backed up?
• Where do the backups go?
✓Offsite to a third-party? New scope/
contract


Conclusion

• Cloud Compliance is possible but not
probable .. until the services evolve
• Cloud gives you scalability, but not
security .. unless you bake it in


Thank You

• Questions?

• Contact Mike Dahn?


Compliance & Privacy in the Cloud

Recommended

Recommended

More Related Content

Similar to Compliance & Privacy in the Cloud

Similar to Compliance & Privacy in the Cloud (20)

Recently uploaded

Recently uploaded (20)

Compliance & Privacy in the Cloud