This document summarizes the work of the Cloud Security Alliance (CSA), a global non-profit organization focused on promoting best practices for security in cloud computing. The CSA has over 10,000 individual members from various industries and expertise areas working on cloud security issues. Some of the CSA's key initiatives include developing a Cloud Controls Matrix to help organizations assess security risks in cloud environments, as well as research projects on cloud metrics and the Consensus Assessments Initiative. The document outlines the top threats to cloud computing such as data leakage, malicious insiders, and insecure APIs. It also provides highlights from the CSA's guidance on best practices for governance and operating in the cloud.

1. Cloud Security Alliance: Assuring the future of Cloud ComputingSergio Loureiro, CSA founding membersergio@secludit.comIBM La Gaude, 23rd June 2010

2. About the Cloud Security AllianceGlobal, not-for-profit organizationInclusive membership, supporting broad spectrum of subject matter expertise: cloud experts, security, legal, compliance, virtualization, and on and on…We believe Cloud Computing has a robust future, we want to make it better“To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.”

3. Membership50+ Corporate Members12 non-profit affiliations10,000 individual members growing by 300/weekBroad Geographical DistributionWorking Group activities performed through individual membership class

4. Corporate Members

5. S-P-I FrameworkYou “RFP”security inSaaSSoftware as a ServiceYou buildsecurity inPaaSPlatform as a ServiceIaaSInfrastructure as a Service

6. Top Threats to Cloud Computing

7. Shared Technology Vulnerabilities

8. Data Loss / Data Leakage

9. Malicious Insiders

10. Interception or Hijacking of Traffic

11. Insecure APIs

12. Nefarious Use of Service

13. Unknown Risk Profile

14. Top Threats - Status

15. CSA Research ProjectsGo to www.cloudsecurityalliance.org/Research.html for Research dashboard and Working Group signup

16. CSA Guidance ResearchCloud ArchitecturePopular best practices for securing cloud computing13 Domains of concern – governing & operating groupingsFoundation for CSA researchGovernance and Enterprise Risk ManagementLegal and Electronic DiscoveryGoverning the CloudCompliance and AuditInformation Lifecycle ManagementPortability and InteroperabilitySecurity, Bus. Cont,, and Disaster RecoveryData Center OperationsIncident Response, Notification, RemediationApplication SecurityOperating in the CloudEncryption and Key ManagementIdentity and Access ManagementVirtualizationGuidance > 100k downloads: cloudsecurityalliance.org/guidance

17. CSA Guidance Research - StatusCloud ArchitectureVer 2.1 released Dec 2009Ver 3 mid-20112010 focusTranslationsWiki formatPer domain whitepapers (not official guidance)Governance and Enterprise Risk ManagementLegal and Electronic DiscoveryGoverning the CloudCompliance and AuditInformation Lifecycle ManagementPortability and InteroperabilitySecurity, Bus. Cont,, and Disaster RecoveryData Center OperationsIncident Response, Notification, RemediationApplication SecurityOperating in the CloudEncryption and Key ManagementIdentity and Access ManagementVirtualization

18. Guidance Highlights - GovernanceBest opportunity to secure cloud engagement is before procurement – contracts, SLAs, architectureKnow provider’s third parties, BCM/DR, financial viability, employee vettingIdentify data location when possiblePlan for provider termination & return of assetsPreserve right to auditReinvest provider cost savings into due diligence

19. Guidance Highlights - OperatingEncrypt data when possible, segregate key mgt from cloud providerAdapt secure software development lifecycleUnderstand provider’s patching, provisioning, protectionLogging, data exfiltration, granular customer segregationHardened VM imagesAssess provider IdM integration, e.g. SAML, OpenID

20. CSA Research ProjectsCloud Controls Matrix ToolTrusted Cloud InitiativeConsensus Assessments InitiativeCloud Metrics Research

21. ContactHelp us secure cloud computingwww.cloudsecurityalliance.orginfo@cloudsecurityalliance.orgLinkedIn: www.linkedin.com/groups?gid=1864210Twitter: @cloudsa

22. SummaryCloud Computing is real and transformationalChallenges for People, Process, Technology, Organizations and CountriesBroad governance approach neededTactical fixes neededCombination of updating existing best practices and creating completely new best practicesAdapting controls into “all virtual” environment

23. Thank you!sergio@secludit.comBlog elastic-security.com, Twitter @elasticsecurity