What is needed in the next generation cloud trusted platform ?

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
CSV-T10
Director of Cloud Security
Google
@MrDBCross
David B. Cross
What is needed in the Nex...

How Do You Trust a Cloud Platform?
Trust through transparency: Logging, auditing, compliance
Automation: Abstraction, dete...

What Comprises a Cloud Trusted Platform?
Usage
Operations
Deployment
Application
Network
Storage
OS + IPC
Boot
Hardware
3
...

#RSAC
Hardware Layer

The Need for a Trusted Hardware Stack
5
Trusted Supply Chain of Hardware and Software
Cloud Attack Surface
Controlled
desi...

#RSAC
Boot Layer

OS Layer: The Risks Without a Hardened Kernel
Reality: VMs should
always be viewed as
untrusted
7
VM Containment is Missio...

OS Layer: The Risks of Unknown Hardware
Unknown hardware
configurations
The more untrusted
software, the risk is
exponenti...

OS Layer: Recommended Risk Mitigations
Continuous attack surface reduction. Trim the kernel and
hardare drivers to only wh...

#RSAC
Application Layer

#RSAC
The Cloud Fabric Layer is Evolving
11
Standard Cloud Fabric Definition:
"The loosely coupled storage,
networking and...

Application Layer: Code Has an Identity
12
Right code running on the right machine authorized by the right identity
access...

Trusted Fabric Recommendations
Code is always tested and reviewed
Only execute code with known cryptographic
signatures an...

Despite this Evolution We are Not Secure
14
Mainframes ContainersServers
Virtual
Machines
Micro-
services
Multi-tenant sys...

Consider a Sandboxed Application Model
15
Mainframes ContainersServers Virtual Machines
Host kernel syscall are the
contin...

Sandboxed Applications – The Challenges
16
Untrusted app
Memory
Compute
OS/IO/Disk
User Data
Privileges
More
Less
Privileg...

Sandboxed Applications - Philosophy
Defense Layers
17
Independent security boundaries
Combining diverse technologies
in si...

Sandboxed Applications - Philosophy
18
Continuous internal and external reviews
Assume attackers have all your source code...

Sandboxed Applications - Philosophy
19
Monitoring
Logging at all layers, all the time
Central repository and tamper resist...

Problem:
We all have secrets!
The Continued Application Layer Risks
Protecting secrets is increasingly hard
Database crede...

The Next Generation Cloud Application Model
Past Ecosystem Solutions Explored:
TPMs were the "hope" for trusted applicatio...

The Next Generation Cloud Application Model
22
Looking forward into the future:
Secure Isolated Execution Environments (SI...

Next Generation Cloud Apps Using Hardware
The benefits of hardware
Reduce the Trusted Computing
Base to the smallest footp...

The Next Generation Cloud Application Model
24
Emerging industry technologies:
Intel SGX hardware enclaves
• Dedicated HW ...

#RSAC
Deployment Layer

Deployment: Strong Multi-Factor Authentication
The boundaries are down and the
model is changing
2FA and security keys are...

#RSAC
Operations Layer

Ops Layer: Machine Learning is Not the Only Answer
28
Trusted
Machine
Trusted
Person
Untrusted
Location
Untrusted
Time Hig...

Apply: Best Practices when Moving to the Cloud
29
1
Examine
the cloud platform
security stack in
detail from an end
to end...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 29 Ad

View on Slideshare

1 of 29 Ad