Evolution of Security Controls Towards Cloud Services discusses security controls for cloud services. It summarizes the Cloud Security Alliance's Security Trust Assurance and Risk framework for guiding cloud vendors and assessing cloud security risks. It also discusses the Cloud Controls Matrix version 3.0 which provides guidance on implementing security controls in cloud environments based on 16 security domains. Managing uncertainty is key when using cloud services, and formal verification methods can help ensure security. Continuous monitoring of cloud environments helps gain visibility and detect security issues.

1. Evolution of Security Controls
Towards Cloud Services
Hugo Rodrigues

2. 2© 2019 Hugo Rodrigues. All rights reserved.
Where to start?
Where to look?
What’s relevant?
What to do?
How to do it?
Security Controls
Cloud Services

3. 3© 2019 Hugo Rodrigues. All rights reserved.
CSA - Security Trust Assurance and Risk (STAR)
Security principles to guide cloud vendors and to
assist prospective cloud customers in assessing
the overall security risk of a cloud provider
Assurance, Education, Research, Community
Example topics:
What are the base-level security controls required for an IoT system?
What are the top threats to cloud computing?
How will we protect networks and data in the era of quantum computing?
https://cloudsecurityalliance.org/star/
Source: Cloud Security Alliance

4. 4© 2019 Hugo Rodrigues. All rights reserved.
Tool for the systematic assessment of a cloud implementation, to provide
guidance on which security controls should be implemented by which actor
within the cloud supply chain
• Control framework for cloud computing
• 16 domains covering all key aspects of the cloud technology
• Map to Standards, Regulations & Controls Frameworks
• ..
CCM v3.0.1 is available as a free download to help companies
evaluate cloud providers and guide security efforts

5. 5© 2019 Hugo Rodrigues. All rights reserved.
Uncertainty with cloud
Security matters at every layer of modern computing systems, but especially at
the level of distributed systems and networks
Modern computing systems and modern applications are typically distributed
systems, with data storage and computation happening at different nodes in the
distributed system
The formal protection mechanisms are enough?
e.g. patents, trademarks, industry designs, utility models and copyright,…

6. 6© 2019 Hugo Rodrigues. All rights reserved.
Formal protection in distributed systems
Amazon Web Services have used programmatic formal methods including
formal verification and model checking to verify the correctness of their widely
used Simple Storage System (S3)
Facebook Infer static analyzer is used to identify null pointer access and
resource leaks in Java programs.
It builds on the key technology of separation logic, which enables precise but
scalable reasoning about program code that performs complex heap
manipulation. This system has been released as open source
Formal protection at the technology level is key for cloud services

7. 7© 2019 Hugo Rodrigues. All rights reserved.
Source: Pooyan Jamshidi, Cloud Architecture Model with Layers SaaS, PaaS, and IaaS
Multidimensional decision points - under uncertainty

8. 8© 2019 Hugo Rodrigues. All rights reserved.
Manage uncertainty
Cloud applications are software systems with layered, distributed
architectures that utilize layer-specific resources provided through services
Focus on decision points from the intersection between services with
technologies
Set specific goals to measure the need for change vs lift and shift
Prepare the environment to an abstraction level suitable to enterprise
maturity in working with distributed systems
Due to the uncertainty that prevails in the cloud, using change
patterns at the core of models and rules has helped to map uncertain
situations into manageable ones

9. 9© 2019 Hugo Rodrigues. All rights reserved.
Gain visibility over cloud services
Set compliance controls
and
Set operational controls
Data collected from operational controls supports threads being
discovered from pattern mismatch analysis

10. 10© 2019 Hugo Rodrigues. All rights reserved.
Pay attention to data behavior
Source: Zhenguo Chen, Trust evaluation model of cloud user based on behavior data
Example:

11. 11© 2019 Hugo Rodrigues. All rights reserved.
Manage your data
“As with any function or application, weak data leads to weak results.
In cybersecurity, that means too many false positives for
overburdened security analysts, higher risk of successful breaches,
and greater losses from each breach.” - Stu Bradley, SAS

12. 12© 2019 Hugo Rodrigues. All rights reserved.
Source: Nathan Sanders, HDSR MIT
Turn data into gold
Prediction: Given a new measurement, you want to use an existing data set
to build a model that reliably chooses the correct identifier from a set of
outcomes
Complement vendors’ standard with own signatures

13. 13© 2019 Hugo Rodrigues. All rights reserved.
Cloud services increase security events?
• Perimeter evaporated and cloud environment
shifts rapidly
• Former on-prem services now in the cloud
• External logs may have reliability / availability
issues
• EDR deployment complicated by volume and
velocity
• Containment is hampered by volatility and lack of
access
• Convergence and new connectivity requirements
Source: RSA Conference 2019

14. 14© 2019 Hugo Rodrigues. All rights reserved.
Respond To Security Event - cloud services
Anticipation is key for compliance - Follow the CCM to the maximum extent
Proactivity is key for operations – Use analytics and insights
Response is needed for everything else
Build a Cloud-Specific Incident Response Plan: A well-defined plan allows to
effectively identify, minimize the damage, and reduce the cost of an attack, while
finding and fixing the cause to prevent future attacks
Mitigation of control gaps is never sufficient, infrastructure will always have gaps
and zero day vulnerabilities
The Three Elements: Plan, Team, and Tools

15. 15© 2019 Hugo Rodrigues. All rights reserved.
Impact analysis to measure financials
Risk itself can be a qualitative measure, but the impact around an incident
(the cost of a downed asset associated with lost revenue, recovery, etc.)
can be quantitative.
Consider a Risk Management Framework even before you move systems
Source: Journal of risk and Financial management

16. 16© 2019 Hugo Rodrigues. All rights reserved.
Financial health
You can’t own a problem if you don’t measure it
Quantifying the impact of security incidents is a great way to mature beyond
“our risk is yellow”
Analytics, Intelligence & Response: apply investigative and analytic techniques to
anticipate and resolve incidents
The Human & Process Security: navigate management issues such as operational
risk strategies, as well as people-related issues such as social engineering

17. Q&A
Hugo Rodrigues
hugosrodrigues

18. Thank you!