If your company is moving to the cloud, or you are auditing a company using cloud technology, what's different? What stays the same? ~ Keynote presentation for Bienvenue au congrès ISACA Québec 2019 ~ Copyright 2nd Sight Lab, LLC https://2ndsightlab.com

1. @teriradichel
How the Cloud
Changes Cyber Security
Teri Radichel, CEO | 2nd Sight Lab
@teriradichel

2. @teriradichel
Enterprises are predicted to invest over 3.5
million on average within the next year on
cloud technologies. This expenditure will take
30% of their total IT budget in 2020.
- IDG

3. @teriradichel
94% of respondents to the 2019 RightScale
State of the Cloud Report use cloud.
- RightScale

4. @teriradichel
The same concerns

5. @teriradichel
Responsibility
CUSTOMER CUSTOMER CUSTOMER
CLOUD PROVIDER
CLOUD PROVIDER
CLOUD PROVIDER

6. @teriradichel
Contracts + Legal
CUSTOMER
CLOUD PROVIDER

7. @teriradichel
Procurement
EXPENSE
REPORT
………..
$……….
Amazon Web Services
$…….
_________________
$…….
INVOICE
_________________
Dropbox
…. ….
………………….
………………….
$ …….
P.O.
………..
……..
Salesforce
………..
………………
$ …….

8. @teriradichel
Assessing the cloud provider (CSA CAIQ)

9. @teriradichel
Cloud provider risks

10. @teriradichel
Cloud provider best practices

11. @teriradichel
Individual service configurations

12. @teriradichel
Misconfigurations

13. @teriradichel
DevOps

14. @teriradichel
Automated governance

15. @teriradichel
Stolen credentials

16. @teriradichel
SSO

17. @teriradichel
MFA
?

18. @teriradichel
Networking

19. @teriradichel
Data exfiltration

20. @teriradichel
CASBs
CLOUD 1
CLOUD 2 ⚠️
CLOUD 3
CLOUD 4
CLOUD 5

21. @teriradichel
Encryption
?

22. @teriradichel
Compute

23. @teriradichel
Architecture
APPWEB DATA

24. @teriradichel
Segregation
QADEV PROD

25. @teriradichel
Least privilege
z

26. @teriradichel
Logs

27. @teriradichel
84% of surveyed enterprises describe
their IT infrastructure as “multi-cloud.”
- RightScale 2019 State of the Cloud Report

28. @teriradichel
Multi-cloud
X 3+

29. @teriradichel
Checklist
Legal
Procurement
CSP assessments (CAIQ)
CSP best practices
CSP service configurations
Training
Automate governance
Credentials – SSO + MFA
Networking
Cloud encryption
New compute
CASBs + DLP
Architecture
Segregation
Least privilege
Monitor all the logs

30. @teriradichel
Thank you!
Teri Radichel
Follow: @teriradichel + @2ndsightlab
Web: https://2ndsightlab.com
Blog: https://medium.com/cloud-security
Classes: https://2ndsightlab.com/cloud-security-training.html