The document discusses building trust and confidence in cloud computing. It outlines Cisco's approach to cloud security from the perspective of cloud consumers and providers. Key points include the changing business landscape driving cloud adoption, security concerns that have prevented cloud adoption, how cloud security approaches have changed to be more enabling rather than inhibiting, and shared security responsibilities between cloud consumers and providers. The document also provides recommendations for what cloud customers should demand from their providers to ensure security.

2. Building Trust and Confidence
in the Cloud
Sujata Ramamoorthy | Chief Security Officer | Cisco Cloud Platform
Jeff Wicks | Chief Security Officer | Cisco Cloud Offerings
July 13, 2016

3. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
Director, Enterprise Security
• Corporate security policies & Practices
• Security Risk Governance
• IT and Business Partnerships
• Security Services
CSO, Cloud Offerings
• Cloud Security Policies and Standards
• Security Operations
(governance, compliance and monitoring)
• Engineering and Business Partnerships
• Visibility and Trust
3
Complimentary Functions

4. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 4
Business Landscape
Industry and Cisco
Changing Role of IT
Technology Transitions
Internet of Things
Data and
Analytics
CloudMobile
Business Implications
Security and
Privacy
Experience
Expectations
Globalizations
Growth and
Innovation
New Business
Models
New Breed
of Apps

5. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 5
The Cloud is Driving Business Transformation
eWeek
Increased
Productivity
+69%
Markets & Markets
Hybrid Cloud Growth
$33B -> $92B
2016 -> 2021
Gartner
Public Cloud Growth
+16% in 2016 to
$204B
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public

6. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 6
Cisco Enterprise Journey to Cloud
140
182
237
308
400
0
100
200
300
400
500
2011 2012 2013 2014 2015
NumberofProviders
CAGR
= 30%
Cloud Providers
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
Product As a Service
Meeting Place On-Prem
Router/Firewall
Virtual Managed Services
CSR, ASAv, WSAv
Call Manager On-Prem
Team Collaboration IWE
(WebEx Social)
Documentation In-House
Cisco Spark
Call
in the cloud

7. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
Business Imperatives
New Revenue
Streams
Accelerated
Deployment
Dynamic,
Efficient, Agile
Security Assured
Experience
ITaaS
Private
SaaS
Hybrid
Public
7
We Now Live in a World of Many Clouds
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public

8. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
Cloud Infrastructure Challenges
Application
and Service
Migration
Operational
Excellence
Configuration
and Policy
Implementation
Security
Total Cost of
Ownership
8

9. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
41%
35%
32%
26%
18%
15%
11% 10%
4%
Data Privacy
and
Security
Auditing
and
Compliance
Control of
Data
Contractual /
Legal Issues
Network
Connection
Security
Geographical
Coverage
Access
and
Control
Security
Models /
Toolsets
Internal
Issues
Source: Cloud – Wave 6 | ©2014-451 Research, LLC. www.451research.com
Top Security Concerns with Cloud Computing
9

10. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
Enabler (New)
Ultimate Simplicity
• Easy to consume requirements
• Pre-hardened foundations
• Self guided SDL workflows
• Automated security validation
10
Cloud Security: Old vs. New World
Inhibitor (Old)
Wrong Security Model
• Overly technical requirements
• Lacked security operations guidance
• Not aligned to risk of the offering
• Resource intensive gap analysis
Security not aligned
with business delivery
Security at the speed
and risk of the business
Deliberate shift to transform
cloud security to enable
business speed and reduce risk
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public

11. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
Security Responsibilities
Cloud Providers vs. Consumers
HardwareApplication Platform
Architecture
Virtualized
Infrastructure
Facility
Consumer Provider
IaaS IaaS
PaaS PaaS
SaaS SaaS
11

12. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 12
What is the Providers Role?
Cloud Security Models will Leverage…
Cloud
Architectures
Strong
Authentication
Segmentation
Encryption
and Key
Management
Event
Monitoring
Automation
Transparency

13. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 13
Your Role as a Consumer of Cloud
Engagement MonitoringPolicy Processes
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public

14. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
Case Studies

15. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
A Holistic Approach to Security
15
• Transparency from
provider
• Ability to configure
settings for Terms of Use
• Integration for Identity,
Data and Service/
Security Management
• Continuous Assurance
• Security Posture and
Practices
• Pen-test
• Audit
• Awareness
• Accountability
• Governance

16. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
Build
• Security Standards
and Architectures
• Threat Analysis and Protection
• Quality Management
• Common Secure Services
• Data Encryption
and Protection
• Assessment Activities
• Intrusion Detection and
Prevention Systems
• Security Governance
Operate
• Policy and Compliance
• Transparency to
Enable Customers
• Secure Cloud Supply Chain
• Application Layer Data and
Event Monitoring
Monitor
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
Cloud Security Model to Drive Trust
Cloud Security Lifecycle
16

17. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
Security in the Cloud will Continue to Evolve
17
Internet of Things
(IoT)
Hybrid Cloud
(Public – Hybrid – Private)
Cloud
Interdependencies
Cloud A Cloud B
Developer Friendly
Clouds
Big Data
Growth
Will be enabled by
Security Automation
• Transparency
• Chef/Puppet (Hardening)
• Continuous Security
• Security Validation Scripts
Software Defined Security
• ACI/SDN
• Embed Security Policies
• Virtual Security
Appliance
Context Driven Security
• Data Driven Real time
Analysis
• Behavioral Analytics
Data Sovereignty
• Local Laws and
Regulations
• Data Loss Prevention
• Audits/Certifications

18. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 18
Cisco Cloud Strategy
Business
Metrics
Cisco
Applications
Infrastructure
and
Intercloud
End-to-End
Security
Interoperability
and
Open
Standards
Choice of
Consumption
Models
Provide SaaS in
select categories
Enable Cloud Providers
to deliver differentiated
cloud services
Enable enterprises to
build private and hybrid clouds

19. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
What Should Customers Demand?
Threat
Analysis
Transparency
Compliance
Governance
Trust
Value Chain
Continuous
Assessments
Event
Monitoring
Quality
Agility
Security
Performance
Open
Standards
Flexibility
Mobility
Interoperability

20. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
Take-Aways
RelationshipsOngoing
Engagement
TransparencyAsk the Right
Questions
Mutual
Responsibility
© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public

22. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Public
• Cloud and Business Landscape
• Cisco’s Cloud Journey
• Cloud Challenges and Concerns:
• What prevents adoption?
• How has the security approach changed?
• Shared responsibilities between Cloud Consumers and Providers
• Cisco’s approach to Cloud security: Consumer and Provider view
• What should customers demand of their cloud providers
• Take a ways
Building Trust and Confidence in the Cloud:
1 Slide Outline
22