Nephos Technologies - Extending Security to the Cloud - Cloud Expo 2013
•
0 likes•245 views
This presentation was given by Lee Biggenden at CloudExpo 2013 in London, discussing what you should look for in a Cloud Services Provider and what you need to consider as part your security model when you do migrate to the Cloud. You can get more information from us be Emailing sales@nephostechnologies.com and don't forget to follow us on Twitter @NephosTech
Recommended
More Related Content
What's hot
What's hot (11)
Similar to Nephos Technologies - Extending Security to the Cloud - Cloud Expo 2013
Similar to Nephos Technologies - Extending Security to the Cloud - Cloud Expo 2013 (20)
Recently uploaded
Recently uploaded (20)
Nephos Technologies - Extending Security to the Cloud - Cloud Expo 2013
- 1. NEPHOS TECHNOLOGIES Cloud Services Broker! Extending Security To The Cloud ! 30th January 2013 – Cloud Expo Europe! ! Lee Biggenden!
- 2. EXTENDING SECURITY TO THE CLOUD! 1. Realistic Expectations! 2. Identifying Risks! 3. Considerations & Steps To Take! 4. Where Can We Get Some Help?! 5. Q&A! ! ! 02/01/2013! Nephos Technologies Ltd.! 2!
- 3. WHAT SHOULD YOU EXPECT FROM YOUR CSP?! DON’T EXPECT YOUR CSP EXPECT To Be Given Informa=on Image Valida=on Your CSP should share informa3on on their Typically CSP’s will not validate server images, the accredita3ons, geographies' and security measures responsibility will be on you Blurred Boundaries Perimeter Security or Tiered Security The “network perimeter” is blurred in the CSP’s don’t normally provide a perimeter Cloud so be prepared for it Firewall, or services like IPS as standard + A Different Approach to Security Dedicated Infrastructure -‐ For example, typically CSPs won’t provide Typically dedicated Cloud services are not the security measures like Firewalls as standard standard but they are available at extra cost To Have To Do Your Homework! The CSP To Take Ownership You need to research your providers, and to Public CSPs typically don’t offer complex solu3ons – understand the impact of one over another YOUR DATA IS YOUR RESPONSIBILITY! JUST BECAUSE THEY DON’T PROVIDE IT DIRECTLY DOESN’T MEAN ITS NOT POSSIBLE! 02/01/2013! Nephos Technologies Ltd.! 3!
- 4. CLOUD: WHERE ARE THE POTENTIAL RISKS?! • Unknown risk! – What standards do your providers follow (if any) ! ! • Abuse & nefarious use of Cloud services! Pre-Deployment! – Consumable in nature ! – Weak validation of user credentials ! • Insecure interfaces, API’s & open perimeters! – Important application layer control point between systems ! – Lack of perimeter security = open target for professional hackers! • Multitenancy and shared technology! – Understand shared infrastructure and the potential risk! – Limited isolation methods as standard! Post-Deployment! • Data loss and leakage ! – Who has access to what data and where is it?! – Malicious corruption of data ! • Account or service hijacking ! – Data access to account information ! – Weak portal authentication ! 02/01/2013! Nephos Technologies Ltd.! 4!
- 5. WHAT QUESTIONS SHOULD YOU ASK OF CSP’S AND YOURSELF?! Ask Ask Your Yourself! CSP! 1. Why are we moving?! 1. Accreditations?! 2. Who does have access?! 2. Customer segregation?! 3. Who should have access?! 3. Perimeter security?! 4. Data sovereignty?! 4. Known partners?! 5. Regulatory compliance?! 5. Monitoring/audit capabilities?! 6. What’s the application flow?! 6. Failover scenarios?! 02/01/2013! Nephos Technologies Ltd.! 5!
- 6. INCLUDE SECURITY AS PART OF YOUR PLANNING PROCESS (EARLY)! PLANNING 1. Identify! • Business Priorities! Identify! • Workloads! • Regulatory Requirements! 2. Evaluate! • Sensitivity of assets ! Investigate! Evaluate! • Provider services! 3. Map! • Security workload to Cloud delivery model! • Data flow between tiers! 4. Analyse! • Dataflows, security and delivery models against requirements! • Gap analysis ! Analyse! Map! 5. Investigate ! • User behaviours and access requirements! • Data classification requirements! Example text ! 02/01/2013! Nephos Technologies Ltd.! 6!
- 7. WHAT SECURITY STEPS SHOULD YOU CONSIDER?! • Physical & Operating System! – Build trusted compute pools & create secure connections! – Enable service and security monitoring / auditing ! – Patch management process needs to be applied ! • Data! – Classify your data (and what risks you can afford to take with it)! – Move your security closer to your data ! – Encrypt your data – in motion and at rest ! – Compliance and regulatory requirements! • Users! – Create strong access policy – you still need to control data access ! – Understand the access risks and the devices that you’re exposing to your data! 02/01/2013! Nephos Technologies Ltd.! 7!
- 8. WHO CAN OFFER INDEPENDENT ADVICE?! Independent Advice and Service Is a Must When You Choose to Deploy… Cloud Security Alliance! ODCA! Independent consortium that Independent consortium of Global identifies and promotes the IT leaders from over 300 use of cloud security companies working on a unified assurance best practices.! customer vision for deployments.! DMTF! TCG! Working on cloud Independent consortium developing, infrastructure management defining, and promoting open, interface specifications to vendor-neutral industry standards improve management for interoperable trusted computing interoperability. ! platforms! Cloud Industry Forum! Cloud Brokers / Aggregators! Established to provide transparency Independent advisors for Cloud, through certification to a Code of providing advice and value added Practice and to assist end users in services! gaining access to core information .! 02/01/2013! Nephos Technologies Ltd.! 8!
- 9. THE CLOUD SERVICES BROKER MODEL! 02/01/2013! Nephos Technologies Ltd.! 9!
- 10. HOW DO NEPHOS TECHNOLOGIES DELIVER SERVICE ! Cloud Migra=on • P-‐to-‐V, V-‐to-‐C • Applica3on/Data Migra3on 4 Support & Management • Tes3ng • SLA management • Project Management • Service restora3on • Service Transi3on Management • Managed service • Infrastructure monitoring • Capacity planning 3 • Cost certainty Architectural Design CLOUD • Public, Private or Hybrid FUNDAMENTALS • Security considera3ons • Performance certainty • Architect for the Cloud, not the DC 2 Strategy & Planning • The right provider • The right services • The business opportunity • How do you measure success 1 • The business case 02/01/2013! Nephos Technologies Ltd.! 10!
- 11. CUSTOMER USE CASE: UK BASED B2B RETAILER! • 1,500 Users across 8 European datacenter locations ! • Circa $1bn turnover 2012 (Europe)! • Under UK, European and US regulations (SOX, PCIDSS)! SCENARIO PROBLEM SOLUTION • Initial feaisbility work! • Weak and antiquated security Phase 1:! mechanisms ! • Benefits of Cloud identified! • Engaged QSA! • No consistant security models • Inconsistant European • Gap Analysis of existing across Europe! delivery of service! infrastructure Vs. requirements! • Not currently meeting PCIDSS • Develop a strategy/solution • Identified Cloud provider! requirements ! to enable a PCIDSS • Identfied Gaps and overlay compliant migration to a • No Cloud experience in-house! technologies ! Hybrid Cloud environment! • Limited security expertise in- Phase 2:! house! • Solution deployment! ! • Tight timescales (< 6 months)! • SA and OHO! ! Encrypted network extension to public Cloud, data encryption, NGFW, key management, AAA, a compliant provider! 02/01/2013! Nephos Technologies Ltd.! 11!
- 12. THANK YOU! LinkedIn: http://linkd.in/TKYmyR! Twitter: @NephosTech / @LeeBiggenden! Online: www.nephostechnologies.com ! Email: lee@nephostechnologies.com ! ! WE’RE ALSO AVAILABLE AT STAND 719!