Sergio Loureiro, a co-founder of Cloud Security Alliance, presents why your data is not as safe as you think in cloud and containerized environments.

1. How to secure your data in the cloud
Sergio Loureiro, Director Product Management
1

2. Objective
2
• The lack of visibility and control in hybrid and multi-cloud environment
• Why security automation is mandatory for agile environments?
• Why traditional solutions do not cope with cloud and containers?
• 3 steps plan for data security in AWS, Azure and Docker

3. Shared Responsibility between Providers and Enterprises
3

4. Cloud Trust Models
4
Trustgap
Trustgap
Trustgap

5. Workloads are Enterprise’s Responsibility
5
Most common cases Strategic cases

6. First Headline back in 2011

7. Fast forward to 2018

8. Securing the Migration Journey to IaaS
8
source: https://www.rightscale.com/lp/state-of-the-cloud
Customer Challenges
- Assess a different kind
of infrastructure
- Time consuming
permission process
- Evaluate configurations
for all instances and
storage

9. Growth of Container Adoption with DevOps Trend
9
Customer Challenges
- Evaluate containers environments
- Evaluate container configurations
and management
source: https://www.docker.com/what-container

10. Security Automation is Mandatory for DevOps
• Auto-Discovery of assets by API
• Security checks automatically launched
• Agentless is less costly to manage and works
with Serverless
• DevOps is changing when, who and how
security management is done

11. Why traditional solutions do not cope with cloud?
• Shared responsibility and new cloud services every week
• Elasticity and Agile
• Changing IPs
• License model
• Cloud Shadow IT
• APIs for everything
• Publicly accessible
• New layer of configuration (and misconfigurations)

12. Overview of AWS and Azure security capabilities
12
AWS
- Security Groups (firewall)
- Trusted Advisor (high level)
- Inspector (assessment)
- Key Management Service
- Identity and Access Management
- Macie (DLP)
- GuardDuty (threat detection)
- Shield (DoS)
- WAF (WAF)
Azure
- Azure Security Center
- Security Groups (firewall)
- Key Vault
- Endpoint Protection
- VM agent
- …
+ Integration with security partner solutions

13. What’s missing from AWS and Azure?
13
1. Putting all security services together
and assessing that continuous changes
are not bringing added risk
2. Workloads (Applications + Data)
security, your own stuff 

14. Cloud Workload Protection Controls - Top 3 Approaches
Operations Hygiene
Core
Additional • CIS AWS benchmark
• CIS Azure benchmark
• CIS Docker benchmark
• CIS Kubernetes bench.

15. EWP Features
Source: Gartner Market Guide to Cloud Workload Protection Platform 2017

16. Let’s draw a plan
16
- 1st step: workload security assessment + cloud configuration assessment
- 2nd step: security automation for continuous assessment
- 3rd step: extend to new services

17. 1. Comprehensive Solution
17
Vulnerability Management
identifies vulnerabilities
Application Security
evaluates applications
Cloud & Container Security
assesses configurations and
workloads
Combines all 3 into one solution

18. 2. Continuous Workload Analytics
• Implementation of CIS benchmarks: AWS, Azure, Docker and Kubernetes
• Using the IaaS Provider or Hypervisors APIs
• Auto-discovery for elastic scenarios, zero configuration
• Real-time alerts on configuration issues

19. 3. Extend to new cloud services
• Orchestration possible by API
• Integration on CI/CD setups for containers
• Virtual appliances available for Azure and AWS for private assets
• Managed Services, Snapshot and Professional Services plans available

20. Examples of CIS AWS and CIS Azure Controls

21. Use Case with AWS Elastic Map Reduce (EMR)

22. Use Case with AWS Elastic Map Reduce (EMR)

23. Use Case with AWS Elastic Map Reduce (EMR)

24. Supporting Material
• EWP web: https://outpost24.com/cloud-security
• EWP white paper - https://marketing.outpost24.com/cloud-security-whitepaper
• AWS best practices white paper - https://marketing.outpost24.com/aws-security-
whitepaper
Looking for more?
• Gartner Cloud Workload Protection Platform (CWPP) research
• Cloud Security Alliance Security Guidance version 4
• Latest CIS benchmarks for Amazon AWS 1.1.0 and Microsoft Azure 1.0.0
• Demo accounts available on request

25. Q & A

26. Outpost24 EWP executive overview

27. Outpost24 EWP cloud provider status view

28. Outpost24 EWP instances status view

29. Outpost24 EWP workload findings view