Niloufer Tamboly and Mallik Prasad presented 'Securing The Journey To The Cloud' at the first (ISC)2 New Jersey Chapter meeting. Chapter officers: Gurdeep Kaur, President Niloufer Tamboly, Membership Chair Mallik Prasad, Secretary Anthony Nelson, Treasurer

1. Securing The Journey To
The Cloud
Niloufer Tamboly
Mallik Prasad
January 31, 2013

2. Securing the journey to the Cloud
Ø The Essentials of Cloud Computing
Ø Cloud Deployment and Service Delivery Models
Ø Cloud Security and Risk Considerations
Ø Assessing Risk, Audit Program Considerations
Ø Virtualization Concepts

3. How cloud is impacting business models
The New Normal Challenges
Ø Traditional brick and mortar companies are being challenged by competitive
new lean upstart companies utilizing cloud technologies.
Ø Business Demand on IT is increasing while expectations are for IT to do more
with less.
Ø Companies are embracing the mobile proliferation and the race for market
share utilizing these newer cloud technologies.
Ø What was about the Data Center is now about the data

4. The New Normal
The New Normal
Ø It’s a Digital world — The boundaries between work and home are no longer
relevant.
Ø Open Enterprise — The boundaries between businesses and the consumer
have been redrawn.
Ø Consumerization of Technology (Online, Mobile, Social Media) are changing
the shopping experience.
Ø Smarter shopper experience — The consumer is now multi-channel

5. Demystifying the Cloud

6. What is Cloud Computing?
Definition
Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of
configurable computing resources (e.g., networks, servers, storage, applications, and services) that can
be rapidly provisioned and released with minimal management effort or service provider interaction.
This cloud model promotes availability and is composed of five essential characteristics, four deployment
models and three service models.
Source: http://csrc.nist.gov/groups/SNS/cloud-computing/

7. Essential Characteristics
Ø On-demand self-service
Ø Broad network access
Ø Resource pooling
Ø Rapid elasticity
Ø Measured Service

8. Cloud Is Not…
…simply
virtualization
While many cloud solutions, both public and private, leverage virtualized
infrastructure resources to deliver functionality, cloud raises the bar by
providing on-demand provisioning. Publicly-announced private clouds are
essentially an aggressive virtualization program on top of the traditional
enterprise IT stack
…just applying SOA
principles
Service Oriented Architecture (SOA) is a set of design principles, whereas cloud
is a service. Cloud based services will be defined and enabled through SOA. As
such SOA is a prerequisite to reap cloud computing benefits. However, following
SOA design principles alone does not guarantee the ability to easily transition to
a cloud based solution
…only traditional
hosting
Cloud and traditional hosting share many characteristics but unlike traditional
hosting cloud service is offered on-demand, is scalable and elastic — a user can
have as much or as little of the service as they need and pay for the resources
actually used

9. Cloud Deployment Models
ØPrivate Cloud
ØPublic Cloud
ØCommunity Cloud
ØHybrid Cloud

10. Private Cloud
The cloud infrastructure is operated solely for a single organization. It may be managed by
the organization or a third party, and may exist on-premises or off premises.

11. Examples of a Private Cloud
Ø Openstack software delivers a scalable cloud operating system
Ø Some VMWare or Citrix installations
Ø Some Social Networks offer private clouds as: MangoApps, Huddle
IL3, and Jive

12. Public Cloud
The cloud infrastructure is made available to the general public or a large
industry group and is owned by an organization selling cloud services.

13. Examples of a Public Cloud
Ø Gmail
Ø SalesForce
Ø Amazon Elastic Compute Cloud (EC2)
Ø Facebook

14. Community Cloud
The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (for example,
mission, objectives, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party,
and may exist on-premise or off-premise.

15. Examples of a Community Cloud
Ø NYSE Technologies Capital Markets Cloud Platform: is the first financial
services cloud offering platform services to the capital markets community.
The platform is for banks, broker-dealers, systematic traders, and buy-side
institutions seeking to reduce the costs trading infrastructure and to
streamline access to a wide variety of trading applications, and provides
turnkey access to trading infrastructure and services, making it far simpler to
benefit from the world’s most vibrant capital markets community.

16. Hybrid Cloud
The cloud infrastructure is a composition of cloud models (private or public) that remain unique entities but are
bound together by standardized or proprietary technology that enables data and application portability (e.g.,
cloud bursting for load-balancing between clouds).

17. Examples of a Hybrid Cloud
Ø Organizations may host critical applications on private clouds and
applications with relatively less security concerns on the public cloud. The
usage of both private and public clouds together is called hybrid cloud. A
related term is Cloud Bursting. In Cloud Bursting, an organization can use
their own computing infrastructure for normal usage, but access the cloud
for high/peak load requirements. This ensures that a sudden increase in
computing requirement is handled gracefully.
Ø An organization might use a public cloud service, such as Amazon Simple
Storage Service (Amazon S3) for archived data but continue to maintain in-
house storage for operational customer data.

18. Demystifying the Cloud

19. Service Delivery Models
Ø Software as a Service (SaaS)
Ø Platform as a Service (PaaS)
Ø Infrastructure as a Service (IaaS)
Ø X as a Service (XaaS)

20. Software as a Service (SaaS)
Ø Definition - Delivers software as a service over the Internet. In most cases,
there is no need to install and run the application on the customer's own
computers hence simplifying maintenance and support.
Ø Customization - User of service have limited customization since they no
longer develop the application.
Ø Benefits - User of cloud maintains very little or no technical staff to run the
application software. User of service could realize additional savings as
expenses go from a Capital Expense to an Operating Expense and a reduction
in staff.

21. Platform as a Service (PaaS)
Ø Definition – Delivers a computing platform as a service. It facilitates deployment
of applications while limiting or reducing the cost and complexity of buying and
managing the underlying hardware and software layers. User of Cloud writes
application code that integrates with the providers platform.
Ø Customization – User of service has moderate customization — build
applications within the constraints of the platform.
Ø Benefits - User of service maintains the technical staff to develop and maintain
the application. User of service could realize additional savings as expenses go
from a Capital Expense to an Operating Expense and a reduction in staff.

22. Infrastructure as a Service (IaaS)
Ø Definition - Delivers computer infrastructure, typically a platform
virtualization environment as a service. Service is typically billed on a utility
computing basis and amount of resources consumed.
Ø Customization – Not much as a subscriber of the cloud customization where
technology being deployed requires minimal configuration.
Ø Benefits -User of service maintains the technical staff to develop and
manage its platform and application software. User of service could realize
savings as expenses go from a Capital Expense to an Operating Expense.

23. Exercise 1

24. Cloud Standards and Related
Regulations Are Still Evolving
Leading organizations trying to establish Security Standards in the Cloud are:
Ø NIST (National Institute of Standards and Technology)
Ø CSA (Cloud Security Alliance)
Ø ENISA (European Network and Information Security Agency)

25. Audit Program and Frameworks
ØThe National Institute of Standards and Technology (NIST) SP
800-30
ØISACA Cloud Computing Audit Program
ØCloud Security Alliance - Cloud Controls Matrix (attached Slide 34)
ØFederal Risk and Authorization Management Program
(FedRAMP)

26. Security and Privacy are top cloud
concerns

27. Cloud issues can impact you
It is important for cloud consumers to
consider and address security when
migrating to cloud

28. Public Cloud – Amazon view of Security
• Amazon Web services
– EC2, EBS, S3, VPC
etc.
• Customer
responsibility to
maintain security,
protection and backup
of their data and
applications on AWS
Source: http://aws.amazon.com/security/

29. CSA Threats – Public Cloud
# Threat Examples
1 Abuse and Nefarious Use of Cloud
Computing
IaaS offerings have hosted the Zeus botnet, InfoStealer trojan
horses, botnets, Spam
2 Insecure Interfaces and APIs Anonymous access and/or reusable tokens/passwords/keys,
clear text authentication, inflexible access controls, limited
monitoring and logging
3 Malicious Insiders Lack of Privileged user management monitoring policies, audits
4 Shared Technology Issues Red and Blue Pill exploits
5 Data Loss or Leakage Insufficient AAA controls; inconsistent use of encryption and
software keys, operational failures, disposal challenges,
reliability and DR
6 Account or Service Hijacking Lack of internal security controls and detailed
auditing/monitoring
7 Unknown Risk Profile IRS asked Amazon EC2 to perform a Certification & Audit;
Amazon refused, Heartland Data Breach

30. Scope and control among cloud service models
Application
Platform Architecture
Virtualized
Infrastructure
Hardware
Facility
Cloud Consumer
Cloud Provider
IaaS
PaaS
SaaS
IaaS
PaaS
SaaS
Regulatory Compliance is a key concern in public cloud - the cloud consumer has to
ensure controls for compliance are appropriately addressed either by the provider or
by including controls for data & applications on the cloud
Source: NIST Guidelines on Security and Privacy in
Public Cloud Computing

31. Cloud – Security Observations
Secure Cloud Infrastructure environment
•Secure setup and configurations
•Inter-VM traffic inspection and control
•Manage Privileged Users and their activities
How to manage identity and access across physical and virtual environments
•Identity Lifecycle Management
•Authentication Authorization Audit,
Application Security Assurance
•Varied trust levels requires different security controls
•Application Vulnerabilities
•Bespoke Application Re-factoring for Cloud
How to manage and monitor the entire Cloud infrastructure
•Configuration and Patch Management
•Compliance Management and reporting
•Incident detection and response
Policy and risk Management for Cloud
•Extension of ISMS incorporating Cloud Security
•Segregation of duties for Cloud
How to ensure Data Security
•Different classifications of data
•Data leakage from suspended, stored images
•Production data in orphan test, QA images
A
B
C
D
E
F
Test
Customer
Employee
COTS
Home-Grown
Legacy
HYPERVISOR
IaaS
PaaS
SaaS

32. A view of technical security controls
• Approval by Information Security
• Process/Policies defined/fine tuned
• Risk identification and mitigation
Security
Governance
• Identity and access Management
• Privileged user management
Privileged
Users & SOD
• Application Vulnerability Assessment
• Zoning/VLAN segregation
• Data encryption and obfuscation
Application/Data
Segregation
• Guest and host security
• Inter-VM Traffic inspection
• Patch and configuration management
Virtualization
security
• Guest /Hypervisor/Application log monitoring
• VM/Admin level activity monitoring
• Incident Detection and Response capability within Cloud
Auditing&
Monitoring
A
B
C
D
E
F
Challenges Controls

33. Top Ten Cloud Security Concerns
1. Architecture of the environment (Public V/s. Private, SAAS / PAAS / IAAS)
2. Misconfiguration of the environment, where breaches are caused by errors,
omissions and misconfigurations (e.g. hypervisor, OS, storage, switch).
3. Segmentation from other customers (e.g. Multi-tenant Environments)
4. Authentication and Authorization (e.g. form factor, lack of granular
permissions).

34. Top Ten Cloud Security Concerns
contd.
5. DDOS attacks (e.g. cloud to cloud, inter/intra cloud).
6. Data location and storage e.g. data loss / privacy / leakage.
7. Security Monitoring e.g. cloud perimeter and inside cloud.
8. Incident Response (e.g. availability of resources).
9. Auditability, Certification and Compliance (e.g. which standards to follow, is
the CSP compliant or has been certified, how do I check that?).
10. Legal (e.g. regional, who has access to my data?)

35. How Do You Scope A Cloud Audit?
ØRemember it is not prescriptive
ØYou need to understand the environments, service delivery and
deployment models
ØYou need to understand the risks associated with the
environment

36. Risk Areas In A Cloud Environment
Governance
Ø All changes logged
Ø Reporting on roles, separation of duties.
Ø Security monitoring of cloud environment and possible security
incidents.
Ø Patch Management

37. Risks
Vendor Management
ØVendor Selection
ØContracting
ØMonitoring
ØResource Provisioning
ØVendor Lock-in

38. Risks
Data Management
Ø Data Acquisition
Ø Data Usage
Ø Data Storage
Ø Data Transfer
Ø Data Disposal

39. Risks
Infrastructure Security
ØVulnerability Management
ØSystem Security
ØNetwork Security
ØApplication Security
ØEncryption

40. Risks
Identity and Access Management
ØIdentity Management
Ø Access Management

41. Risks
Physical Security
ØHighly secure physical facility, employee
background checks, multi-level / tiered access
controls in accordance with a least privilege policy
ØAccess logging and monitoring - Video monitoring,
Keycard and biometric palm readers, Fixed and
roving security guards (depending on data center).

42. Risks
Compliance
ØPCI DSS, SAS-70 Type II, FedRamp, FISMA

43. SSAE16 – SOC Decision Tree
Which Report To Use SSAE 16 - SOC
Will the report be used by your customers and their auditors to plan
and perform an audit or integrated audit of your customer’s financial
Yes SOC 1 Report
Will the report be used by your customers as part of their compliance
with the Sarbanes-Oxley Act or similar law or regulation?
Yes SOC 1 Report
Will the report be used by your customers or stakeholders to gain
confidence and place trust in a service organization’s systems?
Yes SOC 2 or 3 Report
Do your customers have the need for and ability to
understand the details of the processing and controls at a
service organization, the tests performed by the service
auditor and results of those tests?
Yes SOC 2 Report
No SOC 3 Report
Do you need to make the report generally available or use a
seal?
Yes SOC 3 Report

44. SSAE16 SOC 2 Overview
Five attributes of a system are known as principles and are defined as
follows:
Ø Security - The system is protected against unauthorized access
(both physical and logical).
Ø Availability - The system is available for operation and use as
committed or agreed.
Ø Processing integrity - System processing is complete, accurate,
timely, and authorized.
Ø Confidentiality - Information designated as confidential is protected
as committed or agreed.
Ø Privacy - Personal information is collected, used, retained,
disclosed, and destroyed in conformity with the commitments in the
entity’s privacy notice and with criteria set forth in Generally
Accepted Privacy Principles (GAPP)

45. SOC 3 Report - SysTrust for Service
Organizations
Use
ØDistribute the SOC 3 report to customers and publicly
display a seal of approval using the SOC 3 Report:
SysTrust for Service Organizations seal.
Scope
ØSOC 3 reports can be issued on one or multiple Trust
Services principles (security, availability, processing
integrity, confidentiality, and privacy).
For more information about the SysTrust for Service
Organization seal program go to www.webtrust.org.

46. Questions/Feedback

47. Exercise 2
Background
HotShot Enterprise (“HSE”) is a global consumer products company, producing household
products with annual revenues of approximately 80 billion USD.
HSE Products is ready to expand and is looking for ways to penetrate nontraditional
markets. HSE, CEO, has plans to grow the company in size, revenue, and profits in addition
to expanding its horizon.
However, to maintain a balanced budget HSE is looking to restructure some cost centers
and reduce company expenses considerably. Plans are under way to restructure the
Information Technology (IT), human resources and supply chain divisions.
The three divisions currently have over 10,000 employees across the world and are
estimated to incur expenses of up to 20 billion annually.

48. Exercise 2 contd.
It is apparent HSE’s competitors have moved into the cloud and are experimenting with new
ways to reach consumers.
For example, one of HSE’s competitors, NoShot Enterprise (“NSE”) is utilizing social media
and other mobile platforms to reach the consumers.
NSE’s quarterly revenue increase highly suggests that their strategy on the cloud has played
a vital role. From HSE’s perspective the boundaries between consumers and businesses are
being redrawn and the cloud is facilitating this move.
Accordingly, HSE’s board of directors accepts the new normal — cloud computing and
focuses more on data.
Exercise:
1) You are asked to test that controls that Data is securely transmitted and
maintained to prevent unauthorized access and modification.
2) Also validate that controls over Virtualized operating systems are hardened to
prevent cross-contamination with other customer environments.

49. Key Properties of Virtualization

50. Virtualization
Hypervisor
• A hypervisor is a piece of software/hardware platform-
virtualization software that allows multiple operating
systems to run on a host computer concurrently. Also called
Virtual Machine Monitor (VMM)
• Type 1: A type 1 hypervisor runs directly on the computer
hardware and manages all operating systems running as
guests above it. This is also known as running on ‘Bare
Metal’
• Type 2: A type 2 hypervisor is a software application that
runs on an operating system.

51. Types of Virtualization

52. Types of Virtualization

53. Virtualization Network Layer

54. Application and Desktop Layer

55. Servers and Storage

56. Additional Documentation
Attachments:

57. Questions
Questions