Uploaded byMoshe Ferber
The Cloud & I, The CISO challenges with Cloud Computing
The document discusses the challenges of CISOs in adopting cloud computing, highlighting various perspectives from different stakeholders like CEOs, CFOs, and end-users. It outlines concerns about security, compliance, and vendor trust, while introducing the shared responsibility model between cloud providers and users. Additionally, it emphasizes the importance of building a cloud strategy, evaluating providers, and integrating security into software lifecycles.
More Related Content
Similar to The Cloud & I, The CISO challenges with Cloud Computing
The Cloud & I, The CISO challenges with Cloud Computing
- 1. The Cloud &I, CISO challenges with the cloud Moshe Ferber CCSK, CCSP When the winds of change blow, some people build walls and others build windmills. - Chinese Proverb
- 2. About myself Informationsecurity professional for over 20 years Founder, partner and investor at various cyber initiatives and startups Popular industry speaker & lecturer (DefCon, BlackHat, Infosec and more) Founding committee member for ISC2 CCSP certification. CCSK Certification lecturer for the Cloud Security Alliance. Member of the board at Macshava Tova – Narrowing societal gaps Chairman of the Board, Cloud Security Alliance, Israeli Chapter
- 3. So, what iscloud?
- 4. Cloud Computing What theCEO think about it?
- 5. Cloud Computing How theCFO see it?
- 6. Cloud Computing How theEnd-User feel regarding it?
- 7. Cloud Computing And howthe CISO Feels about it?
- 8. Everyday Examples “Moving tocloud will expose our data to foreign government” “I got a virtualized servers, so I already in the cloud” “I don’t trust the vendors” “What about compliance?” “Our regulator forbid us from moving to the cloud” “Cloud lacks the visibility we need” “We use hosting, so we are already in the cloud.” “We will loose control over our assets” “And What about the NSA…?” “Cloud services are not mature enough”
- 9. AgilityAgility What do yousay… And how the CISO understand it
- 10. ScalabilityScalability What do yousay… And how the CISO understand it
- 11. ComplianceCompliance What do yousay… And how the CISO understand it
- 12. ManageabilityManageability What do yousay… And how the CISO understand it
- 13. ReliabilityReliability What do yousay… And how the CISO understand it
- 14. Multi tenancyMulti tenancy Whatdo you say… And how the CISO understand it
- 15. And of course,you can not avoid the big question… Who is more secured? Cloud or on premise?
- 16. Can we definewhat is more secure? > <=
- 17. Can we definewhich cloud service? Cloud provider A Cloud provider B
- 18. Does it reallymatter?
- 19. Cloud Services arevery different in nature SaaS PaaS IaaS Private Hybrid Public
- 20. The shared responsibilitymodel Physical Security Network & Data Center Security Hypervisors Security Virtual Machines & OS security Data layer & development platform Application Identity Management DATA Audit & Monitoring IaaS PaaS SaaS Consumer responsibility Provider responsibility
- 21. So, bottom line,is cloud security improving?
- 22. Providers are doingmore to increase trust
- 23. Improvement with securitystandards & compliance
- 24. Security automation isimproving, specially in IaaS/PaaS
- 25. Monitoring & auditingare improving
- 26. Legal eco-system isgetting complicated Technical complexity Legal complexity
- 27. Configuration is stillopen by default, very easy to make mistakes Legal complexity
- 28. Increased chances forcloud provider lock-in Legal complexity
- 29. Government snooping isincreasing Legal complexity
- 30. Cloud Focused (Heavy use) Cloud Adopters (running appsin the cloud) Cloud Curious (First projects) Cloud Avoider (Private Cloud adapters) National Infrastructure Cloud challenges varies depending on the market sector Startups Energy SMB Hi Tech Government Health Military Telecom providers Homeland & Military industries Utility Retail Banks Financial Services Industry
- 31. The Challenge: Privatecloud still got the same attack vectors! Cloud Attack Vectors Provider Administration Management Console Multi tenancy & Virtualization Automation & API Chain of supply Side Channel Attack Insecure Instances Cloud Avoiders Cloud Curious Cloud Adopters Cloud Focused
- 32. The Challenge: Buildyour Cloud strategy Cloud Curious Cloud Avoiders Cloud Adopters Cloud Focused
- 33. The challenge: Understandthe share responsibility model Cloud Curious Cloud Avoiders Cloud Adopters Cloud Focused
- 34. The Challenge: Evaluatingthe providers Cloud Adopters Cloud Avoiders Cloud Curious Cloud Focused
- 35. Copyright © 2015Cloud Security Alliance Industry Standards used by Major Cloud Providers ISO/IEC 27018:2014 Cloud Adopters Cloud Avoiders Cloud Curious Cloud Focused
- 36. The Challenge: Lookfor those abundant applications that can benefit from cloud computing Cloud Adopters Cloud Avoiders Cloud Curious Cloud Focused Public Cloud Integrity Availability On premise Confidentiality
- 37. Telecom Providers The Challenge: Buildingcloud services Transparency Certifications Security operations Cloud Adopters Cloud Avoiders Cloud Curious Cloud Focused
- 38. The Challenge: managingmultiple cloud applications Governance Encryption Identity management Availability Cloud Focused Cloud Avoiders Cloud Curious Cloud Adopters DLP
- 39. Startups The Challenge: Integrating securityinto your software lifecycle & operations Monitoring Static & Dynamic Analysis Multi Tenancy DEVOPS Cloud Focused Cloud Avoiders Cloud Curious Cloud Adopters
- 40. To wrap ThingsUp… Join CSA Israel Facebook & LinkedIn Forums in order to stay updated regarding latest technologies and community meetups. Don’t let security hold you down
- 41. To wrap ThingsUp… Join CSA Israel Facebook & LinkedIn Forums in order to stay updated regarding latest technologies and community meetups. Use the right tools
- 42. To wrap ThingsUp… Perform responsible cloud adoption!
- 43. KEEP IN TOUCH CloudSecurity Course Schedule can be find at: http://www.onlinecloudsec.com/course-schedule
- 44.
Editor's Notes
- #37 The cloud providers AWS and Azure provide a number of compliance certifications. These certifications save time and resources if customers can rely on 3rd party audits by the bodies awarding these certifications (due diligence should be carried out where required). This is not an exhaustive list..There may be more. CCM has been adopted by both Amazon and Microsoft for their IaaS and PaaS services. Microsoft have it for some of their SaaS products such as Office 365 and CRM Dynamics as mentioned earlier. Source https://aws.amazon.com/compliance/ https://azure.microsoft.com/en-us/support/trust-center/compliance/