SlideShare a Scribd company logo
1 of 41
Achieving Security Assurance and
     Compliance in the Cloud
         Ray Sugiarto, CSA Indonesia
         Founder, chapter in formation
       0815 167 2882 BBM 2142176F

           Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Cloud: Ushering in “IT Spring”
Cloud – a simple idea
Compute as a utility
Align technology costs with usage
Challenges our assumptions about
everything
    
        Barriers to market entry in any industry
    
        Organizational structure and business planning
    
        Investment, venture capital, Research &
        Development
    
        Driving a new macroeconomic reality
                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
    
The Revolution Has Tinder
 Social networking, blogging and
 mircoblogging
  Egalitarianism of media and communications
  Mobile computing
  Empowering the citizens
  Cloud computing
 Egalitarianism of IT

What can’t this change?
Timing is everything

                    Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
What is Cloud Computing?
Compute as a utility: third major era of computing
Cloud enabled by
 Moore’s Law
 Hyperconnectivity
 SOA
 Provider scale
Key characteristics
 Elastic & on-demand
 Multi-tenancy
 Metered service
IaaS may track energy costs

                      Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
2011-2014: The Hybrid Enterprise



                                                                   private clouds
              public clouds



                Extended Virtual Data Center
                                                                                       enterprise
  Cloud + Mobile                                                                 Notional
                                                                                  boundary
                                                                              organizational
    Dispersal of applications                               cloud of users      boundary
    Dispersal of data
    Dispersal of users
    Dispersal of endpoint devices
                                                                                                  5
                        Copyright © 2011 Cloud Security Alliance             www.cloudsecurityalliance.org
Cloud Forcing Key Issues
Critical mass of separation between data owners and
data processors
Anonymity of geography of data centers & devices
Anonymity of provider
Transient provider relationships
Physical controls must be replaced by virtual controls
Identity management has a key role to play
Cloud WILL drive change in the security status quo
Reset button for security ecosystem



                 Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
What are the Trust Issues?
Will my cloud provider be transparent about
governance and operational issues?
Will I be considered compliant?
Do I know where my data is?
Will a lack of standards drive unexpected
obsolescence?
Is my provider really better at security than me?
Are the hackers waiting for me in the cloud?
Will I get fired?


                  Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Key Problems of Tomorrow
 Keeping pace with cloud changes
 Globally incompatible legislation and policy
 Non-standard Private & Public clouds
 Lack of continuous Risk Management & Compliance
 monitoring
 Incomplete Identity Management implementations
 Haphazard response to security incidents




               Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
About the Cloud Security
Alliance
 Global, not-for-profit organization
 Over 23,000 individual members, 100 corporate members,
 50 chapters
 Building best practices and a trusted cloud ecosystem
 Agile philosophy, rapid development of applied research
    GRC: Balance compliance with risk management
    Reference models: build using existing standards
    Identity: a key foundation of a functioning cloud economy
    Champion interoperability
    Enable innovation
    Advocacy of prudent public policy
 “To promote the use of best practices for providing security assurance within Cloud Computing, and provide
             education on the uses of Cloud Computing to help secure all other forms of computing.”




                                     Copyright © 2011 Cloud Security Alliance                 www.cloudsecurityalliance.org
HOW DO WE BUILD THE “TRUSTED                        CLOUD?”



                Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Here’s How…
 Strategy
 Education
 Security Framework
 Assessment
 Build for the Future




               Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Strategy
 IT Architecture supporting Hybrid enterprise
  Federated IdM
  Service Oriented Architecture “loose coupling” principles
 Consider cloud as an option to any new IT
 initiative
  What are the cost differences?
  What are the feature/functionality differences?
  Does the application support different cloud deployments and
  multiple providers?
 Risk Management
  Sensitivity of application and data, new risks introduced by cloud,
  risk tolerance levels
                      Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
EDUCATION
• Classes in Feb and May in Indonesia by
   AdvancedTechpac

               Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
CSA Guidance Research
 Popular best practices for
 securing cloud computing




                                                                                             Governing the Cloud
 Flagship research project

 V2.1 released 12/2009

 V3 research underway,
 targeting Q3 2011 release


                                                Operating in the Cloud
 wiki.cloudsecurityalliance.or
 g/guidance


Guidance > 100k
downloads:
cloudsecurityalliance.org/guidance


                        Copyright © 2011 Cloud Security Alliance         www.cloudsecurityalliance.org
Guidance Highlights – 1/2
 Governance, ERM: Secure the cloud before procurement –
 contracts, SLAs, architecture
 Governance, ERM: Know provider’s third parties, BCM/DR,
 financial viability, employee vetting
 Legal: Plan for provider termination & return of assets
 Compliance: Identify data location when possible
 ILM: Persistence, Protection
 Portability & Interoperability: SOA “loose coupling”
 principles


                    Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Guidance Highlights – 2/2
BCM/DR: provider redundancy vs. your own
DC Ops: provisioning, patching, logging
Encryption: encrypt data when possible, segregate key mgt
from cloud provider
AppSec: Adapt secure software development lifecycle
Virtualization: Harden, rollback, port VM images
IdM: Federation & standards e.g. SAML, OpenID




                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Certificate of Cloud Security
Knowledge (CCSK)


 Benchmark of cloud security competency
 Measures mastery of CSA guidance and ENISA cloud risks
 whitepaper
 Understand cloud issues
 Look for the CCSKs at cloud providers, consulting partners
 Online web-based examination
 www.cloudsecurityalliance.org/certifyme



                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Classes in Indonesia, Jakarta


•
• First class was done in Nov 20
• New class is targeted for 09 Feb 2012 at
   Cyber 2 supported by CBN one of the oldest
   ISPs in Indonesia
             rd
• Planned 3 class is in May 2012 or may be
   bring forward to April depend on demand
• Join us as below for those in Indonesia :
• http://www.facebook.com/groups/ccskindonesia/
                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Training Courses
  CCSK Basic
One day course to enable student to pass CCSK

  CCSK Plus
Two day course includes practical cloud lab work

  GRC Stack Training
One day course to use GRC Stack components

  PCI/DSS In the Cloud
Achieving PCI compliance in cloud computing

  http://cloudsecurityalliance.org/education/training/


                            Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Upcoming Conferences


 CSA Summit Korea, Sept. 29, Seoul
 CSA Summit Europe, Oct. 10, London (with RSA Europe)
 CSA Congress, Nov. 16-17, Orlando
 CSA Summit RSA, Feb. 27, 2012, San Francisco
 SecureCloud 2012 (partnership with ENISA)




                 Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
SECURITY FRAMEWORK




           Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
CSA Reference Model
                       CSA Cloud Reference
                       Model
                           IaaS (Compute & storage) is
                           the foundation
                           PaaS (Rapid application dev)
                           adds middleware to IaaS
                           SaaS represents complete
                           applications on top of PaaS




        Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Cloud Controls Matrix
 Controls derived from
 guidance
 Mapped to familiar
 frameworks: ISO 27001,
 COBIT, PCI, HIPAA,
 FISMA, FedRAMP
 Rated as applicable to S-
 P-I
 Customer vs Provider role
 Help bridge the “cloud gap”
 for IT & IT auditors


                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
ASSESSMENT

     Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Assessment Responsibility




        Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Consensus Assessment Initiative




 Research tools and processes to perform shared
 assessments of cloud providers
 Integrated with Controls Matrix
 Version 1 CAI Questionnaire released Oct 2010,
 approximately 140 provider questions to identify presence of
 security controls or practices
 Use to assess cloud providers today, procurement
 negotiation, contract inclusion, quantify SLAs
 www.cloudsecurityalliance.org/cai.html


                     Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
CSA STAR Registry

CSA STAR (Security, Trust and Assurance Registry)
Public Registry of Cloud Provider self assessments
Based on Consensus Assessments Initiative Questionnaire
 Provider may substitute documented Cloud Controls Matrix
 compliance
Voluntary industry action promoting transparency
Free market competition to provide quality assessments
 Provider may elect to provide assessments from third parties
Available October 2011


                     Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
BUILD FOR
THE FUTURE

       Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
CSA GRC Stack
Family of 4 research projects
  Cloud Controls Matrix

  Consensus Assessments
  Initiative

  Cloud Audit

  Cloud Trust Protocol

Tools for governance, risk
and compliance
management
                                                                                  Private, Community

Enabling automation and
                                                            Control      Provider
continuous monitoring of                                   Requiremen    Assertion
                                                               ts            s
GRC
                     Copyright © 2011 Cloud Security Alliance           www.cloudsecurityalliance.org
CloudAudit


Open standard and API to automate provider audit
assertions
Change audit from data gathering to data analysis
Necessary to provide audit & assurance at the scale
demanded by cloud providers
Uses Cloud Controls Matrix as controls namespace
Use to instrument cloud for continuous controls monitoring



                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Cloud Trust Protocol (CTP)

Developed by CSC, transferred to CSA
Open standard and API to verify control assertions
“Question and Answer” asynchronous protocol, leverages
SCAP (Secure Content Automation Protocol)
Integrates with Cloud Audit
Now we have all the components for continuous controls
monitoring




                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
CloudSIRT

 Consensus research for emergency response
 in Cloud
 Enhance community’s ability to respond to incidents
 Standardized processes
 Supplemental best practices for SIRTs
 Hosted Community of Cloud SIRTs
 www.cloudsecurityalliance.org/cloudsirt.html



                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Trusted Cloud Initiative

 Comprehensive Cloud Security Reference Architecture
 Secure & interoperable Identity in the cloud
 Getting SaaS, PaaS to be “Relying Parties” for corporate
 directories
 Scalable federation
 Outline responsibilities for Identity Providers
 Assemble reference architectures with existing standards
 www.cloudsecurityalliance.org/trustedcloud.html


                       Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Reference Model Structure




          TCI Reference Architecture

        Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Security as a Service

 Information Security Industry re-invented
 Define Security as a Service
 Articulate solution categories within Security as a Service
 Guidance for adoption of Security as a Service
 Align with other CSA research
 Develop deliverables as a proposed 14th domain within
 CSA Guidance Version 3.
 www.cloudsecurityalliance.org/secaas.html



                     Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Data Governance Project


Survey of current Cloud Provider data governance practices
in the market (e.g. backup, encryption, secure deletion, etc.)
Structure based on Domain 5: Information Lifecycle Mgt
Project co-sponsored by CSA Silicon Valley and CSA
Singapore
Target Sept. 2011 Report release
Charter and participation info to be posted on CSA website
1st week of August.



                    Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
What Might Cloud 2.0 Look Like?

 Less centralized than you think: cloud brokering,
 SOA, REST, evade energy costs, grid
 Regulated – if we don’t do it ourselves
 Disruptive technologies, e.g. format preserving
 encryption, new secure hypervisors, Identity
 Management everywhere
 New cloud business app models
 Greater policy harmonization (maritime law?)
 4 of 10 biggest IT companies of 2020 do not exist


                  Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Going to the Cloud
Securely
 Challenges remain
 More tools available than you think
 Waiting not an option
 Many types of clouds
 Identify IT options appropriate for specific cloud
 Leverage business drivers & risk management
 Be Agile!



                  Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Contact


Help Us Secure Cloud Computing
   www.cloudsecurityalliance.org
   info@cloudsecurityalliance.org
   LinkedIn: www.linkedin.com/groups?gid=1864210
   Twitter: @cloudsa




                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
Training arm for Apccor in Indonesia – organizer of CCSK
classes and cloud related events
Other certification classes and trainings




          Need more info call to Rosi, Felicia, Ray
  +6221 4176 6679 or email to ccsk@advancedtechpac.com

                   Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org
THANK
 YOU!
 Copyright © 2011 Cloud Security Alliance   www.cloudsecurityalliance.org

More Related Content

What's hot

Chap 6 cloud security
Chap 6 cloud securityChap 6 cloud security
Chap 6 cloud securityRaj Sarode
 
2012 10 cloud security architecture
2012 10 cloud security architecture2012 10 cloud security architecture
2012 10 cloud security architectureVladimir Jirasek
 
Cloud computing understanding security risk and management
Cloud computing   understanding security risk and managementCloud computing   understanding security risk and management
Cloud computing understanding security risk and managementShamsundar Machale (CISSP, CEH)
 
Security Issues of Cloud Computing
Security Issues of Cloud ComputingSecurity Issues of Cloud Computing
Security Issues of Cloud ComputingFalgun Rathod
 
Security as a Service Model for Cloud Environment
Security as   a Service Model   for   Cloud   EnvironmentSecurity as   a Service Model   for   Cloud   Environment
Security as a Service Model for Cloud EnvironmentKaashivInfoTech Company
 
Infrastructure Security by Sivamurthy Hiremath
Infrastructure Security by Sivamurthy HiremathInfrastructure Security by Sivamurthy Hiremath
Infrastructure Security by Sivamurthy HiremathClubHack
 
Evaluation Of The Data Security Methods In Cloud Computing Environments
Evaluation Of The Data Security Methods In Cloud Computing EnvironmentsEvaluation Of The Data Security Methods In Cloud Computing Environments
Evaluation Of The Data Security Methods In Cloud Computing Environmentsijfcstjournal
 
Cloud Security: A New Perspective
Cloud Security: A New PerspectiveCloud Security: A New Perspective
Cloud Security: A New PerspectiveWen-Pai Lu
 
Cloud Computing Security
Cloud Computing SecurityCloud Computing Security
Cloud Computing SecurityPiyush Mittal
 
Cloud Computing Risk Management (Multi Venue)
Cloud Computing Risk Management (Multi Venue)Cloud Computing Risk Management (Multi Venue)
Cloud Computing Risk Management (Multi Venue)Brian K. Dickard
 
Security issue in cloud by himanshu tiwari
Security issue in cloud by himanshu tiwariSecurity issue in cloud by himanshu tiwari
Security issue in cloud by himanshu tiwaribhanu krishna
 
Cloud Security Guide - Ref Architecture and Gov. Model
Cloud Security Guide -  Ref Architecture and Gov. ModelCloud Security Guide -  Ref Architecture and Gov. Model
Cloud Security Guide - Ref Architecture and Gov. ModelVishal Sharma
 
Sukumar Nayak-Detailed-Cloud Risk Management and Audit
Sukumar Nayak-Detailed-Cloud Risk Management and AuditSukumar Nayak-Detailed-Cloud Risk Management and Audit
Sukumar Nayak-Detailed-Cloud Risk Management and AuditSukumar Nayak
 
Cloud Computing Security Issues
Cloud Computing Security IssuesCloud Computing Security Issues
Cloud Computing Security IssuesStelios Krasadakis
 
Cloud Encounters: Measuring the computing cloud
Cloud Encounters: Measuring the computing cloudCloud Encounters: Measuring the computing cloud
Cloud Encounters: Measuring the computing cloudPeter HJ van Eijk
 
Cloud Computing Risk Management (IIA Webinar)
Cloud Computing Risk Management (IIA Webinar)Cloud Computing Risk Management (IIA Webinar)
Cloud Computing Risk Management (IIA Webinar)Brian K. Dickard
 
Rob kloots auditoutsourcedit
Rob kloots auditoutsourceditRob kloots auditoutsourcedit
Rob kloots auditoutsourceditRobert Kloots
 

What's hot (20)

Chap 6 cloud security
Chap 6 cloud securityChap 6 cloud security
Chap 6 cloud security
 
2012 10 cloud security architecture
2012 10 cloud security architecture2012 10 cloud security architecture
2012 10 cloud security architecture
 
Cloud computing understanding security risk and management
Cloud computing   understanding security risk and managementCloud computing   understanding security risk and management
Cloud computing understanding security risk and management
 
Security Issues of Cloud Computing
Security Issues of Cloud ComputingSecurity Issues of Cloud Computing
Security Issues of Cloud Computing
 
Security as a Service Model for Cloud Environment
Security as   a Service Model   for   Cloud   EnvironmentSecurity as   a Service Model   for   Cloud   Environment
Security as a Service Model for Cloud Environment
 
Infrastructure Security by Sivamurthy Hiremath
Infrastructure Security by Sivamurthy HiremathInfrastructure Security by Sivamurthy Hiremath
Infrastructure Security by Sivamurthy Hiremath
 
Evaluation Of The Data Security Methods In Cloud Computing Environments
Evaluation Of The Data Security Methods In Cloud Computing EnvironmentsEvaluation Of The Data Security Methods In Cloud Computing Environments
Evaluation Of The Data Security Methods In Cloud Computing Environments
 
Cloud Security: A New Perspective
Cloud Security: A New PerspectiveCloud Security: A New Perspective
Cloud Security: A New Perspective
 
Cloud Computing Security
Cloud Computing SecurityCloud Computing Security
Cloud Computing Security
 
Cloud Computing Risk Management (Multi Venue)
Cloud Computing Risk Management (Multi Venue)Cloud Computing Risk Management (Multi Venue)
Cloud Computing Risk Management (Multi Venue)
 
Cloud Security Top 10 Risk Mitigation Techniques for 2019
Cloud Security Top 10 Risk Mitigation Techniques for 2019Cloud Security Top 10 Risk Mitigation Techniques for 2019
Cloud Security Top 10 Risk Mitigation Techniques for 2019
 
Security issue in cloud by himanshu tiwari
Security issue in cloud by himanshu tiwariSecurity issue in cloud by himanshu tiwari
Security issue in cloud by himanshu tiwari
 
Cloud Security Guide - Ref Architecture and Gov. Model
Cloud Security Guide -  Ref Architecture and Gov. ModelCloud Security Guide -  Ref Architecture and Gov. Model
Cloud Security Guide - Ref Architecture and Gov. Model
 
Sukumar Nayak-Detailed-Cloud Risk Management and Audit
Sukumar Nayak-Detailed-Cloud Risk Management and AuditSukumar Nayak-Detailed-Cloud Risk Management and Audit
Sukumar Nayak-Detailed-Cloud Risk Management and Audit
 
Cloud Security Fundamentals Webinar
Cloud Security Fundamentals WebinarCloud Security Fundamentals Webinar
Cloud Security Fundamentals Webinar
 
Cloud Computing Security Issues
Cloud Computing Security IssuesCloud Computing Security Issues
Cloud Computing Security Issues
 
Cloud Encounters: Measuring the computing cloud
Cloud Encounters: Measuring the computing cloudCloud Encounters: Measuring the computing cloud
Cloud Encounters: Measuring the computing cloud
 
Cloud Computing Risk Management (IIA Webinar)
Cloud Computing Risk Management (IIA Webinar)Cloud Computing Risk Management (IIA Webinar)
Cloud Computing Risk Management (IIA Webinar)
 
Rob kloots auditoutsourcedit
Rob kloots auditoutsourceditRob kloots auditoutsourcedit
Rob kloots auditoutsourcedit
 
CSA & GRC Stack
CSA & GRC StackCSA & GRC Stack
CSA & GRC Stack
 

Viewers also liked

Future Prediction: Network Intrusion Detection System in the cloud
Future Prediction: Network Intrusion Detection System in the cloudFuture Prediction: Network Intrusion Detection System in the cloud
Future Prediction: Network Intrusion Detection System in the cloudSedthakit Prasanphanich
 
CLOUD COMPUTING UNIT-5 NOTES
CLOUD COMPUTING UNIT-5 NOTESCLOUD COMPUTING UNIT-5 NOTES
CLOUD COMPUTING UNIT-5 NOTESTushar Dhoot
 
EMC Cloud Management
EMC Cloud ManagementEMC Cloud Management
EMC Cloud ManagementCenk Ersoy
 
Operational Best Practices in the Cloud
Operational Best Practices in the CloudOperational Best Practices in the Cloud
Operational Best Practices in the CloudRightScale
 
NIST 800-30 Intro to Conducting Risk Assessments - Part 1
NIST 800-30 Intro to Conducting Risk Assessments - Part 1NIST 800-30 Intro to Conducting Risk Assessments - Part 1
NIST 800-30 Intro to Conducting Risk Assessments - Part 1Denise Tawwab
 
Integrated Cloud Framework: Security, Governance, Compliance, Content Applica...
Integrated Cloud Framework: Security, Governance, Compliance, Content Applica...Integrated Cloud Framework: Security, Governance, Compliance, Content Applica...
Integrated Cloud Framework: Security, Governance, Compliance, Content Applica...Chad Lawler
 
Cloud service management
Cloud service managementCloud service management
Cloud service managementgaurav jain
 

Viewers also liked (9)

Future Prediction: Network Intrusion Detection System in the cloud
Future Prediction: Network Intrusion Detection System in the cloudFuture Prediction: Network Intrusion Detection System in the cloud
Future Prediction: Network Intrusion Detection System in the cloud
 
CLOUD COMPUTING UNIT-5 NOTES
CLOUD COMPUTING UNIT-5 NOTESCLOUD COMPUTING UNIT-5 NOTES
CLOUD COMPUTING UNIT-5 NOTES
 
EMC Cloud Management
EMC Cloud ManagementEMC Cloud Management
EMC Cloud Management
 
Operational Best Practices in the Cloud
Operational Best Practices in the CloudOperational Best Practices in the Cloud
Operational Best Practices in the Cloud
 
NIST 800-30 Intro to Conducting Risk Assessments - Part 1
NIST 800-30 Intro to Conducting Risk Assessments - Part 1NIST 800-30 Intro to Conducting Risk Assessments - Part 1
NIST 800-30 Intro to Conducting Risk Assessments - Part 1
 
Integrated Cloud Framework: Security, Governance, Compliance, Content Applica...
Integrated Cloud Framework: Security, Governance, Compliance, Content Applica...Integrated Cloud Framework: Security, Governance, Compliance, Content Applica...
Integrated Cloud Framework: Security, Governance, Compliance, Content Applica...
 
CISA Training - Chapter 5 - 2016
CISA Training - Chapter 5 - 2016CISA Training - Chapter 5 - 2016
CISA Training - Chapter 5 - 2016
 
Cloud Reference Model
Cloud Reference ModelCloud Reference Model
Cloud Reference Model
 
Cloud service management
Cloud service managementCloud service management
Cloud service management
 

Similar to CCSK, cloud security framework, Indonesia

CSA Atlanta Chapter Meeting Q1'2013 and RSA Conference 2013 CSA Announcements
CSA Atlanta Chapter Meeting Q1'2013 and RSA Conference 2013 CSA AnnouncementsCSA Atlanta Chapter Meeting Q1'2013 and RSA Conference 2013 CSA Announcements
CSA Atlanta Chapter Meeting Q1'2013 and RSA Conference 2013 CSA AnnouncementsPhil Agcaoili
 
glenn_amblercloud_security_ncc_event_22-may-2012_v1 (9)
glenn_amblercloud_security_ncc_event_22-may-2012_v1 (9)glenn_amblercloud_security_ncc_event_22-may-2012_v1 (9)
glenn_amblercloud_security_ncc_event_22-may-2012_v1 (9)Glenn Ambler
 
Zsl cloud-management-made-easier-with-scm
Zsl cloud-management-made-easier-with-scmZsl cloud-management-made-easier-with-scm
Zsl cloud-management-made-easier-with-scmzslmarketing
 
Cloud Application Rationalization- The Cloud, the Enterprise, and Making the ...
Cloud Application Rationalization- The Cloud, the Enterprise, and Making the ...Cloud Application Rationalization- The Cloud, the Enterprise, and Making the ...
Cloud Application Rationalization- The Cloud, the Enterprise, and Making the ...Chad Lawler
 
Lss implementing cyber security in the cloud, and from the cloud-feb14
Lss implementing cyber security in the cloud, and from the cloud-feb14Lss implementing cyber security in the cloud, and from the cloud-feb14
Lss implementing cyber security in the cloud, and from the cloud-feb14L S Subramanian
 
Effectively and Securely Using the Cloud Computing Paradigm
Effectively and Securely Using the Cloud Computing ParadigmEffectively and Securely Using the Cloud Computing Paradigm
Effectively and Securely Using the Cloud Computing Paradigmfanc1985
 
Presentation on Effectively and Securely Using the Cloud Computing Paradigm v26
Presentation on Effectively and Securely Using the Cloud Computing Paradigm v26Presentation on Effectively and Securely Using the Cloud Computing Paradigm v26
Presentation on Effectively and Securely Using the Cloud Computing Paradigm v26Bill Annibell
 
Presentation On Effectively And Securely Using The Cloud Computing Paradigm V26
Presentation On Effectively And Securely Using The Cloud Computing Paradigm V26Presentation On Effectively And Securely Using The Cloud Computing Paradigm V26
Presentation On Effectively And Securely Using The Cloud Computing Paradigm V26TT L
 
Cloud security Deep Dive 2011
Cloud security Deep Dive 2011Cloud security Deep Dive 2011
Cloud security Deep Dive 2011Kim Jensen
 
Cloud Security Guidance: IBM Recommendations For The Implementation Of Cloud ...
Cloud Security Guidance: IBM Recommendations For The Implementation Of Cloud ...Cloud Security Guidance: IBM Recommendations For The Implementation Of Cloud ...
Cloud Security Guidance: IBM Recommendations For The Implementation Of Cloud ...IBM India Smarter Computing
 
When revenue intelligence meets the cloud
When revenue intelligence meets the cloudWhen revenue intelligence meets the cloud
When revenue intelligence meets the cloudcVidya Networks
 
The Management of Security in Cloud Computing Ramgovind.docx
The Management of Security in Cloud Computing  Ramgovind.docxThe Management of Security in Cloud Computing  Ramgovind.docx
The Management of Security in Cloud Computing Ramgovind.docxcherry686017
 
The Cloud Is Rockin' and Rollin' In
The Cloud Is Rockin' and Rollin' InThe Cloud Is Rockin' and Rollin' In
The Cloud Is Rockin' and Rollin' InKrishnan Subramanian
 
2014 2nd me cloud conference trust in the cloud v01
2014 2nd me cloud conference trust in the cloud v012014 2nd me cloud conference trust in the cloud v01
2014 2nd me cloud conference trust in the cloud v01promediakw
 
Design and implement a new cloud security method based on multi clouds on ope...
Design and implement a new cloud security method based on multi clouds on ope...Design and implement a new cloud security method based on multi clouds on ope...
Design and implement a new cloud security method based on multi clouds on ope...csandit
 
DESIGN AND IMPLEMENT A NEW CLOUD SECURITY METHOD BASED ON MULTI CLOUDS ON OPE...
DESIGN AND IMPLEMENT A NEW CLOUD SECURITY METHOD BASED ON MULTI CLOUDS ON OPE...DESIGN AND IMPLEMENT A NEW CLOUD SECURITY METHOD BASED ON MULTI CLOUDS ON OPE...
DESIGN AND IMPLEMENT A NEW CLOUD SECURITY METHOD BASED ON MULTI CLOUDS ON OPE...cscpconf
 

Similar to CCSK, cloud security framework, Indonesia (20)

CSA Atlanta Chapter Meeting Q1'2013 and RSA Conference 2013 CSA Announcements
CSA Atlanta Chapter Meeting Q1'2013 and RSA Conference 2013 CSA AnnouncementsCSA Atlanta Chapter Meeting Q1'2013 and RSA Conference 2013 CSA Announcements
CSA Atlanta Chapter Meeting Q1'2013 and RSA Conference 2013 CSA Announcements
 
3245224.ppt
3245224.ppt3245224.ppt
3245224.ppt
 
glenn_amblercloud_security_ncc_event_22-may-2012_v1 (9)
glenn_amblercloud_security_ncc_event_22-may-2012_v1 (9)glenn_amblercloud_security_ncc_event_22-may-2012_v1 (9)
glenn_amblercloud_security_ncc_event_22-may-2012_v1 (9)
 
Zsl cloud-management-made-easier-with-scm
Zsl cloud-management-made-easier-with-scmZsl cloud-management-made-easier-with-scm
Zsl cloud-management-made-easier-with-scm
 
Cloud Application Rationalization- The Cloud, the Enterprise, and Making the ...
Cloud Application Rationalization- The Cloud, the Enterprise, and Making the ...Cloud Application Rationalization- The Cloud, the Enterprise, and Making the ...
Cloud Application Rationalization- The Cloud, the Enterprise, and Making the ...
 
Lss implementing cyber security in the cloud, and from the cloud-feb14
Lss implementing cyber security in the cloud, and from the cloud-feb14Lss implementing cyber security in the cloud, and from the cloud-feb14
Lss implementing cyber security in the cloud, and from the cloud-feb14
 
Effectively and Securely Using the Cloud Computing Paradigm
Effectively and Securely Using the Cloud Computing ParadigmEffectively and Securely Using the Cloud Computing Paradigm
Effectively and Securely Using the Cloud Computing Paradigm
 
Presentation on Effectively and Securely Using the Cloud Computing Paradigm v26
Presentation on Effectively and Securely Using the Cloud Computing Paradigm v26Presentation on Effectively and Securely Using the Cloud Computing Paradigm v26
Presentation on Effectively and Securely Using the Cloud Computing Paradigm v26
 
Presentation On Effectively And Securely Using The Cloud Computing Paradigm V26
Presentation On Effectively And Securely Using The Cloud Computing Paradigm V26Presentation On Effectively And Securely Using The Cloud Computing Paradigm V26
Presentation On Effectively And Securely Using The Cloud Computing Paradigm V26
 
Cloud security Deep Dive 2011
Cloud security Deep Dive 2011Cloud security Deep Dive 2011
Cloud security Deep Dive 2011
 
Cloud computing for SMBs
Cloud computing for SMBsCloud computing for SMBs
Cloud computing for SMBs
 
Cloud Security Guidance: IBM Recommendations For The Implementation Of Cloud ...
Cloud Security Guidance: IBM Recommendations For The Implementation Of Cloud ...Cloud Security Guidance: IBM Recommendations For The Implementation Of Cloud ...
Cloud Security Guidance: IBM Recommendations For The Implementation Of Cloud ...
 
Presd1 10
Presd1 10Presd1 10
Presd1 10
 
When revenue intelligence meets the cloud
When revenue intelligence meets the cloudWhen revenue intelligence meets the cloud
When revenue intelligence meets the cloud
 
The Management of Security in Cloud Computing Ramgovind.docx
The Management of Security in Cloud Computing  Ramgovind.docxThe Management of Security in Cloud Computing  Ramgovind.docx
The Management of Security in Cloud Computing Ramgovind.docx
 
The Cloud Is Rockin' and Rollin' In
The Cloud Is Rockin' and Rollin' InThe Cloud Is Rockin' and Rollin' In
The Cloud Is Rockin' and Rollin' In
 
Cloud Computing Security
Cloud Computing SecurityCloud Computing Security
Cloud Computing Security
 
2014 2nd me cloud conference trust in the cloud v01
2014 2nd me cloud conference trust in the cloud v012014 2nd me cloud conference trust in the cloud v01
2014 2nd me cloud conference trust in the cloud v01
 
Design and implement a new cloud security method based on multi clouds on ope...
Design and implement a new cloud security method based on multi clouds on ope...Design and implement a new cloud security method based on multi clouds on ope...
Design and implement a new cloud security method based on multi clouds on ope...
 
DESIGN AND IMPLEMENT A NEW CLOUD SECURITY METHOD BASED ON MULTI CLOUDS ON OPE...
DESIGN AND IMPLEMENT A NEW CLOUD SECURITY METHOD BASED ON MULTI CLOUDS ON OPE...DESIGN AND IMPLEMENT A NEW CLOUD SECURITY METHOD BASED ON MULTI CLOUDS ON OPE...
DESIGN AND IMPLEMENT A NEW CLOUD SECURITY METHOD BASED ON MULTI CLOUDS ON OPE...
 

Recently uploaded

Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Mark Goldstein
 
Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...Farhan Tariq
 
Abdul Kader Baba- Managing Cybersecurity Risks and Compliance Requirements i...
Abdul Kader Baba- Managing Cybersecurity Risks  and Compliance Requirements i...Abdul Kader Baba- Managing Cybersecurity Risks  and Compliance Requirements i...
Abdul Kader Baba- Managing Cybersecurity Risks and Compliance Requirements i...itnewsafrica
 
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)Mark Simos
 
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...Alkin Tezuysal
 
Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)Kaya Weers
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfNeo4j
 
Microservices, Docker deploy and Microservices source code in C#
Microservices, Docker deploy and Microservices source code in C#Microservices, Docker deploy and Microservices source code in C#
Microservices, Docker deploy and Microservices source code in C#Karmanjay Verma
 
Zeshan Sattar- Assessing the skill requirements and industry expectations for...
Zeshan Sattar- Assessing the skill requirements and industry expectations for...Zeshan Sattar- Assessing the skill requirements and industry expectations for...
Zeshan Sattar- Assessing the skill requirements and industry expectations for...itnewsafrica
 
Scale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterScale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterMydbops
 
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS:  6 Ways to Automate Your Data IntegrationBridging Between CAD & GIS:  6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integrationmarketing932765
 
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesMuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesManik S Magar
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPathCommunity
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxLoriGlavin3
 
QCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architecturesQCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architecturesBernd Ruecker
 
Generative AI - Gitex v1Generative AI - Gitex v1.pptx
Generative AI - Gitex v1Generative AI - Gitex v1.pptxGenerative AI - Gitex v1Generative AI - Gitex v1.pptx
Generative AI - Gitex v1Generative AI - Gitex v1.pptxfnnc6jmgwh
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxLoriGlavin3
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfpanagenda
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersNicole Novielli
 
React JS; all concepts. Contains React Features, JSX, functional & Class comp...
React JS; all concepts. Contains React Features, JSX, functional & Class comp...React JS; all concepts. Contains React Features, JSX, functional & Class comp...
React JS; all concepts. Contains React Features, JSX, functional & Class comp...Karmanjay Verma
 

Recently uploaded (20)

Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
 
Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...
 
Abdul Kader Baba- Managing Cybersecurity Risks and Compliance Requirements i...
Abdul Kader Baba- Managing Cybersecurity Risks  and Compliance Requirements i...Abdul Kader Baba- Managing Cybersecurity Risks  and Compliance Requirements i...
Abdul Kader Baba- Managing Cybersecurity Risks and Compliance Requirements i...
 
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
Tampa BSides - The No BS SOC (slides from April 6, 2024 talk)
 
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
Unleashing Real-time Insights with ClickHouse_ Navigating the Landscape in 20...
 
Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)
 
Connecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdfConnecting the Dots for Information Discovery.pdf
Connecting the Dots for Information Discovery.pdf
 
Microservices, Docker deploy and Microservices source code in C#
Microservices, Docker deploy and Microservices source code in C#Microservices, Docker deploy and Microservices source code in C#
Microservices, Docker deploy and Microservices source code in C#
 
Zeshan Sattar- Assessing the skill requirements and industry expectations for...
Zeshan Sattar- Assessing the skill requirements and industry expectations for...Zeshan Sattar- Assessing the skill requirements and industry expectations for...
Zeshan Sattar- Assessing the skill requirements and industry expectations for...
 
Scale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterScale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL Router
 
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS:  6 Ways to Automate Your Data IntegrationBridging Between CAD & GIS:  6 Ways to Automate Your Data Integration
Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integration
 
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotesMuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
MuleSoft Online Meetup Group - B2B Crash Course: Release SparkNotes
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to Hero
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
 
QCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architecturesQCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architectures
 
Generative AI - Gitex v1Generative AI - Gitex v1.pptx
Generative AI - Gitex v1Generative AI - Gitex v1.pptxGenerative AI - Gitex v1Generative AI - Gitex v1.pptx
Generative AI - Gitex v1Generative AI - Gitex v1.pptx
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptx
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software Developers
 
React JS; all concepts. Contains React Features, JSX, functional & Class comp...
React JS; all concepts. Contains React Features, JSX, functional & Class comp...React JS; all concepts. Contains React Features, JSX, functional & Class comp...
React JS; all concepts. Contains React Features, JSX, functional & Class comp...
 

CCSK, cloud security framework, Indonesia

  • 1. Achieving Security Assurance and Compliance in the Cloud Ray Sugiarto, CSA Indonesia Founder, chapter in formation 0815 167 2882 BBM 2142176F Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 2. Cloud: Ushering in “IT Spring” Cloud – a simple idea Compute as a utility Align technology costs with usage Challenges our assumptions about everything  Barriers to market entry in any industry  Organizational structure and business planning  Investment, venture capital, Research & Development  Driving a new macroeconomic reality Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org 
  • 3. The Revolution Has Tinder Social networking, blogging and mircoblogging Egalitarianism of media and communications Mobile computing Empowering the citizens Cloud computing Egalitarianism of IT What can’t this change? Timing is everything Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 4. What is Cloud Computing? Compute as a utility: third major era of computing Cloud enabled by Moore’s Law Hyperconnectivity SOA Provider scale Key characteristics Elastic & on-demand Multi-tenancy Metered service IaaS may track energy costs Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 5. 2011-2014: The Hybrid Enterprise private clouds public clouds Extended Virtual Data Center enterprise Cloud + Mobile Notional boundary organizational Dispersal of applications cloud of users boundary Dispersal of data Dispersal of users Dispersal of endpoint devices 5 Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 6. Cloud Forcing Key Issues Critical mass of separation between data owners and data processors Anonymity of geography of data centers & devices Anonymity of provider Transient provider relationships Physical controls must be replaced by virtual controls Identity management has a key role to play Cloud WILL drive change in the security status quo Reset button for security ecosystem Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 7. What are the Trust Issues? Will my cloud provider be transparent about governance and operational issues? Will I be considered compliant? Do I know where my data is? Will a lack of standards drive unexpected obsolescence? Is my provider really better at security than me? Are the hackers waiting for me in the cloud? Will I get fired? Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 8. Key Problems of Tomorrow Keeping pace with cloud changes Globally incompatible legislation and policy Non-standard Private & Public clouds Lack of continuous Risk Management & Compliance monitoring Incomplete Identity Management implementations Haphazard response to security incidents Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 9. About the Cloud Security Alliance Global, not-for-profit organization Over 23,000 individual members, 100 corporate members, 50 chapters Building best practices and a trusted cloud ecosystem Agile philosophy, rapid development of applied research GRC: Balance compliance with risk management Reference models: build using existing standards Identity: a key foundation of a functioning cloud economy Champion interoperability Enable innovation Advocacy of prudent public policy “To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.” Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 10. HOW DO WE BUILD THE “TRUSTED CLOUD?” Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 11. Here’s How… Strategy Education Security Framework Assessment Build for the Future Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 12. Strategy IT Architecture supporting Hybrid enterprise Federated IdM Service Oriented Architecture “loose coupling” principles Consider cloud as an option to any new IT initiative What are the cost differences? What are the feature/functionality differences? Does the application support different cloud deployments and multiple providers? Risk Management Sensitivity of application and data, new risks introduced by cloud, risk tolerance levels Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 13. EDUCATION • Classes in Feb and May in Indonesia by AdvancedTechpac Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 14. CSA Guidance Research Popular best practices for securing cloud computing Governing the Cloud Flagship research project V2.1 released 12/2009 V3 research underway, targeting Q3 2011 release Operating in the Cloud wiki.cloudsecurityalliance.or g/guidance Guidance > 100k downloads: cloudsecurityalliance.org/guidance Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 15. Guidance Highlights – 1/2 Governance, ERM: Secure the cloud before procurement – contracts, SLAs, architecture Governance, ERM: Know provider’s third parties, BCM/DR, financial viability, employee vetting Legal: Plan for provider termination & return of assets Compliance: Identify data location when possible ILM: Persistence, Protection Portability & Interoperability: SOA “loose coupling” principles Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 16. Guidance Highlights – 2/2 BCM/DR: provider redundancy vs. your own DC Ops: provisioning, patching, logging Encryption: encrypt data when possible, segregate key mgt from cloud provider AppSec: Adapt secure software development lifecycle Virtualization: Harden, rollback, port VM images IdM: Federation & standards e.g. SAML, OpenID Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 17. Certificate of Cloud Security Knowledge (CCSK) Benchmark of cloud security competency Measures mastery of CSA guidance and ENISA cloud risks whitepaper Understand cloud issues Look for the CCSKs at cloud providers, consulting partners Online web-based examination www.cloudsecurityalliance.org/certifyme Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 18. Classes in Indonesia, Jakarta • • First class was done in Nov 20 • New class is targeted for 09 Feb 2012 at Cyber 2 supported by CBN one of the oldest ISPs in Indonesia rd • Planned 3 class is in May 2012 or may be bring forward to April depend on demand • Join us as below for those in Indonesia : • http://www.facebook.com/groups/ccskindonesia/ Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 19. Training Courses CCSK Basic One day course to enable student to pass CCSK CCSK Plus Two day course includes practical cloud lab work GRC Stack Training One day course to use GRC Stack components PCI/DSS In the Cloud Achieving PCI compliance in cloud computing http://cloudsecurityalliance.org/education/training/ Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 20. Upcoming Conferences CSA Summit Korea, Sept. 29, Seoul CSA Summit Europe, Oct. 10, London (with RSA Europe) CSA Congress, Nov. 16-17, Orlando CSA Summit RSA, Feb. 27, 2012, San Francisco SecureCloud 2012 (partnership with ENISA) Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 21. SECURITY FRAMEWORK Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 22. CSA Reference Model CSA Cloud Reference Model IaaS (Compute & storage) is the foundation PaaS (Rapid application dev) adds middleware to IaaS SaaS represents complete applications on top of PaaS Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 23. Cloud Controls Matrix Controls derived from guidance Mapped to familiar frameworks: ISO 27001, COBIT, PCI, HIPAA, FISMA, FedRAMP Rated as applicable to S- P-I Customer vs Provider role Help bridge the “cloud gap” for IT & IT auditors Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 24. ASSESSMENT Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 25. Assessment Responsibility Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 26. Consensus Assessment Initiative Research tools and processes to perform shared assessments of cloud providers Integrated with Controls Matrix Version 1 CAI Questionnaire released Oct 2010, approximately 140 provider questions to identify presence of security controls or practices Use to assess cloud providers today, procurement negotiation, contract inclusion, quantify SLAs www.cloudsecurityalliance.org/cai.html Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 27. CSA STAR Registry CSA STAR (Security, Trust and Assurance Registry) Public Registry of Cloud Provider self assessments Based on Consensus Assessments Initiative Questionnaire Provider may substitute documented Cloud Controls Matrix compliance Voluntary industry action promoting transparency Free market competition to provide quality assessments Provider may elect to provide assessments from third parties Available October 2011 Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 28. BUILD FOR THE FUTURE Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 29. CSA GRC Stack Family of 4 research projects Cloud Controls Matrix Consensus Assessments Initiative Cloud Audit Cloud Trust Protocol Tools for governance, risk and compliance management Private, Community Enabling automation and Control Provider continuous monitoring of Requiremen Assertion ts s GRC Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 30. CloudAudit Open standard and API to automate provider audit assertions Change audit from data gathering to data analysis Necessary to provide audit & assurance at the scale demanded by cloud providers Uses Cloud Controls Matrix as controls namespace Use to instrument cloud for continuous controls monitoring Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 31. Cloud Trust Protocol (CTP) Developed by CSC, transferred to CSA Open standard and API to verify control assertions “Question and Answer” asynchronous protocol, leverages SCAP (Secure Content Automation Protocol) Integrates with Cloud Audit Now we have all the components for continuous controls monitoring Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 32. CloudSIRT Consensus research for emergency response in Cloud Enhance community’s ability to respond to incidents Standardized processes Supplemental best practices for SIRTs Hosted Community of Cloud SIRTs www.cloudsecurityalliance.org/cloudsirt.html Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 33. Trusted Cloud Initiative Comprehensive Cloud Security Reference Architecture Secure & interoperable Identity in the cloud Getting SaaS, PaaS to be “Relying Parties” for corporate directories Scalable federation Outline responsibilities for Identity Providers Assemble reference architectures with existing standards www.cloudsecurityalliance.org/trustedcloud.html Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 34. Reference Model Structure TCI Reference Architecture Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 35. Security as a Service Information Security Industry re-invented Define Security as a Service Articulate solution categories within Security as a Service Guidance for adoption of Security as a Service Align with other CSA research Develop deliverables as a proposed 14th domain within CSA Guidance Version 3. www.cloudsecurityalliance.org/secaas.html Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 36. Data Governance Project Survey of current Cloud Provider data governance practices in the market (e.g. backup, encryption, secure deletion, etc.) Structure based on Domain 5: Information Lifecycle Mgt Project co-sponsored by CSA Silicon Valley and CSA Singapore Target Sept. 2011 Report release Charter and participation info to be posted on CSA website 1st week of August. Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 37. What Might Cloud 2.0 Look Like? Less centralized than you think: cloud brokering, SOA, REST, evade energy costs, grid Regulated – if we don’t do it ourselves Disruptive technologies, e.g. format preserving encryption, new secure hypervisors, Identity Management everywhere New cloud business app models Greater policy harmonization (maritime law?) 4 of 10 biggest IT companies of 2020 do not exist Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 38. Going to the Cloud Securely Challenges remain More tools available than you think Waiting not an option Many types of clouds Identify IT options appropriate for specific cloud Leverage business drivers & risk management Be Agile! Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 39. Contact Help Us Secure Cloud Computing www.cloudsecurityalliance.org info@cloudsecurityalliance.org LinkedIn: www.linkedin.com/groups?gid=1864210 Twitter: @cloudsa Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 40. Training arm for Apccor in Indonesia – organizer of CCSK classes and cloud related events Other certification classes and trainings Need more info call to Rosi, Felicia, Ray +6221 4176 6679 or email to ccsk@advancedtechpac.com Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
  • 41. THANK YOU! Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org