Network Security
Total Page:16
File Type:pdf, Size:1020Kb
RSA: Cloud Security Alliance GRC Stack Update Cloud Security Alliance, Atlanta Chapter Phil Agcaoili, Cox Communications Dennis Hurst, HP March 2011 Cloud Computing NIST Definition • UPDATED (Jan 2011) – National Institute of Standards and Technology (NIST) Special Publication 800-145 (Draft) • Model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) • Rapidly provisioned and released with minimal management effort or service provider interaction • Composed of 5 essential characteristics, 3 service models, and 4 deployment models. • Source: http://www.nist.gov/itl/csd/cloud-020111.cfm Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Computing 5 Essential Characteristics • On-demand tenant self-service model for provisioning computing capabilities (server time, network storage, etc.) • Broad network access with capabilities over the network accessible by standard mechanisms and mobile platforms • Resource pooling through dynamically assigned physical and virtual capabilities delivered in a multi-tenant model and location independent • Rapid elasticity of provisioned resources automatically or manually adjusted aligned with service level flexibility and needs • Measured service to monitor, control and report on transparent resource optimization Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Computing 3 Service Models • Software as a Service (SaaS) • Capability made available to tenant (or consumer) to use provider’s applications running on cloud infrastructure, accessible via web browser, mobile apps, and system interfaces. • Examples: Salesforce.com, Drop Box, Box.net, Google Docs, WebEx • Platform as a Service (PaaS) • Capability made available to tenant to deploy tenant owned (created or acquired) applications using programming languages and tools supported by provider. • Examples: Microsoft Azure, Amazon Web Services, Bungee Connect • Infrastructure as a Service (IaaS) / Datacenter as a Service (DaaS) • Capability made available to tenant to provision processing, storage, networks or other fundamental computing resources to host and run tenant’s applications. • Examples: Rackspace, Terremark (Verizon), Savvis, AT&T Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Computing 4 Deployment Models (1) PRIVATE (2) COMMUNITY (3)PUBLIC Shared with General Public / ACCESSIBILITY Single Organization Common Interests / Large Industry Requirements Group Organization or Organization or MANAGEMENT Cloud Provider Third Party Third Party HOST On or Off Premise On or Off Premise On or Off Premise (4) HYBRID • Composition of 2 or more deployment models that remain unique entities • Bound together by standardized or proprietary technology enabling data and application portability Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Computing Security: Largest Barrier to Adoption Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org What is Different about Cloud? Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org What is Different about Cloud? SERVICE OWNER SaaS PaaS IaaS Data Joint Tenant Tenant Application Joint Joint Tenant Compute Provider Joint Tenant Storage Provider Provider Joint Network Provider Provider Joint Physical Provider Provider Provider Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org What is Different about Cloud? Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Proposal for Atlanta Chapter Objective #1: Cloud Security Contract Template • Vendor and Customer Needs: • A simple, but uniform security contract and questionnaire/checklist • Benefits: • Standard/uniform customer response • Minimizes unique customer requests • Provide basic security attestation and assurance Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org What is Different about Cloud? Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org What is Different about Cloud? Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Controls Matrix Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Controls Matrix Leadership Team • Becky Swain – Cisco Systems, Inc. • Philip Agcaoili – Cox Communications • Marlin Pohlman – EMC, RSA • Kip Boyle – CSA • V1.1 Released Dec 2010 • Rated as applicable to S-P-I with Cloud Provider / Tenant Delineation • Controls baselined and mapped to: • COBIT • HIPAA / HITECH Act • ISO/IEC 27001-2005 • NISTSP800-53 • FedRAMP • PCI DSSv2.0 • BITS Shared Assessments • GAPP Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Controls Matrix Global Industry Contribution • AdalbertoAfonso A Navarro F do Valle – Deloitte LLP • Kyle Lai – KLC Consulting, Inc. • Addison Lawrence – Dell • Larry Harvey – Cisco Systems, Inc. • Akira Shibata – NTT DATA Corp • Laura Kuiper – Cisco Systems, Inc. • Andy Dancer • Lisa Peterson – Progressive Insurance • Anna Tang – Cisco Systems, Inc. • Lloyd Wilkerson – Robert Half International • April Battle – MITRE • Marcelo Gonzalez – Banco Central Republica Argentina • ChandrasekarUmpathy • Mark Lobel – PricewaterhouseCoopers LLP • Chris Brenton – Dell • Meenu Gupta – Mittal Technologies • Dale Pound – SAIC • Mike Craigue, Ph.D. – Dell • Daniel Philpott – Tantus Technologies • MS Prasad, Exec Dir CSA India • Dr. Anton Chuvakin – Security Warrior Consulting • Niall BrowneI – LiveOps • Elizabeth Ann Wickham – L47 Consulting Limited • Patrick Sullivan • Gary Sheehan – Advanced Server Mgmt Group, Inc. • Patty Williams – Symetra Financial • Georg Heß • Paul Stephen – Ernst and Young LLP • Georges Ataya Solvay – Brussels School of Economics & Mgmt • Phil Genever-Watling - Dell • Glen Jones – Cisco Systems, Inc. • Philip Richardson – Logicalis UK Ltd • Greg Zimmerman – Jefferson Wells • PritamBankar – Infosys Technologies Ltd. • Guy Bejerano - LivePerson • RamesanRamani – Paramount Computer Systems • Henry Ojo – Kamhen Services Ltd, • Steve Primost • Jakob Holm Hansen – Neupart A/S • TaiyeLambo – eFortresses, Inc . • Joel Cort – Xerox Corporation • Tajeshwar Singh • John DiMaria – HISPI • Thej Mehta – KPMG LLP • John Sapp – McKesson Healthcare, HISPI • Thomas Loczewski – Ernst and Young GmbH, Germany • Joshua Schmidt – Vertafore, Inc. • Vincent Samuel – KPMG LLP • KarthikAmrutesh – Ernst and Young LLP • Yves Le Roux – CA Technologies • Kelvin Arcelay – Arcelay& Associates • HISPI membership (Release ISO Review Body) Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Controls Matrix Characteristics • Objective measure to monitor activities and then take corrective action to accomplish organizational goals. • Comprised of a set of policies and processes (internal controls) affecting the way Cloud services are directed, administered or controlled. • Aligned to Information Security regulatory rules and industry accepted guidance. • Controls reflect the intent of the CSA Guidance as applied to existing patterns of Cloud execution. Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Controls Matrix Optimal & Holistic Compliance Bridging Regulatory Governance And Practical Compliance Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Controls Matrix 11 Domains 1. Compliance (CO) 7. Operations Management (OM) 2. Data Governance (DG) 8. Risk Management (RI) 3. Facility Security (FS) 9. Release Management (RM) 4. Human Resources (HR) 10. Resiliency (RS) 5. Information Security (IS) 11.Security Architecture (SA) 6. Legal (LG) Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Controls Matrix 98 Controls Compliance Legal • CO01 – Audit Planning • LG01 - Non-Disclosure Agreements • CO02 – Independent Audits • LG02 - Third Party Agreements • CO03 – Third Party Audits • CO04 – Contact / Authority Maintenance • CO05 – Information System Regulatory Mapping • CO06 – Intellectual Property Data Governance • DG01 – Ownership / Stewardship Risk Management • DG02 – Classification • RI01 – Program • DG03 – Handling / Labeling / Security Policy • RI02 – Assessments • DG04 – Retention Policy • RI03 – Mitigation / Acceptance • DG05 – Secure Disposal • RI04 – Business / Policy Change Impacts • DG06 – Non-Production Data • RI05 – Third Party Access • DG07 – Information Leakage • DG08 – Risk Assessments Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Controls Matrix 98 Controls (cont.) Human Resources Resiliency • HR01 – Background Screening • RS01 – Management Program • HR02 – Employment Agreements • RS02 – Impact Analysis • HR03 – Employment Termination • RS03 – Business Continuity Planning • RS04 – Business Continuity Testing • RS05 – Environmental Risks • RS06 – Equipment Location Release Management • RS07 – Equipment Power Failures • RM01 – New Development / Acquisition • RS08 – Power / Telecommunications • RM02 – Production Changes • RM03 – Quality Testing Operational Management • RM04 – Outsourced Development • OP01 – Policy • RM05 – Unauthorized Software Installations • OP02 – Documentation • OP03 – Capacity / Resource Planning • OP04 – Equipment Maintenance Copyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org Cloud Controls Matrix 98 Controls (cont.) Security Architecture • SA01 – Customer Access Requirements • SA02 – User ID Credentials Facility Security • SA03 – Data Security