Cloud security and adoption

Cloud Security Issues and Cloud Security Issues and Cloud Security Issues and Cloud Security Issues and Adoption Guideline for Thai Adoption Guideline for Thai Adoption Guideline for Thai Adoption Guideline for Thai Government AgenciesGovernment AgenciesGovernment AgenciesGovernment Agencies

July 26, 2016

Dr. Sudsanguan Ngamsuriyaroj

Faculty of ICT, Mahidol University

About Me� Assistant Professor

Faculty of ICT, Mahidol University

� Teaching

Parallel computing, Cloud computing

Security

Computer Ethics

� Research

Security (network, cloud, database)

Parallel computing

Healthcare applications

SIPA TECHNOLOGY MEETUP 2016 - HIGH PERFORMANCE COMPUTING TRENDS AND TECHNOLOGY 2

sudsanguan.nga@mahidol.ac.th

AgendaCloud Adoption

General Security Concepts

Cloud Security Model

Cloud Security Issues

3SIPA TECHNOLOGY MEETUP 2016 - HIGH PERFORMANCE COMPUTING TRENDS AND TECHNOLOGY

Cloud Adoptionfrom Data Center to Cloud

http://www.stratoscale.com/blog/cloud/the-journey-from-virtualization-to-cloud-computing/

SIPA TECHNOLOGY MEETUP 2016 - HIGH PERFORMANCE COMPUTING TRENDS AND TECHNOLOGY

Cloud Adoption – Why?

Cloud Adoption – Why?Cost Reduction

http://www.opengroup.org/cloud/whitepapers/ccroi/roi.htm

Are you ready for Cloud?Which applications will be moved to cloud

Readiness of existing infrastructure

Development of IT personnel (infrastructure and developers)

How to migrate to cloud◦ Which cloud model/platform (public, private, hybrid) to use

Budget / ROI

Application users

Schedule to deliver products/services

Categories of Applications

1. Public applications: for everyone: web sites

2. External based applications: for customers/ partners

3. Internal based applications: for staff only - emails

4. Private applications: for administration: ERP, HR

Which applications will be moved to Cloud

�Network infrastructure

�System infrastructure

�Application platforms

�BCP – Business Continuity Plan

�Infrastructure Maintenance

�Audit process

Readiness of Existing Infrastructure

� Physical / Logical network diagram (latest update?)

� All existing equipment and their capacity

� Report of network usage◦ Bandwidth enough?

◦ Any usage abuse?

� What links needed to be updated

Readiness of Existing Infrastructure:Network Ready?

�List of all servers and the applications running

�List of all servers no longer used

�How long a server will be used

�Is there any maintenance?

�What workload running and how much the utilization is?

�If there is a new server, a plan to use VM ?

Readiness of Existing Infrastructure:System Ready?

Workload Forecasted

http://www.americanis.net/2013/shift-your-risk-in-the-cloud/

Workload Analysis

What would be Barriers?

�Data security and privacy

�People with effective skills

�Different cloud service providers and platforms

�Vendor lock-in

�Cloud providers’ reliability and availability

�Risks

http://www.slideshare.net/ISS-NUS/security-in-smart-city-implementation-infrastructure-and-people

General Security Concept

http://www.slideshare.net/dr_edw777/chapter-1-overview-11741038

NIST Reference Architecture

Source: NIST Special Publication 500-292, NIST Cloud Computing Reference Architecture

Cloud Security Model

http://www.softwaretestpro.com/ItemAssets/5590/Fig4.jpg

1. Data breaches/ leaks

2. Data loss

3. Account or service traffic hijacking

4. Insecure interfaces and APIs

5. Denial of services

6. Malicious Insiders

7. Cloud abuse

8. Insufficient due diligence

9. Shared technology vulnerabilities

CSA Notorious 9 CSA Notorious 9 CSA Notorious 9 CSA Notorious 9 Cloud Top Threats in 2013

https://downloads.cloudsecurityalliance.org/initiatives/top_

threats/The_Notorious_Nine_Cloud_Computing_Top_Threats_in_2013.pdf

CSA Treacherous CSA Treacherous CSA Treacherous CSA Treacherous 12 12 12 12 Cloud Top Threats in 2016

1. Data Breaches

2. Weak Identity, Credential and Access Management

3. Insecure APIs

4. System and Application Vulnerabilities

5. Account Hijacking

6. Malicious Insiders

7. Advanced Persistent Threats (APTs)

8. Data Loss

9. Insufficient Due Diligence

10.Abuse and Nefarious Use of Cloud Services

11.Denial of Service

12.Shared Technology Issues

https://cloudsecurityalliance.org/download/the-treacherous-twelve-cloud-computing-top-threats-in-2016/

Data BreachesWorld's Biggest Data BreachesSelected losses greater than 30,000 records (updated 11th July 2016)

http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

Data Loss

http://www.theregister.co.uk

/2016/05/13/salesforcecom_crash_caused_data_loss/

http://www.computerworld.com/a

rticle/2973600/cloud-

computing/google-cloud-loses-data-belgium-itbwcw.html

Data Security on Cloud

How to protect your data from being observed?

�Data Encryption

what about KEY? and Key Management?

encryption algorithm?

How about “homomorphic encryption”?

�Data Masking for Sensitive data like bank accounts

maintain a mapping between real and masked data

Data Life Cycle

https://securosis.com/tag/data+security+lifecycle

Cloud Threats and Vulnerabilities

Adopted from “Realizing the Benefits of Vulnerability Management in the Cloud” by Gordon MacKay, CTO, Digital Defense, Inc.

https://www.eitdigital.eu/fileadmin/files/docs/documents_helsinki/TheoDimitrakos-EIT_ICT_Labs_Symposium_on_Trusted_Cloud_and_Future_Enterprises-email-no-demo.pdf

Q&AThank you

SIPA TECHNOLOGY MEETUP 2016 - HIGH PERFORMANCE COMPUTING TRENDS AND TECHNOLOGY 29

Cloud security and adoption

Technology

Cloud Security: Focusing on Automation and Thwarting APTs · 2014-11-26 · Global Compliance, Cloud Adoption, Big Data, Data Breaches . CLOUD ADOPTION . Enterprise Security #1 Inhibitor

IT Attestation in the Cloud Era - Infocom Security · Security has been the greatest concern surrounding Cloud Adoption at enterprises ... Cloud Outsourced Data Center Proprietary,

Cloud Security – 2016 Spotlight Report - CloudPassage · PDF fileCLOUD SECURITY SPOTLIGHT REPORT TABLE OF CONTENTS Overview Key survey findings CLOUD ADOPTION TRENDS Cloud benefits

Enterprise Cloud Stakeholders Speak: Adoption Patterns, Barriers & Post-Adoption 'Cloud Sentiment

1 Security and Legal Issues in Cloud Adoption John Nicholson Strategic Negotiator, Infosys President, DC Chapter, Cloud Security Alliance

Investigating the Security Factors in Cloud Computing Adoption…infonomics-society.org/wp-content/uploads/jitst/published-papers/... · Investigating the Security Factors in Cloud

Corralling Shadow IT & Enabling Secure Adoption …...Corralling Shadow IT & Enabling Secure Adoption of Cloud Services Featuring: Andy Radle Cloud Security Architect – HP Harold

Best Practices for Security in Cloud Adoption by …teammicrosoftindia.com/images/2016/datacenter/Best...Best Practices for Security in Cloud Adoption by Indian Banks A White Paper

Simplifying Security for Cloud Adoption - Defining your game plan

Cloud SeCuritY - AlienVault SECURITY SPOTLIGHT REPORT tABLe oF CoNteNtS Overview Key survey findings CLoud AdoptioN tReNdS Cloud adoption Public …

The Evolving Security Landscape€¦ · Cloud Security Cloud computing adoption is < 1% of organizations h Security and compliance issues Top concerns of cloud computing: h Service

Cloud SeCuritY - CloudPassage · CLOUD SECURITY SPOTLIGHT REPORT tABLe oF CoNteNtS Overview Key survey findings CLoud AdoptioN tReNdS Cloud adoption Public cloud usage ... 12% public

Security Perspective of the AWS Cloud Adoption Framework

Best Practices for Security in Cloud Adoption by Indian Banksdownload.microsoft.com/download/5/0/3/5032D430-D8F... · Best Practices for Security in Cloud Adoption by Indian Banks

2018 CLOUD SECURITY REPORT · 2018 CLOU ECURIT EPORT 3 Cloud security concerns – While adoption of cloud computing continues to surge, security concerns are showing no signs of

Cloud security: Accelerating cloud adoption

Growing businesses safely: cloud adoption vs security concerns · infrastructure, the people involved in managing IT security and their adoption of cloud tools and services. Throughout

Cloud Security services and mechanisms · 2019-10-25 · • Introduction: Cloud adoption is growing • Shared Responsibility Security Model in Cloud • Case Study: AWS Security

Preparing for the Convergence of Healthcare, SOA, and ...€¦ · cloud adoption – Concerns about data security and HIPAA regulations remain deterrents to wide-spread cloud adoption

Cloud Security Services and Mechanismsuazone.org/demch//presentations/cci2020-cloud-security...Outline • Introduction: Cloud adoption is growing • Shared Responsibility Security