Cloud security

Click to edit Master title style

CLOUD COMPUTING SECURITY

6/5/2011

Alexandra Instituttet

Click to edit Master title style

CLOUD COMPUTINGSECURITY

Alexandra Institute

Click to edit Master title styleWhat Is Cloud Computing?Cloud collection of services• Infrastructure• Compute• Network• Storage resources

• Applications• Information

These components can be rapidly• Orchestrated• provisioned• implemented • Decommissioned• scaled up or down

on-demand utility• like model of allocation and consumption

Click to edit Master title styleCloud Benefits

• ROI• Focus on core• Improving financial performance• Clear IT budgeting

• IT Chargeback • Responsibility Accounting

Operational efficiency

• Time to Market improvement• Agility• Return on Engagement

Revenue growth

• Innovation in Assembly• Externalization of core capabilities• Business Leverage of new technologies

Organization's business transformation The Cloud-Tail

Click to edit Master title styleB2B Scenario

Supply chain • Enables smaller Investment in various

organizations, and using supply chain as a service• Different business use a common supply chain,

allowing implementation of• tracking• measuring• planning

Products Recall Service • This service allows to production companies and

networks to cooperate in the case of an event that requires the return of product from the shelves.

• The service is on Cloud Computing Platform For Manufacturing of GS1 and HP Canada.

ROI

improved financial performance

dispersing the mist around the IT budgeting

improving the Time To Market Agility

Innovation in Assembly

Click to edit Master title style

return on investment

improved financial performance

Externalization of core capability

improving the Time To Market

Agility

Improving Return On Engagement

Innovation in Assembly

Provision of services• Provision of services in the cloud

community related organization• Distributors, agents, customers and

service providers etc.

CRM• Strengthen ties with those elements that

are channel customer care• Improves customer service and

streamlines the supply chain "from the client, through the distributor organization

B2B2C Scenario (Business to Business to Customer)

Click to edit Master title style

Mashup • Third party organization combine services

from organization A and organization B and generates a third cloud service that has a new business potential.

Examples• The cooperation between Facebook to

Amazon, which Facebook Applications swarming on Amazon's EC2 infrastructure

• Appirio company's application, installed as a Facebook Application and author of the Facebook for Salesforce.com.

Innovation In Assembly Scenario

Improving Return On Engagement

Innovation In Assembly

improved financial performance

dispersing the mist around the IT budgeting

Agility

business leveraging of new technologies innovation

Improving time to market

Externalization of core capability

Click to edit Master title style

CLOUD COMPUTING

Elasticity Evolution

Operations Evolution

Sourcing Evolution

Cloud Computing Evolution

Click to edit Master title styleCloud Service Models

http://www.katescomment.com/iaas-paas-saas-definition/

Click to edit Master title styleMulti-Tenancy

Multi-Tenancy• Refers to a situation in which one

program, need to serve at the same time the number of consumer organizations (Tenants)

separation• Solution that supports Multi-Tenancy,

capable of creating separation between the different Tenants

Chinese walls• The barrier Principles are essential to

create "Chinese walls" between different service consumers in sharing infrastructure and resources

CLOUD COMPUTINGAlexandra Institute

SECURITY

Click to edit Master title style14 Specific Cloud Computing Security Challenges*1. Migrating PII & sensitive data to the cloud

EU Data Protection Directive & U.S. Safe Harbor program Exposure of data to foreign government & data Subpoenas Data retention & records management issues Privacy Impact Assessments (PIA)

2. Identity & Access Management3. Multi-tenancy4. Logging & Monitoring5. Data ownership /custodianship6. Quality of Service guarantees7. Securing hypervisors (Blue Pill)

*Cloud Computing An insight in the Governance & Security aspects\Marc Vael

Click to edit Master title style14 Specific Cloud Computing Security Challenges*8. Attracting hackers (high value target)9. Security of virtual OS in the cloud10.BCP / DRP11. Data encryption & key management

Encrypting access to cloud resource control interface Encrypting administrative access to OS instances Encrypting access to applications Encrypting application data at rest

12.Public cloud vs. Internal cloud security13.Lack of public SaaS version control14.14.Using SLAs to obtain cloud security

Suggested requirements for cloud SLAs Issues with cloud forensics & e-discovery

*Cloud Computing An insight in the Governance & Security aspects\Marc Vael

Click to edit Master title style

How Security Gets Integrated

Domain 2 Governance

and Enterprise

Risk Management

Domain 2 Governance

and Enterprise

Risk Management

Domain 4 Compliance and Audit

Domain 5 Information

Lifecycle Management

Domain 6 Portability

and Interoperability

Domain 6 Portability

and Interoperability

Domain 10Application

Security

Domain 6 Portability

and Interoperability

Domain 8 Data Center Operations

Domain3Legal and Electronic Discovery

Domain 7Traditional Security,

Business Continuity, and

Disaster Recovery

Domain 7Traditional Security,

Business Continuity, and

Disaster Recovery

Domain 9Incident Response,

Notification, and Remediation

Domain 11 Encryption and

Key Management

Domain 11 Encryption and Key

Management

Domain 12 Identity and Access

Management

Domain 12 Identity and

Access Management

Domain 13 Virtualization

Click to edit Master title styleFor more information go to Alexandra.dk/CCSK