Healthcare: La sicurezza nel Cloud October 18, IBM Corporation

Transcription

1 Healthcare: La sicurezza nel Cloud October 18, 2011

2 Cloud Computing Tests The Limits Of Security Operations And Infrastructure Security and Privacy Domains People and Identity Data and Information Application and Process Network, Server and Endpoint Physical Infrastructure Governance, Risk and Compliance Self-Service Highly Virtualized Location Independence Workload Automation Rapid Elasticity Standardization To cloud Multiple Logins, Onboarding Issues Multi-tenancy, Data Separation External Facing, Quick Provisioning Virtualization, Network Isolation Provider Controlled, Lack of Visibility Audit Silos, Compliance Controls In a cloud environment, access expands, responsibilities change, control shifts, and the speed of provisioning resources and applications increases - greatly affecting all aspects of IT security. 2

3 Different cloud deployment models also change the way we think about security Private cloud Hybrid IT Public cloud Changes in Security and Privacy Customer responsibility for infrastructure More customization of security controls Good visibility into day-to-day operations Easy to access to logs and policies Applications and data remain inside the firewall Provider responsibility for infrastructure Less customization of security controls No visibility into day-to-day operations Difficult to access to logs and policies Applications and data are publically exposed 3

4 Critical Risks Areas in Cloud Computing Challenges with an increase in potential unauthorized exposure when migrating workloads to a shared network and compute infrastructure Data Security Where the information is located and stored, who has access rights, how access is monitored & managed, including resiliency Less Control Security Management Control needed to manage firewall and security settings for applications and runtime environments in the cloud Compliance Reliability Restrictions imposed by industry regulations over the use of clouds for some applications Risks across private, public and hybrid cloud delivery models Concerns with high availability and loss of service should outages occur

5 Three Phase Approach Design Deploy Consume Establish a cloud strategy and implementation plan to get there. Build cloud services, in the enterprise and/or as a cloud services provider. Manage and optimize consumption of cloud services. IBM Cloud Security Approach Secure by Design Focus on building security into the fabric of the cloud. Workload Driven Secure cloud resources with innovative features and products. Service Enabled Govern the cloud through ongoing security operations and workflow. Example security capabilities Cloud security roadmap Secure development Network threat protection Server security Database security Application security Virtualization security Endpoint protection Configuration and patch management Identity and access management Secure cloud communications Managed security services 5

6 Cloud Service Model Suggests Split ofresponsibilities between Provider and Subscriber Employee Benefits Mgmt. Industry-specific Business Travel Processes Procurement Business Process-as-a-Service Who is responsible for security at the level? Datacenter Infrastructure Middleware Application Process Provider Subscriber Collaboration CRM/ERP/HR Financials Industry Applications Application-as-a-Service Provider Subscriber Middleware Web 2.0 Application Runtime Java Runtime Database Development Tooling Platform-as-a-Service Provider Subscriber Data Center Servers Networking Storage Fabric Shared virtualized, dynamic provisioning Infrastructure-as-a-Service Provider Subscriber Provider/Subscriber service agreement determines actual responsibilities.

7 Each pattern has its own set of key security concerns Infrastructure as a Service (IaaS): Cut IT expense and complexity through cloud data centers Platform-as-a-Service (PaaS): Accelerate time to market with cloud platform services Innovate business models by becoming a cloud service provider Software as a Service (SaaS): Gain immediate access with business solutions on cloud Cloud Enabled Data Center Cloud Platform Services Cloud Service Provider Business Solutions on Cloud Integrated service management, automation, provisioning, self service Pre-built, pre-integrated IT infrastructures tuned to application-specific needs Advanced platform for creating, managing, and monetizing cloud services Capabilities provided to consumers for using a provider s applications Key security focus: Infrastructure and Identity Key security focus: Applications and Data Key security focus: Data and Compliance Key security focus: Compliance and Governance Manage datacenter identities Secure virtual machines Patch default images Monitor logs on all resources Network isolation Secure shared databases Encrypt private information Build secure applications Keep an audit trail Integrate existing security Isolate cloud tenants Policy and regulations Manage security operations Build compliant data centers Offer backup and resiliency Harden exposed applications Securely federate identity Deploy access controls Encrypt communications Manage application policies 7

8 Different workloads require different security controls in the Cloud Simple migration of the Cloud Analytics Infrastructure storage Industry applications Collaboration Workplace, Desktop and devices Business processes Disaster recovery Development & Test Infrastructure Compute New Business Model Collaborative health care Medical imaging Financial risk Energy Management Analysis of individual requirements Sensitive data Highly customized data Not yet virtualized software Legal restrictions Complex processes and transactions Regulation intensive systems Mature workload Isolated workload Preproduction systems Batch processing systems There is no single product or service for Cloud Security 8

9 An IBM Customer Example Secure data access to healthcare applications and data. American Hospital Business challenge Inability to provision physicians, nurses, and other staffmembers to appropriately entitled applications in a secure and timely manner. Key security requirements Cross Clinics Identity Management Outsourcing Identity and Access Management burden 9

10 Where to start? 03.ibm.com/press/us/en/attachment/32799.wss?fileId=ATTACH_FILE1&fil ename= _us%20cloud%20computing%20white%20paper_final_lr.pdf 10

11 11

12 Entry points to get started with IBM security solutions for cloud Design Deploy Consume GRC Understand the concerns of your unique cloud initiative IBM Cloud Security Roadmap Service Identity Enable single sign on across multiple cloud services IBM Tivoli Federated Identity Manager Business GW Data Protect and monitor access to shared databases IBM InfoSphere Guardium Intrusion Defend users and apps from network attacks IBM Security Network Intrusion Prevention System Virtualization Protect VMs and hypervisor from advanced threats IBM Virtual Server Protection for VMware Patch Management Provide patch and config management of VMs IBM Tivoli Endpoint Manager for Security and Compliance Cloud Security On Ramps IBM Security Framework 12