1 John Essner, CISO Office of Information Technology State of New Jersey
3 Governance Compliance Trust Architecture Identity and Access Management Software Isolation Data Protection Availability Incident Response Recommendations
4 Governance implies control and oversight. Policies, procedures, and standards. Asset Classification. Application development and information technology service acquisition. Design, implementation, testing, use, and monitoring of deployed or engaged services. Audit mechanisms and tools to ensure organizational practices.
5 Compliance refers to an organization s responsibility. Operate in agreement with established laws, regulations, standards, and specifications. Security Requirements ISO HIPAA FISMA Payment Card Industry (PCI) State of NJ - Service Contract Requirements for the Performance of Service Contracts within the United States
6 Data Location - when information crosses borders, the governing legal, privacy, and regulatory regimes can be ambiguous and raise a variety of concerns. Electronic Discovery - involves the identification, collection, processing, analysis, and production of Electronically Stored Information (ESI) in the discovery phase of litigation.
7 Relinquishes direct control over many aspects of security and privacy. High level of trust onto the cloud provider. Responsibility to protect information and information systems. The risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction. Ensure that service arrangements have sufficient means to allow visibility into the security and privacy controls and processes.
8 Data Ownership - the organization s ownership rights over the data must be firmly established in the service contract to enable a basis for trust and privacy of data. Third Party - cloud services that use third- party cloud providers to outsource or subcontract some of their services should raise concerns, including the scope of control over the third party. Visibility - continuous monitoring of information security requires maintaining ongoing awareness of security controls, vulnerabilities, and threats to support risk management decisions.
9 Ancillary Data - while the focus of attention in cloud computing is mainly on protecting application data, cloud providers also hold significant details about the accounts of cloud consumers that could be compromised and used in subsequent attacks. Risk Management - is the process of identifying and assessing risk to organizational operations, organizational assets, or individuals resulting from the operation of an information system, and taking the necessary steps to reduce it to an acceptable level
10 The software and hardware used to deliver cloud services can vary significantly among cloud providers for any specific service model. The physical location of the infrastructure is determined by the cloud provider. The design and implementation of the reliability, resource pooling, scalability, and other logic needed in the support framework.
11 Attack Surface - the hypervisor or virtual machine monitor is an additional layer of software between an operating system and hardware platform that is used to operate multi-tenant virtual machines and is common to IaaS clouds. Virtual Network Protection. Most virtualization platforms have the ability to create softwarebased switches and network configurations as part of the virtual environment.
12 Virtual Machine Images - IaaS cloud providers and manufacturers of virtual machine products maintain repositories of virtual machine images. Client-Side Protection - a successful defense against attacks requires securing both the client and server side of cloud computing.
13 Safeguards are in place to secure authentication, authorization, and other identity and access management functions. An organizational identification and authentication may not naturally extend into a public cloud. Identity federation allows the organization and cloud provider to trust and share digital identities and attributes across both domains.
14 Authentication - is the process of establishing confidence in user identities. Assurance levels should be appropriate for the sensitivity of the application and information assets accessed and the risk involved. Authorization is the process to control role definition, user authorization, and other administrative tasks related to security. Access controls - are one means to keep data away from unauthorized users; encryption is another. Access controls are typically identitybased, which makes authentication of the user s identity an important issue in cloud computing.
15 Multi-tenancy - High degrees of multitenancy over large numbers of platforms are needed for cloud computing to achieve the envisioned flexibility of on-demand provisioning of reliable services and the cost benefits and efficiencies due to economies of scale. Attack Vectors - multi-tenancy in virtual machine-based cloud infrastructures, together with the subtleties in the way physical resources are shared between guest virtual machines, can give rise to new sources of threat
16 Shared environment - Data stored in a public cloud typically resides in a shared environment collocated with data from other customers. Sensitive and regulated Organizations must account for the means by which access to the data is controlled and the data is kept secure. Data controls - Data must be secured while at rest, in transit, and in use, and access to the data must be controlled.
17 Data Sanitization - the data sanitization practices that a cloud provider implements have obvious implications for security. Sanitization involves the expunging of data from storage media by overwriting, degaussing, or other means, or the destruction of the media itself, to prevent unauthorized disclosure of information.
18 In simple terms, availability is the extent to which an organization s full set of computational resources is accessible and usable. Availability can be affected temporarily or permanently, and a loss can be partial or complete. Data Backup and Recovery - the organization s contingency and continuity planning should address the recovery and restoration of disrupted cloud services and operations, using alternate services, equipment, and locations.
19 Involves an organized method for dealing with the consequences of an attack against the security of a computer system. Incident Response Plan the cloud provider s role is vital in performing incident response activities, including incident verification, attack analysis, containment, data collection and preservation, problem remediation, and service restoration.
20 Trust requires a carefully execute service agreement. It should include everything that has been covered this morning. Have it reviewed by your Information Technology Department and legal counsel. Have these discussions with IT at the table. If you don t have an IT department? Hire a Technology Consultant to ensure all areas are covered and that you are protecting your agency.
21 Identify security, privacy, and other requirements for cloud services. Common security requirements include coverage for the following areas: Personnel requirements, including clearances, roles, and responsibilities Regulatory requirements Service availability Problem reporting, review, and resolution Information handling and disclosure agreements and procedures
22 Physical and logical access controls Network access control, connectivity, and filtering Data protection System configuration and patch management Backup and recovery Data retention and sanitization Security and vulnerability scanning Risk management Incident reporting, handling, and response Continuity of operations Resource management Certification and accreditation Assurance levels Independent auditing of services
23 NIST SP Guidelines on Security and Privacy in Public Cloud Computing Federal Risk and Authorization Management Program (FedRAMP) Cloud Security Alliance https://cloudsecurityalliance.org/ NJINFOSECURE
ITL BULLETIN FOR JUNE 2012 CLOUD COMPUTING: A REVIEW OF FEATURES, BENEFITS, AND RISKS, AND RECOMMENDATIONS FOR SECURE, EFFICIENT IMPLEMENTATIONS Shirley Radack, Editor Computer Security Division Information
Creating Effective Cloud Computing Contracts for the Federal Government Best Practices for Acquiring IT as a Service A joint publication of the In coordination with the Federal Cloud Compliance Committee
GOVERNANCE STRATEGIES New Requirements for Security and Compliance Auditing in the Cloud Cloud computing poses new challenges for IT security, compliance, and audit professionals who must protect corporate
International Telecommunication Union ITU-T X.1601 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (01/2014) SERIES X: DATA NETWORKS, OPEN SSTEM COMMUNICATIONS AND SECURIT Cloud computing Overview of cloud
GPO Box 2343 Adelaide SA 5001 Tel (+61 8) 8204 8773 Fax (+61 8) 8204 8777 DX:336 email@example.com www.archives.sa.gov.au Cloud Computing and Records Management June 2015 Version 1 Version
Cloud Service Level Agreement Standardisation Guidelines Brussels 24/06/2014 1 Table of Contents Preamble... 4 1. Principles for the development of Service Level Agreement Standards for Cloud Computing...
2014 Australian Government Information Security Manual CONTROLS 2014 Australian Government Information Security Manual CONTROLS Commonwealth of Australia 2014 All material presented in this publication
Data Protection Act 1998 Guidance on the use of cloud computing Contents Overview... 2 Introduction... 2 What is cloud computing?... 3 Definitions... 3 Deployment models... 4 Service models... 5 Layered
A COALFIRE PERSPECTIVE Top 10 Risks in the Cloud by Balaji Palanisamy, VCP, QSA, Coalfire March 2012 DALLAS DENVER LOS ANGELES NEW YORK SEATTLE Introduction Business leaders today face a complex risk question
CPNI VIEWPOINT 01/2010 CLOUD COMPUTING MARCH 2010 Acknowledgements This viewpoint is based upon a research document compiled on behalf of CPNI by Deloitte. The findings presented here have been subjected
Cloud Computing: Implications and Guidelines for Records Management in Kentucky State Government (Version 1.0 August 2012) Many information technology (IT) departments and resource allocators are considering
This article was originally published in the November 2010 issue of the Intellectual Property & Technology Law Journal. ARTICLE Insights into Cloud Computing The basic point of cloud computing is to avoid
2013 HIPAA/HITECH AMENDMENTS: HOW THE CHANGES IMPACT THE ediscovery PROCESS Brian Brown Danny Tijerina RenewData, an LDiscovery Company Austin, TX Introduction Maintaining compliance with government regulations
Checklist to Assess Security in IT Contracts Federal Agencies that outsource or contract IT services or solutions must determine if security is adequate in existing and new contracts. Executive Summary
Securing Microsoft s Cloud Infrastructure This paper introduces the reader to the Online Services Security and Compliance team, a part of the Global Foundation Services division who manages security for
Standard: Version: 2.0 Date: June 2011 Author: PCI Data Security Standard (PCI DSS) Virtualization Special Interest Group PCI Security Standards Council Information Supplement: PCI DSS Virtualization Guidelines
Security Officer s Checklist in a Sourcing Deal Guide Share Europe Ostend, May 9th 2014 Johan Van Mengsel IBM Distinguished IT Specialist IBM Client Abstract Sourcing deals creates opportunities and challenges.
Cloud Security Keeping Data Safe in the Boundaryless World of Cloud Computing Executive Summary As cloud service providers mature, and expand and refine their offerings, it is increasingly difficult for
JANUARY 2013 REPORT OF THE DEFENSE SCIENCE BOARD TASK FORCE ON Cyber Security and Reliability in a Digital Cloud JANUARY 2013 Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
ITIL A guide to service asset and configuration management The goal of service asset and configuration management The goals of configuration management are to: Support many of the ITIL processes by providing
AskAvanade: Answering the Burning Questions around Cloud Computing There is a great deal of interest in better leveraging the benefits of cloud computing. While there is a lot of excitement about the cloud,
CYBER SECURITY OPERATIONS CENTRE APRIL 2011, UPDATED SEPTEMBER 2012 Cloud Computing Security Considerations Table of Contents Cloud Computing Security Considerations... 3 Overview of Cloud Computing...
FRAUNHOFER RESEARCH INSTITUTION AISEC CLOUD COMPUTING SECURITY PROTECTION GOALS.TAXONOMY.MARKET REVIEW. DR. WERNER STREITBERGER, ANGELIKA RUPPEL 02/2010 Parkring 4 D-85748 Garching b. München Tel.: +49