1 Cloud Computing Security ENISA Daniele Catteddu, CISM, CISA Convegno Associazione Italiana Information Systems Auditors
2 Agenda Introduction to ENISA ENISA objectives in Cloud computing Reaching the objectives 2009 Benefits, risks and recommendations for InfoSec Cloud Information Assurance Framework 2010 Security and resilience in Gov clouds: achieving an informed decision Conclusions
3 ENISA: Who are we? The European Network & Information Security Agency (ENISA) was formed in The Agency is a Centre of Expertise that supports the Commission and the EU Member States in the area of information security. We facilitate the exchange of information between EU institutions, the public sector and the private sector. 3
4 Focus ENISA assists Member States and the Commission in global issues that affect the European Community as a whole. ENISA contribute to the harmonization of appropriate technical and organizational security measures by providing expert advice. This is an advisory role and the focus is on prevention and preparedness. ENISA does NOT have any operational responsibilities either within the EU institutional framework or with respect to Member States. ENISA has no special role in the security process protecting EU institutions.
5 What is cloud computing ENISA s understanding Highly abstracted hw sw resources Near instant scalability and flexibility Near instantaneous provisioning Shared resources (hardware, database, memory, etc...) Service On demand, usually with a pay as you go billing system Programmatic management (e.g. through Web Services API)
6 What is cloud computing ENISA s understanding Cloud computing is not a new technology Cloud computing is a new business model It is a way of delivering computing resources
7 ENISA Cloud Computing Objectives Help business and governments to reap the cost and security benefits of cloud computing. While maintaining service availability, data confidentiality, integrity and privacy. 7
8 ENISA Cloud Computing Objectives Creating trust and trustworthiness through promoting best practice and assurance standards 8
11 Reaching the objectives ENISA Deliverables and Ongoing Activities Cloud Computing: Benefits, Risks and Recommendations for Information security 2009 Assurance framework 2009 Research Recommendations 2009 Gov-Cloud security and resilience analysis (2010) Common Assurance Maturity Model(CAMM) consortium (proposed) procurement and monitoring guidance for government cloud contracts. 11
12 Cloud Computing: Benefits, Risks and Recommendations for Information security 12
13 Highlights from the report 27 experts involved Mainly based on an SMEs requirements 8 security benefits 53 vulnerabilities considered 24 cloud specific risks identified Information Assurance (framework), Legal and Research recommendations 13
14 Security Benefits 14
15 Economy of Scale
16 Economies of scale and Security All kinds of security measures are cheaper when implemented on a larger scale (e.g. filtering, patch management, hardening of virtual machine instances and hypervisors, etc) The same amount of investment in security buys better protection.
17 Other benefits of scale Multiple locations by default -> redundancy and failure independence Edge networks: content delivered or processed closer to its destination Staff specialization & experience Cloud providers big enough to hire specialists in dealing with specific security threats.
18 Improved management of updates and defaults Updates can be rolled out much more rapidly across a homogenous platform Default VM images and software modules can be updated with the latest patches and security settings Snapshots of virtual infrastructure (in IaaS) to be taken regularly and compared with a security baseline.
19 The Risks
20 Very high value assets Most risks are not new, but they are amplified by resource concentration Trustworthiness of insiders. Hypervisors - hypervisor layer attacks on virtual machines are very attractive. More Data in transit (Without encryption?) Management interfaces big juicy targets
21 Loss of Governance The client cedes control to the Provider on a number of issues effecting security: External pen testing not permitted. Very limited logs available. Usually no forensics service offered No information on location/jurisdiction of data. Outsource or sub-contract services to third-parties (fourth parties?) SLAs may not offer a commitment to provide the above services, thus leaving a gap in security defences.
22 Lock in Few tools, procedures or standard formats for data and service portability. Difficult to migrate from one provider to another, or to migrate data and services to or from an in-house IT environment. Potential dependency of service provision on a particular CP.
23 Compliance Challenges Cloud Provider cannot provide evidence of their own compliance to the relevant requirements Cloud Provider does not permit audit by the Cloud Customer In certain cases, using a cloud implies certain kind of compliance cannot be achieved
24 Legal and contractual risks Data in multiple jurisdictions, some of which may be risky. Lack of compliance with EU Data Protection Directive Potentially difficult for the customer (data controller) to check the data handling practices of the provider Multiple transfers of data exacerbated the problem Subpoena and e-discovery Confidentiality and Non-disclosure Intellectual Property Risk Allocation and limitation of liability
25 Isolation failure Storage (e.g. Side channel attacks see Memory Virtual machines Entropy pools (http://bit.ly/41siin) Resource use (e.g. Bandwidth)
26 RESOURCE EXHAUSTION Overbooking Underbooking Caused by: Resource allocation algos Denial of Service Freak events
27 Key management Key management is (currently) the responsibility of the cloud customer Key provisioning and storage is usually off-cloud One key-pair per machine doesn t scale to multiple account holders/rbac Credential recovery sometimes available through management interface (protected by UN/PWD by) Copies of VM images may contain keys if not wellmanaged
29 Cloud Information Assurance Framework Increasing transparency through a minimum baseline for: comparing cloud offers assessing the risk to go Cloud reducing audit burden for CP and security risks
30 Cloud Information Assurance Framework An example Network architecture controls Well-defined controls are in place to mitigate DDoS (distributed denial of-service) attacks e.g. o o Defence in depth (traffic throttling, packet black-holing, etc..) Defences are in place against internal (originating from the cloud providers networks) attacks as well as external (originating from the Internet or customer networks) attacks. Measures are specified to isolate resource usage between accounts for virtual machines, physical machines, network, storage (e.g., storage area networks), management networks and management support systems, etc. The architecture supports continued operation from the cloud when the customer is separated from the service provider and vice versa (e.g., there is no critical dependency on the customer LDAP system).
31 Research recommendations BUILDING TRUST IN THE CLOUD Certification processes and standards for clouds Return on security investments (ROSI) the measures cloud computing can enable to improve the accuracy of ROI for security Techniques for increasing transparency while maintaining appropriate levels of security Tagging, e.g., location tagging, data type tagging, policy tagging Privacy preserving data provenance systems, e.g., tracing data end-to-end through systems End-to-end data confidentiality in the cloud and beyond: Encrypted search (long term) Encrypted processing schemes (long term) Encryption and confidentiality tools for social applications in the cloud Higher assurance clouds, virtual private clouds, etc
32 Research recommendations DATA PROTECTION IN LARGE-SCALE CROSS- ORGANIZATIONAL SYSTEMS The following areas require further research with respect to cloud computing: Data destruction and lifecycle management Integrity verification - of backups and archives in the cloud and their version management Incident handling - monitoring and traceability Dispute resolution and rules of evidence International differences in relevant regulations, including data protection and privacy Legal means to facilitate the smooth functioning of multinational cloud infrastructures Automated means to mitigate problems with different jurisdictions.
33 Governments recommendations 2009 Public clouds are (usually) not suitable for critical government applications. Clearly define international differences in DP legislation. Should there be breach notification requirements on cloud providers....
34 Government towards the Cloud 34
35 Governments and the Cloud DK UK... Gov Agencies and Public Organizations around the globe are moving non-critical applications towards a "cloud approach". In Europe we have some fast adopters, i.e. Denmark and UK, announcing/planning to move into the cloud. Australia USA In the short-medium term (1 to 3 years) an increasing number of Public Organizations, in EU Member States, will consider/adopt cloud computing. Singapore Japan 35
36 2010 Security and resilience in Gov clouds: achieving an informed decision
37 Objectives and scope to support MSs in elaborating their cloud strategy to guide Public Bodies in defining their risk profile to evaluate S.W.O.T. of cloud computing to provide good practices The main focus is the impact on resilience and security of services.
38 Security and resilience in Gov clouds: achieving an informed decision 3 scenarios considered: a local healthcare authority implementing the electronic healthcare records and other e- services, a local public administration rolling out new services for the citizens and rationalizing internal IT services, and finally, a Ministry planning the creation of governmental cloud as a business incubator 38
39 Business/Operational, Legal and Regulatory requirements Security and Resilience requirements IT services architectural options and delivery models COMPARATIVE RISK ASSESSMENT (SWOT or RISK ANALYSIS & ASSESSMENT) Select IT solution Identify threats, weaknesses Prepare Request for Proposal (RpF) Select Partner-Provider Risk treatment
40 Security and Resilience parameters Preparedness Risk Analysis and Assessment Prevention and Detection Patch Management Access Control and Accountability Supply Chain Business continuity Service Delivery Availability and Reliability Scalability and Elasticity Cloud Access Recovery and response Legal and regulatory compliance
41 Community Cloud Strengths Common requirements and constraints and risks More bargaining power as a group (with the cloud provider) Ability to be a walled garden Membership vetting according to the trustworthiness of the candidate If based on federation -> edge networks Private Cloud Full transparency and control over legal requirements (e.g. Geography) Ability to implement your own practices (e.g. risk analysis and assessment) Possibility to fully monitor all security events, BCP testing Auditablilty Priority in service resumption Public Cloud Strong security and resilience capabilities (e.g. prevention and detection, patch management, availability and reliability, tolerance and elasticity, performance, response and recovery, business continuity and physical security CAVEAT: these strength are directly related with the scale of the provider
42 Weaknesses Community Cloud difficult to agree on security baselines, the client-based common logging formats, etc compared to a private cloud, you are a bigger target. access control and authentication are weakened Private Cloud no advantage of economies of scale potentially less tolerance to malicious attacks less comprehensive redundancy regime, no geo-redundancy less flexibility Public Cloud lack of control on the access control systems, the lack accountability (audits are not allowed). you need negotiations power to be able to ask the right info the provider. external forensics very difficult geo location constrains as a weakness: data cannot leave the country
43 Opportunities Community Cloud common ToR and security policies, standards etc... Potential flexibility of security policies closedness e.g. more strict security Public Cloud Risk Analysis and Assessment, Penetration testing, Real time security monitoring In order for a public cloud to take advantage of these opportunities a the following measure should be in place: 1) full control on asset inventory, 2) detailed physical assets, information and services classification, 3) integration between risk analysis/assessment and real time security monitoring processes, 4) effective screening of employees Public Cloud In a private cloud, users and applications oriented monitoring mechanisms can be implemented making possible a quick adjustment of resources to meet peaks in the demand. Furthermore, security events of interest can be fully monitored.
44 Community Cloud Lack of exit criteria Community might grow too quickly Threats Harder to predict resource usage (than private cloud) Failure of isolation mechanisms (not compared to public) Difficulty of identifying the legal entity Public Cloud Lack of legal and regulatory compliance (data retention, forensics, reporting). Attractive target for criminals and Insiders Isolation failure, information leakage, illegal monitoring Lack of linkability and accountability in case illegal activities poor requirements definition and asset classification. You might incur in supplementary multiple jurisdiction Change of control (Risk of provider acquisition) Private Cloud politically motivated attacks damages to reputation Big brother effect Poor requirements definition and asset classification may results in loss of security and integrity when scaling from a private cloud to an hybrid one. Inadequate definition of the contracts with business partner(s) and lack of monitoring of the contract execution may be critical in relation with the size of the provider.
45 Key messages Private and community clouds appear to be the solution that best fits the needs of public bodies they offer the highest level of governance, control and visibility. Baer in mind that if a private/community cloud does not reach the necessary infrastructural critical mass, most of the resilience and security benefits of the cloud model will not be realised. Public cloud is the option that offers potentially the highest level of service availability at lowest cost but currently its adoption should be limited to non sensitive applications and in the context of a defined strategy for cloud adoption which should include a clear exit strategy.
46 Conclusions Cloud computing can represent an improvement in security and resilience Transparency is crucial: users must be given a means to assess and compare provider security practices In the current state of the art, migrating critical and sensitive applications and data to the cloud is still very risky Much more effort is required to achieve security levels required for higher assurance applications in the cloud For once we can build security in by design, let s not miss the chance
47 The Penultimate Slide Watch out for the results of ENISA s cloud security study out end of November (http://)
48 The Final Slide Contact: Daniele Catteddu
49 Contact Daniele Catteddu European Network and Information Security Agency Science and Technology Park of Crete (ITE) P.O. Box Heraklion - Crete Greece
ENISA Cloud Computing Security Strategy Dr Giles Hogben European Network and Information Security Agency (ENISA) What is Cloud Computing? Isn t it just old hat? What is cloud computing ENISA s understanding
Cloud computing: benefits, risks and recommendations for information security Dr Giles Hogben Secure Services Programme Manager European Network and Information Security Agency (ENISA) Goals of my presentation
How to procure a secure cloud service Dr Giles Hogben European Network and Information Security Agency Security in the cloud contracting lifecycle Can cloud meet your security requirements Choose the provider
Cloud Computing An insight in the Governance & Security aspects AGENDA Introduction Security Governance Risks Compliance Recommendations References 1 Cloud Computing Peter Hinssen, The New Normal, 2010
ENISA and Cloud Security Rossen Naydenov Network Information Security Officer Critical Information Infrastructure Protection Department - ENISA European Union Agency for Network and Information Security
Assessing Risks in the Cloud Jim Reavis Executive Director Cloud Security Alliance Agenda Definitions of Cloud & Cloud Usage Key Cloud Risks About CSA CSA Guidance approach to Addressing Risks Research
Security Issues in Computing CSCI 454/554 Computing w Definition based on NIST: A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources
1 VENDOR RISK MANAGEMENT UPDATE- ARE YOU AT RISK? Larry L. Llirán, CISA, CISM December 10, 2015 ISACA Puerto Rico Symposium 2 Agenda Introduction Vendor Management what is? Available Guidance Vendor Management
John Essner, CISO Office of Information Technology State of New Jersey http://csrc.nist.gov/publications/nistpubs/800-144/sp800-144.pdf Governance Compliance Trust Architecture Identity and Access Management
ITU TRCSL Symposium on Cloud Computing Session 2: Cloud Computing Foundation and Requirements What Cloud computing means in real life Saman Perera Senior General Manager Information Systems Mobitel (Pvt)
Certified Information Systems Auditor (CISA ) Certification Course Description Our 5-day ISACA Certified Information Systems Auditor (CISA) training course equips information professionals with the knowledge
Securing The Cloud Foundational Best Practices For Securing Cloud Computing Scott Clark Agenda Introduction to Cloud Computing What is Different in the Cloud? CSA Guidance Additional Resources 2 What is
ENISA and Cloud Security Dimitra Liveri NIS Expert EuroCloud Forum 2015 Barcelona 07-10-2015 European Union Agency for Network and Information Security Securing Europe s Information Society Operational
CLOUD STORAGE SECURITY INTRODUCTION Gordon Arnold, IBM SNIA Legal Notice The material contained in this tutorial is copyrighted by the SNIA. Member companies and individual members may use this material
Organizational risks 1 Lock-in Risk of not being able to migrate easily from one provider to another 2 Loss of Governance Control and influence on the cloud providers, and conflicts between customer hardening
Thought Leadership White Paper Cloud Computing Cloud Security Who do you trust? Nick Coleman, IBM Cloud Security Leader Martin Borrett, IBM Lead Security Architect 2 Cloud Security Who do you trust? Cloud
Introduction to Cloud Computing Srinath Beldona email@example.com Agenda Pre-requisites Course objectives What you will learn in this tutorial? Brief history Is cloud computing new? Why cloud computing?
Cloud Computing and Security Risk Analysis Qing Liu Technology Architect STREAM Technology Lab Qing.Liu@chi.frb.org 1 Disclaimers This presentation provides education on Cloud Computing and its security
How to ensure control and security when moving to SaaS/cloud applications Stéphane Hurtaud Partner Information & Technology Risk Deloitte Laurent de la Vaissière Directeur Information & Technology Risk
Mobile Cloud Computing Lecture 02b Cloud Computing II 吳 秀 陽 Shiow-yang Wu T. Sridhar. Cloud Computing A Primer, Part 2: Infrastructure and Implementation Topics. The Internet Protocol Journal, Volume 12,
Thought Leadership White Paper Cloud Computing Cloud Security Who do you trust? Nick Coleman, IBM Cloud Security Leader Martin Borrett, IBM Lead Security Architect 2 Cloud Security Who do you trust? Cloud
Key Considerations of Regulatory Compliance in the Public Cloud W. Noel Haskins-Hafer CRMA, CISA, CISM, CFE, CGEIT, CRISC 10 April, 2013 firstname.lastname@example.org Disclaimer Unless otherwise specified,
SECURITY CONCERNS AND SOLUTIONS FOR CLOUD COMPUTING 1. K.SURIYA Assistant professor Department of Computer Applications Dhanalakshmi Srinivasan College of Arts and Science for Womren Perambalur Mail: Surik.email@example.com
Dr. Marcel Schlatter, IBM Distinguished Engineer, Delivery Technology & Engineering, GTS 10 November 2010 Hybrid Computing Why is it becoming popular, Patterns, Trends, Impact Hybrid Definition and Scope
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Cloud Computing: Legal Risks and Best Practices A Bennett Jones Presentation Toronto, Ontario Lisa Abe-Oldenburg, Partner Bennett Jones LLP November 7, 2012 Introduction Security and Data Privacy Recent
Cloud Computing Security Considerations Roger Halbheer, Chief Security Advisor, Public Sector, EMEA Doug Cavit, Principal Security Strategist Lead, Trustworthy Computing, USA January 2010 1 Introduction
REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY
Cloud Computing Bringing the Cloud into Focus November 2011 Introduction Ken Cochrane CEO, IT/NET Partner, KPGM Performance and Technology National co-leader IT Advisory Services KPMG Andrew Brewin Vice
Stepping Through the Info Security Program Jennifer Bayuk, CISA, CISM Infosec Program How to: compose an InfoSec Program cement a relationship between InfoSec program and IT Governance design roles and
Your Platform of Choice The Cloud is Not Enough Why Hybrid Infrastructure is Shaping the Future of Cloud Computing Mark Cravotta EVP Sales and Service SingleHop LLC Talk About Confusing? Where do I start?
Effective Practices for Cloud Security Effective Security Practices Series Moving some internal processes to the cloud initially looks appealing: lower capital costs, more centralized management and control,
NETWORK ACCESS CONTROL AND CLOUD SECURITY Tran Song Dat Phuc SeoulTech 2015 Table of Contents Network Access Control (NAC) Network Access Enforcement Methods Extensible Authentication Protocol IEEE 802.1X
ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements
Information Security: Cloud Computing Simon Taylor MSc CLAS CISSP CISMP PCIRM Director & Principal Consultant All Rights Reserved. Taylor Baines Limited is a Registered Company in England & Wales. Registration
Cloud Computing Rev.B December 2012 2 Cloud Computing Document History Date Version Modification Author December 2009 December 2012 1.0 Initial Release, Rev.A Daniele Catteddu, Giles Hogben 2.0 Rev.B Thomas
Information Security Manager: Architecture, Planning, and Governance (Instructor-led; 3 Days) Module I. Information Security Governance A. Introduction to Information Security Governance B. Overview of
INTRODUCTION TO CLOUD COMPUTING CEN483 PARALLEL AND DISTRIBUTED SYSTEMS CLOUD COMPUTING Cloud computing is a model for enabling convenient, ondemand network access to a shared pool of configurable computing
Overview of Cloud Computing and Cloud Computing s Use in Government Justin Heyman CGCIO, Information Technology Specialist, Township of Franklin Best Practices for Security in the Cloud John Essner, Director
Strategic Compliance & Securing the Cloud Annalea Sharack-Ilg, CISSP, AMBCI Technical Director of Information Security Complexity and Challenges 2 Complexity and Challenges Compliance Regulatory entities
The Magazine for IT Security May 2010 sör alex / photocase.com free digital version made in Germany issue 3 Luiz Fotolia.com Clouds or storm clouds? Cloud Computing Security by Javier Moreno Molinero Gradually,
CPNI VIEWPOINT 01/2010 CLOUD COMPUTING MARCH 2010 Acknowledgements This viewpoint is based upon a research document compiled on behalf of CPNI by Deloitte. The findings presented here have been subjected
How does IBM deliver cloud security? An IBM paper covering SmartCloud Services 1 2 How does IBM deliver cloud security? Contents 2 Introduction 3 Cloud governance 3 Security governance, risk management
6 th Floor, Tower A, 1 CyberCity, Ebene, Mauritius T + 230 403 6000 F + 230 403 6060 E ReachUs@abaxservices.com INFORMATION SECURITY POLICY DOCUMENT Information Security Policy Document Page 2 of 15 Introduction
It is a well-known fact in computer security that security problems are very often a direct result of software bugs. That leads security researches to pay lots of attention to software engineering. The
ISO 27002 Compliance Guide September 2015 Contents Compliance Guide 01 02 03 Introduction 1 Detailed Controls Mapping 2 About Rapid7 7 01 INTRODUCTION If you re looking for a comprehensive, global framework
Information Technology Engineers Examination Information Security Specialist Examination (Level 4) Syllabus Details of Knowledge and Skills Required for the Information Technology Engineers Examination
Data Protection: From PKI to Virtualization & Cloud Raymond Yeung CISSP, CISA Senior Regional Director, HK/TW, ASEAN & A/NZ SafeNet Inc. Agenda What is PKI? And Value? Traditional PKI Usage Cloud Security
AskAvanade: Answering the Burning Questions around Cloud Computing There is a great deal of interest in better leveraging the benefits of cloud computing. While there is a lot of excitement about the cloud,
Cloud Security Specialist Certification Bundle CloudSchool.com CLOUD CERTIFIED Technology Professional This certification bundle provides you with the self-study materials you need to prepare for the exams
Top 10 Cloud Risks That Will Keep You Awake at Night Shankar Babu Chebrolu Ph.D., Vinay Bansal, Pankaj Telang Photo Source flickr.com .. Amazon EC2 (Cloud) to host Eng. Lab testing. We want to use SalesForce.com
Certified Information Systems Auditor (CISA) Course Introduction Course Introduction Module 01 - The Process of Auditing Information Systems Lesson 1: Management of the Audit Function Organization of the
Practical Geospatial Policies: Resolving Operational Issues to Optimize Your SDI Ed Kennedy Hickling Arthurs Low Corporation and Cynthia Mitchell and Simon Riopel Division, Natural Resources Canada Overview
SMS Systems Management Specialists Cloud Computing Grupo SMS www.grupo-sms.com 949.223.9240 option 3 for sales Cloud Computing The SMS Model: Cloud computing is a model for enabling ubiquitous, convenient,
IT Security Risk Management Model for Cloud Computing: A Need for a New Escalation Approach. Gunnar Wahlgren 1, Stewart Kowalski 2 Stockholm University 1: (firstname.lastname@example.org), 2: (email@example.com) ABSTRACT
Cloud Computing - Cyber Security Challenges for the Finance Sector Dr. Evangelos Ouzounis Head of Unit Secure Infrastructures and Services - ENISA European Union Agency For Network And Information Security
GoodData Corporation Security White Paper May 2016 Executive Overview The GoodData Analytics Distribution Platform is designed to help Enterprises and Independent Software Vendors (ISVs) securely share
IBM Global Technology Services Thought Leadership White Paper November 2010 Strategies for assessing cloud security 2 Securing the cloud: from strategy development to ongoing assessment Executive summary
IT OUTSOURCING SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
Copyright Marchany 2010 Cloud Computing Security Issues Randy Marchany, VA Tech IT Security, firstname.lastname@example.org Something Old, Something New New: Cloud describes the use of a collection of services, applications,
Journey to Cloud 9 Navigating a path to secure cloud computing Alastair Broom Solutions Director, Integralis March 2012 Navigating a path to secure cloud computing 2 Living on Cloud 9 Cloud computing represents
Cloud Infrastructure Security Dimiter Velev 1 and Plamena Zlateva 2 1 University of National and World Economy, UNSS - Studentski grad, 1700 Sofia, Bulgaria email@example.com 2 Institute of Control and
Introduction and Overview Klaus Gribi Senior Security Consultant firstname.lastname@example.org May 6, 2015 Agenda 2 1. Cloud Security Cloud Evolution, Service and Deployment models Overview and the Notorious
Recommendations for companies planning to use Cloud computing services From a legal standpoint, CNIL finds that Cloud computing raises a number of difficulties with regard to compliance with the legislation
Study on Cloud security in Japan 2011/February Professor Yonosuke HARADA INSTITUTE of INFORMATION SECURITY (C) ITGI Japan Content 1 Background 2 Survey 2.1 Respondents 2.2 User on cloud services 2.3 Risk
Summary Report Report # 1 Security Challenges of Cross-Border Use of Cloud Services under Special Consideration of ENISA s Contributions COINS Summer School 2015 on Could Security Prepared by: Nabeel Ali
Virginia Government Finance Officers Association Spring Conference May 28, 2014 Cloud Security 101 Presenters: John Montoro, RealTime Accounting Solutions Ted Brown, Network Alliance Presenters John Montoro
Orchestrating the New Paradigm Cloud Assurance Amsterdam 17 January 2012 John Hermans - Partner Current business challenges versus traditional IT Organizations are challenged with: Traditional IT seems
Appendix J: Strengthening the Resilience of Outsourced Technology Services Background and Purpose Many financial institutions depend on third-party service providers to perform or support critical operations.
Information Technology Security Policy for IBTS Pakistan Stock Exchange Limited Table of contents Information Technology Security Policy for IBTS 1- INTRODUCTION AND SCOPE... 3 2- CHARTER OF THE DOCUMENT...
Cloud Computing: Compliance and Client Expectations February 15, 2012 MOSS ADAMS LLP 1 TODAY S PRESENTERS Moderator Kevin Villanueva, CPA, CISA, CISM, CITP, CRISC Sr. Manager, Infrastructure and Security
November 09 Benefits, risks and recommendations for information security ABOUT ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the
National Cyber Security Policy -2013 Preamble 1. Cyberspace 1 is a complex environment consisting of interactions between people, software and services, supported by worldwide distribution of information
TECHNICAL WHITE PAPER The Shared Security Model for vcloud Air The end-to-end security of VMware vcloud Air (the Service ) is shared between VMware and the customer. VMware provides security for the aspects
IT Architecture Review ISACA Conference Fall 2003 Table of Contents Introduction Business Drivers Overview of Tiered Architecture IT Architecture Review Why review IT architecture How to conduct IT architecture
ITL BULLETIN FOR JUNE 2012 CLOUD COMPUTING: A REVIEW OF FEATURES, BENEFITS, AND RISKS, AND RECOMMENDATIONS FOR SECURE, EFFICIENT IMPLEMENTATIONS Shirley Radack, Editor Computer Security Division Information
Brochure More information from http://www.researchandmarkets.com/reports/2213812/ Auditing Cloud Computing. A Security and Privacy Guide. Wiley Corporate F&A Description: The auditor's guide to ensuring
Cloud-Security: Show-Stopper or Enabling Technology? Fraunhofer Institute for Secure Information Technology (SIT) Technische Universität München Open Grid Forum, 16.3,. 2010, Munich Overview 1. Cloud Characteristics
Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the
A COALFIRE PERSPECTIVE Top 10 Risks in the Cloud by Balaji Palanisamy, VCP, QSA, Coalfire March 2012 DALLAS DENVER LOS ANGELES NEW YORK SEATTLE Introduction Business leaders today face a complex risk question