Delivering Security From The Cloud: Turning a Risk into a Weapon. John Pescatore SANS, Director Emerging Security Trends

Size: px

Start display at page:

Download "Delivering Security From The Cloud: Turning a Risk into a Weapon. John Pescatore SANS, Director Emerging Security Trends"

Teresa Olivia Marshall
8 years ago
Views:

1 Delivering Security From The Cloud: Turning a Risk into a Weapon John Pescatore SANS, Director Emerging Security Trends 1

Limit Sharing Limit Access Public Cloud Service Scalable, Shared, Automated, Elastic Implementation Provider Community Cloud

2 Cloud Computing: Definition and Key Attributes A style of computing where scalable and elastic IT-enabled capabilities are delivered as a service to customers using Internet technologies Internet Technologies Customer Service-Based Metered by Use Limit Sharing Limit Access Public Cloud Service Scalable, Shared, Automated, Elastic Implementation Provider Community Cloud Service "Virtual" Private Cloud Service Private Cloud Service Open access Fully shared Limited access Open access Limited sharing Closed access

speed Operational expense, automation Less downtime Self-serve agility Standardization IT as a business Usage

3 The Road Map Through Private Cloud Computing Stage 1: Server Virtualization Stage 2: Distributed Virtualization Stage 3: Private Cloud Stage 4: Hybrid Cloud Stage 5: Public Cloud Consolidation Capital expense Flexibility and speed Operational expense, automation Less downtime Self-serve agility Standardization IT as a business Usage metering Cost for peak loads Flexibility for peak loads Capital expense elimination Increased flexibility (up and down)

4 The Virtualization Tipping Point in 2012 Percentage of installed x86 workloads running in a VM 49% 58% 65% 72% 77% The majority of server deployments during 2010 were virtual. Half of all server workloads were virtualized in % 38% Hosted virtual desktop is the fastest growing of all virtualization categories. 18% Small and midsize enterprises started virtualizing later than larger enterprises. Large enterprises tend to deploy incrementally; small and midsize enterprises tend to virtualize all at once.

5 Virtualization and Private Cloud Road Map Plans Hybrid may be in the future for most customers, but they are already planning for it. Hybrid cloud 47% Stage 4 Partially virtualized 8% Stage 1 Stage 3 Stage 2 Heavily virtualized 17% Private cloud 32% SourceL Gartner Data Center Conference Poll By 2015, how would you describe your virtualization progress (choose the one most applicable)? (N = 104)

6 Where Did Everyone Go? Data.gov Platform as a Service Wired/less Good Old Data Center Nontraditional Application Ecosystems

7 Realistic View of Cloud Risks TSO was a cloud. ISPs were the cloud. Outsourcing is outsourcing. The use of a shared infrastructure is the major issue The loss of transparency is an outsourcing phenomenon Separation of duties and change control are the major risk areas The biggest risk is the need to change business/mission processes to match. Attacks against cloud infrastructure will happen later. 7

8 Hype Cycle for Cloud Computing Source: Gartner 2014

9 We Have Many Security Tools on Our Belt Source: Gartner 2014

10 Many of Those Tools Can Be Delivered from the Cloud Source: Gartner 2014

11 Using the Cloud to Secure the Cloud Data.gov Platform as a Service Security as a Service Good Old Data Center Nontraditional Application Ecosystems

12 Security from the Cloud Major Areas Already In Use DDoS mitigation 45% delivered by ISPs 45% by cloud-based DDoS mitigation MITM security as a Service Already more than 45% anti-spam/ AV delivered from cloud Vulnerability Assessment 30% VA scans delivered from the cloud 20% application vulnerability testing delivered from cloud Web Security Gateway 25% delivered from the cloud today.

13 Security from the Cloud Growth Areas Data encryption Firewall/IPS/UTM Security Information/Event Management Identity/Access Management Web Application Firewall

14 Deployment Example Web Security Gateway in the Cloud Securing mobile device used of the cloud UTM services to small remote offices Source: Zscaler

15 Deployment Example Enabling use of Storage aas Encrypt data before storing in cloud Keep keys off of cloud Source: Cipher Cloud

16 Deployment Example Protecting Web Servers Use WAF aas or CDN to protect vulnerable web servers Source: Imperva

17 Deployment Example SIEM as a Service for Reporting MSSP SOC used, or dedicated SIEM as a Service provider Source: Citadel

18 Bottom Line The cloud is already in use and growing. Whenever IT adds a new delivery method, security has to do the same thing. For most medium to large business, hybrid cloud security delivery will be the norm. Use the cloud to reduce the cost of security tasks that are furthest from critical business services Apply your resources towards the crown jewels. GSA FedRAMP program for cloud security standards.

Federal Aviation Administration. efast. Cloud Computing Services. 25 October 2012. Federal Aviation Administration

Federal Aviation Administration. efast. Cloud Computing Services. 25 October 2012. Federal Aviation Administration efast Cloud Computing Services 25 October 2012 1 Bottom Line Up Front The FAA Cloud Computing Vision released in 2012 identified the agency's road map to meet the Cloud First Policy efast must provide