Pilvipalveluiden tietoturvan standardisointi

Size: px
Start display at page:

Download "Pilvipalveluiden tietoturvan standardisointi"

Transcription

1 Pilvipalveluiden tietoturvan standardisointi Juha Röning

2 Sisältö Standardien kirjo Pilvipalveluiden standardit Seurattavat standardit Standardit ja CSA Cloud Controls Matriisi Cloud Software tutkimus Suomessa

3 Standardit Teknologiastandardit ISO Säädökset Tietosuojalainsäädäntö (EU, kansallinen) PCI-DSS Payment Card Industry Security Standards Council HIPAA (US) The Health Insurance Portability and Accountability Act of 1996 FedRamp (US) The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

4 Pilven standardoijat

5 Teemoja Virtualisoinnin tuomat uhat Jaetut resurssit, CPU/verkko, vuodot Yksityisyys Tiedon sijainti, salaaminen, palvelun yksityisyyspolitiikka Identiteetin hallinta

6 Standardisointiprosessi: ETSI Stage 0 Validate need for standardisation Stage 1 Requirements and objectives Stage 2 Information model Stage 3 Detailed data and protocol model Stage 4 Testing and validation Deploy the standard

7 Standardisointiprosessi: IETF From RFC 2026, section 1.2: In outline, the process of creating an Internet Standard is straightforward: a specification undergoes a period of development and several iterations of review by the Internet community and revision based upon experience, is adopted as a Standard by the appropriate body... and is published. In practice, the process is more complicated, due to (1) the difficulty of creating specifications of high technical quality; (2) the need to consider the interests of all of the affected parties; (3) the importance of establishing widespread community consensus; and (4) the difficulty of evaluating the utility of a particular specification for the Internet community.

8 Tärkeimmät ITU SG13, SG17 ISO SC38, SC27 NIST the National Institute of Standards and Technology: mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life. OASIS Organization for the Advancement of Structured Information Standards: is a non-profit consortium that drives the development, convergence and adoption of open standards for the global information society. IETF Internet Engineering Task Force; make the Internet work better from an engineering point of view

9 Tärkeimmät money talks Cloud Security Alliance The Cloud Security Alliance (CSA) is a not-for-profit organization with a mission to promote the use of best practices for providing security assurance within Cloud Computing, and to provide education on the uses of Cloud Computing to help secure all other forms of computing. The Cloud Security Alliance is led by a broad coalition of industry practitioners, corporations, associations and other key stakeholders. ODCA The Open Data Center Alliance is working actively to shape the future of cloud computing a future based on open, interoperable standards.

10 ITU-T ja ISO standardisointeja ITU-T SG13 Q26: Cloud computing ecosystem, intercloud and general requirements Q27 Cloud functional architecture, infrastructure and networking Q28 Cloud computing resource management and virtualization ISO SC38 WG3 Cloud Computing, Cloud computing reference architecture and vocabulary

11 ITU-T ja ISO standardisointeja ITU-T SG17 -Security Work to build confidence and security in the use of information and communication technologies (ICTs) continues to intensify in a bid to facilitate more secure network infrastructure, services and applications. Over seventy standards (ITU-T Recommendations) focusing on security have been published. ITU-T Study Group 17 (SG17) coordinates security-related work across all ITU-T Study Groups. Often working in cooperation with other standards development organizations (SDOs) and various ICT industry consortia, SG17 deals with a broad range of standardization issues. To give a few examples, SG17 is currently working on cybersecurity; security management; security architectures and frameworks; countering spam; identity management; the protection of personally identifiable information; and the security of applications and services for the Internet of Things (IoT), smart grid, smartphones, web services, social networks, cloud computing, mobile financial systems, IPTV and telebiometrics.

12 ITU-T ja ISO standardisointeja ISO/IEC JTC 1/SC 27 WG 1 Information security management systems WG 2 Cryptography and security mechanisms WG 3 Security evaluation, testing and specification WG 4 Security controls and services WG 5 Identity management and privacy technologies

13 ITU Cloud Security reference architecture

14 Cloud Security Alliance Cloud Controls Matrix Trusted Cloud Infrastructure Security as a Service Cloud Trust Protocol Guidance Document

15 ISO Seurattavia standardeja pilven käyttäjille Controls for Cloud Computing security Additional controls for ISO certification Implementation guidance (27002 päälle) Supply chain guidance Secure Storage (ISO 27040) ITU Cloud Security Framework

16 Seurattavia standardeja NIST The purpose of this document is to provide an overview of public cloud computing and the security and privacy challenges involved. ENISA Cloud Security guide, uusi versio SME-fokuksella ISAE 3402 in-depth audit of a third-party service organization (transparency and trust) https://support.google.com/a/bin/answer.py?hl=en&answer= 60762

17 Cloud security guide: TOP SECURITY RISKS LOSS OF GOVERNANCE LOCK-IN ISOLATION FAILURE COMPLIANCE RISKS MANAGEMENT INTERFACE COMPROMISE: DATA PROTECTION INSECURE OR INCOMPLETE DATA DELETION: MALICIOUS INSIDER

18 Cloud Controls Matrix

19 ISO

20 Cloud Software Turvallisuus ketterässä tuotteenhallinnassa Riskinhallinta Yksityisyyden suoja Rajapintatestaus Organisaatioiden välinen luottamus

21 Generic Security User stories Pienemmillä organisaatioilla ei välttämättä ole käytössä tietoturva-asiantuntijaa Tapa löytää tietoturvavaatimuksia ja ratkaisuja Antti Vähä-Sipilä and Camillo Särs / F-Secure

22

23

24 Rajapintatestaus Radamsa-työkalu ohjelmistojen toimintavarmuuden testaamiseen Selain on erityisen kriittinen pilvipalveluissa Yli sata haavoittuvuutta löydetty ja korjattu

Attacking the roadblocks preventing aggressive adoption of Cloud Standards:

Attacking the roadblocks preventing aggressive adoption of Cloud Standards: Attacking the roadblocks preventing aggressive adoption of Cloud Standards: How SNIA and other standards orgs are developing standards that benefit high priority use cases. John Eastman, CTO, Presented

More information

Global Efforts to Secure Cloud Computing

Global Efforts to Secure Cloud Computing April 2012 Global Efforts to Secure Cloud Computing Jim Reavis Executive Director Cloud: ushering in IT Spring Technology consumerization and its offspring Cloud: Compute as a utility Smart Mobility: Compute

More information

Cloud standards: Ready for Prime Time. CloudWatch webinar: Standards ready for prime time (part 2) 1

Cloud standards: Ready for Prime Time. CloudWatch webinar: Standards ready for prime time (part 2) 1 Cloud standards: Ready for Prime Time CloudWatch webinar: Standards ready for prime time (part 2) 1 Agenda 15:00 Welcome and introduction 15:05 IEEE P2301: Guide for Cloud Portability and Interoperability

More information

ISO/IEC JTC 1/WG 10 Working Group on Internet of Things. Sangkeun YOO, Convenor

ISO/IEC JTC 1/WG 10 Working Group on Internet of Things. Sangkeun YOO, Convenor ISO/IEC JTC 1/WG 10 Working Group on Internet of Things Sangkeun YOO, Convenor History ISO/IEC JTC 1/SWG 5 (2013 ~ ) In JTC 1 Plenary 2014, Special Working on IoT (SWG 5) proposed to establish a subcommittee

More information

Global Efforts to Secure Cloud Computing. Jason Witty President, Cloud Security Alliance Chicago

Global Efforts to Secure Cloud Computing. Jason Witty President, Cloud Security Alliance Chicago Global Efforts to Secure Cloud Computing Jason Witty President, Cloud Security Alliance Chicago Cloud: Ushering in IT Spring Technology consumerization and its offspring Cloud: Compute as a utility Smart

More information

Cloud Security Alliance and Standards. Jim Reavis Executive Director March 2012

Cloud Security Alliance and Standards. Jim Reavis Executive Director March 2012 Cloud Security Alliance and Standards Jim Reavis Executive Director March 2012 About the CSA Global, not for profit, 501(c)6 organization Over 32,000 individual members, 120 corporate members, 60 chapters

More information

Maintaining Herd Communication - Standards Used In IT And Cyber Security. Laura Kuiper

Maintaining Herd Communication - Standards Used In IT And Cyber Security. Laura Kuiper Maintaining Herd Communication - Standards Used In IT And Cyber Security Laura Kuiper So what is Cyber Security? According to ITU-T X.1205 Cybersecurity is the collection of tools, policies, security concepts,

More information

Latest in Cloud Computing Standards. Eric A. Hibbard, CISSP, ISSAP, ISSEP, ISSMP, CISA CTO Security & Privacy Hitachi Data systems

Latest in Cloud Computing Standards. Eric A. Hibbard, CISSP, ISSAP, ISSEP, ISSMP, CISA CTO Security & Privacy Hitachi Data systems Latest in Cloud Computing Standards Eric A. Hibbard, CISSP, ISSAP, ISSEP, ISSMP, CISA CTO Security & Privacy Hitachi Data systems 1 Short Introduction CTO Security & Privacy, Hitachi Data Systems Involved

More information

Cloud Computing Standards: Overview and ITU-T positioning

Cloud Computing Standards: Overview and ITU-T positioning ITU Workshop on Cloud Computing (Tunis, Tunisia, 18-19 June 2012) Cloud Computing Standards: Overview and ITU-T positioning Dr France Telecom, Orange Labs Networks & Carriers / R&D Chairman ITU-T Working

More information

Working Group on. First Working Group Meeting 29.5.2012

Working Group on. First Working Group Meeting 29.5.2012 Working Group on Cloud Security and Privacy (WGCSP) First Working Group Meeting 29.5.2012 1 Review of fexisting i Standards d and Best Practices on Cloud Security Security Standards and Status List of

More information

ITU- T Focus Group Cloud Compu2ng

ITU- T Focus Group Cloud Compu2ng ITU- T Focus Group Cloud Compu2ng International Telecommunication Union 1 ITU-T FG Cloud Management & Structure Management team: Chairman: Victor Kutukov (Russia) Vice-Chairman: Jamil Chawki (France Telecom

More information

Navigating Cloud Standards

Navigating Cloud Standards Navigating Cloud Standards David Bicket Director m-assure Limited dpb@19770.org Acknowledgements: Kate Craig-Wood, Memset Ian Osborne, Intellect, ICT KTN, CIF Standards Chairman Learning objectives What

More information

! Global Efforts to Secure! Cloud Computing

! Global Efforts to Secure! Cloud Computing ay 2012! Global Efforts to Secure! Cloud Computing Jim Reavis Executive Director loud: ushering in IT Spring Technology consumerization and its offspring Cloud: Compute as a utility Smart Mobility: Compute

More information

Building an Effective

Building an Effective Building an Effective Cloud Security Program Becky Swain Co-Founder/Chair, CSA CCM Board Member, CSA Silicon Valley Chapter Partner, EKKO Consulting Marlin Pohlman Co-Chair, CSA CCM Co-Chair/Founder, CSA

More information

Cloud Security Introduction and Overview

Cloud Security Introduction and Overview Introduction and Overview Klaus Gribi Senior Security Consultant klaus.gribi@swisscom.com May 6, 2015 Agenda 2 1. Cloud Security Cloud Evolution, Service and Deployment models Overview and the Notorious

More information

The role of standards in driving cloud computing adoption

The role of standards in driving cloud computing adoption The role of standards in driving cloud computing adoption The emerging era of cloud computing The world of computing is undergoing a radical shift, from a product focus to a service orientation, as companies

More information

ITU WORK ON INTERNET OF THINGS

ITU WORK ON INTERNET OF THINGS ITU WORK ON INTERNET OF THINGS Presentation at ICTP workshop 26 March 2015 Cosmas Zavazava Chief, Projects and Knowledge Management Department International Telecommunication Union ITU HEADQUARTERS, GENEVA

More information

Cloud Standardization, Compliance and Certification. Class 2012 event 25.rd of October 2012 Dalibor Baskovc, CEO Zavod e-oblak

Cloud Standardization, Compliance and Certification. Class 2012 event 25.rd of October 2012 Dalibor Baskovc, CEO Zavod e-oblak Cloud Standardization, Compliance and Certification Class 2012 event 25.rd of October 2012 Dalibor Baskovc, CEO Zavod e-oblak Todays Agenda IT Resourcing with Cloud Computing and related challenges Landscape

More information

Interna'onal Standards Ac'vi'es on Cloud Security EVA KUIPER, CISA CISSP EVA.KUIPER@HP.COM HP ENTERPRISE SECURITY SERVICES

Interna'onal Standards Ac'vi'es on Cloud Security EVA KUIPER, CISA CISSP EVA.KUIPER@HP.COM HP ENTERPRISE SECURITY SERVICES Interna'onal Standards Ac'vi'es on Cloud Security EVA KUIPER, CISA CISSP EVA.KUIPER@HP.COM HP ENTERPRISE SECURITY SERVICES Agenda Importance of Common Cloud Standards Outline current work undertaken Define

More information

The Cloud Security Alliance

The Cloud Security Alliance The Cloud Security Alliance Daniele Catteddu, Managing Director EMEA & OCF-STAR Program Director Cloud Security Alliance ABOUT THE CLOUD SECURITY ALLIANCE To promote the use of best practices for providing

More information

ITU-T Security Standard Activities

ITU-T Security Standard Activities ITU-T Security Standard Activities Koji NAKAO Information Security Fellow, KDDI Corporation Rapporteur, Security Management, Q7/SG 17, ITU-T Chair of ISO/IEC JTC 1/SC 27/WG 4, Japan, & Co-Chair of RAISS

More information

A HYPE-FREE STROLL THROUGH CLOUD STORAGE SECURITY. Eric A. Hibbard, CISSP, CISA Hitachi Data Systems

A HYPE-FREE STROLL THROUGH CLOUD STORAGE SECURITY. Eric A. Hibbard, CISSP, CISA Hitachi Data Systems A HYPE-FREE STROLL THROUGH CLOUD STORAGE SECURITY Eric A. Hibbard, CISSP, CISA Hitachi Data Systems SNIA Legal Notice The material contained in this tutorial is copyrighted by the SNIA unless otherwise

More information

Cloud Standards - A Telco Perspective

Cloud Standards - A Telco Perspective Cloud Standards - A Telco Perspective Abdellatif Benjelloun Touimi abdellatif.benjelloun@huawei.com Corporate Standards Department www.huawei.com TEN YEARS OF CONNECTING EUROPE HUAWEI TECHNOLOGIES CO.,

More information

Cloud Computing ISO Security and Privacy Standards: 27017, 27018, 27001 Mike Edwards (Chair UK Cloud Standards Committee)

Cloud Computing ISO Security and Privacy Standards: 27017, 27018, 27001 Mike Edwards (Chair UK Cloud Standards Committee) Cloud Computing ISO Security and Privacy Standards: 27017, 27018, 27001 Mike Edwards (Chair UK Cloud Standards Committee) Mike Edwards Senior Technical Staff Member, IBM Cloud Computing & SOA Standards,

More information

White Paper on CLOUD COMPUTING

White Paper on CLOUD COMPUTING White Paper on CLOUD COMPUTING INDEX 1. Introduction 2. Features of Cloud Computing 3. Benefits of Cloud computing 4. Service models of Cloud Computing 5. Deployment models of Cloud Computing 6. Examples

More information

Cloud Security Standards. Aziza Al Rashdi Director, Cyber Security Professional Services Oman National CERT Information Technology Authority

Cloud Security Standards. Aziza Al Rashdi Director, Cyber Security Professional Services Oman National CERT Information Technology Authority Cloud Security Standards Aziza Al Rashdi Director, Cyber Security Professional Services Oman National CERT Information Technology Authority Introduction Sign Off December 2012 Information Technology Authority

More information

2011 Cloud Security Alliance, Inc. All rights reserved.

2011 Cloud Security Alliance, Inc. All rights reserved. Vast Landscape of Cloud Standards Development Organizations (SDOs) 2 4 Mission Statement (Non-Profit) Promote common level of understanding Consumers Providers Security Requirements Attestation of Assurance

More information

Cloud Computing and Security Risk Analysis Qing Liu Technology Architect STREAM Technology Lab Qing.Liu@chi.frb.org

Cloud Computing and Security Risk Analysis Qing Liu Technology Architect STREAM Technology Lab Qing.Liu@chi.frb.org Cloud Computing and Security Risk Analysis Qing Liu Technology Architect STREAM Technology Lab Qing.Liu@chi.frb.org 1 Disclaimers This presentation provides education on Cloud Computing and its security

More information

Standards for Cyber Security

Standards for Cyber Security Best Practices in Computer Network Defense: Incident Detection and Response M.E. Hathaway (Ed.) IOS Press, 2014 2014 The authors and IOS Press. All rights reserved. doi:10.3233/978-1-61499-372-8-97 97

More information

Standardised SLAs: how far can we go? DIHC, Euro-Par 2013, Aachan John Kennedy Intel Labs Europe

Standardised SLAs: how far can we go? DIHC, Euro-Par 2013, Aachan John Kennedy Intel Labs Europe Standardised SLAs: how far can we go? DIHC, Euro-Par 2013, Aachan John Kennedy Intel Labs Europe Before we begin AMD AT&T Microelectronics Digital Equipment Harris Semiconductor Hewlett-Packard IBM Intel

More information

Lifting the Fog Around Cloud Computing. Eric A. Hibbard, CISSP-ISSAP, ISSEP, ISSMP, CISA CTO Security & Privacy Hitachi Data systems

Lifting the Fog Around Cloud Computing. Eric A. Hibbard, CISSP-ISSAP, ISSEP, ISSMP, CISA CTO Security & Privacy Hitachi Data systems Lifting the Fog Around Cloud Computing Eric A. Hibbard, CISSP-ISSAP, ISSEP, ISSMP, CISA CTO Security & Privacy Hitachi Data systems 1 Straw Poll Cloud Awareness A. To truly understand clouds one should

More information

Cloud Computing Risk management @HKQAA Symposium Antony Ma Chairman, CSA-HK&M Chapter Global, not-for-profit organization Over 40,000 individual members, around 200 corporate and affiliate members, 64

More information

Standard Big Data Architecture and Infrastructure

Standard Big Data Architecture and Infrastructure Standard Big Data Architecture and Infrastructure Wo Chang Digital Data Advisor Information Technology Laboratory (ITL) National Institute of Standards and Technology (NIST) wchang@nist.gov May 20, 2016

More information

ISO/IEC JTC 1 SC 38 Cloud Works & Issues

ISO/IEC JTC 1 SC 38 Cloud Works & Issues ISO/IEC JTC 1 SC 38 Cloud Works & Issues International Cloud Symposium 2011 10-13 October 2011, Ditton Manor, UK Dr. Seungyun Lee syl@etri.re.kr International Cloud Symposium 2011, 10-13 October 2011,

More information

Part 2: ICT security standards and guidance documents

Part 2: ICT security standards and guidance documents Part 2: ICT security standards and guidance documents Version 3.0 April, 2007 Introduction The purpose of this part of the Security Standards Roadmap is to provide a summary of existing, approved ICT security

More information

M2M & Cybersecurity Workshop TIA 2013 M2M Standards and Security. Mihai Voicu CIO/CSO ILS Technology LLC

M2M & Cybersecurity Workshop TIA 2013 M2M Standards and Security. Mihai Voicu CIO/CSO ILS Technology LLC M2M & Cybersecurity Workshop TIA 2013 M2M Standards and Security Mihai Voicu CIO/CSO ILS Technology LLC Topics 1 What is the role of standardization in security for M2M solutions? 2 How are TIA and other

More information

Standards in the Digital Single Market: setting priorities and ensuring delivery

Standards in the Digital Single Market: setting priorities and ensuring delivery Case Id: 7ea2081f-7496-473e-a25f-805fd92c4aad Date: 04/01/2016 19:19:44 Standards in the Digital Single Market: setting priorities and ensuring delivery Fields marked with are mandatory. General information

More information

A view from the Cloud Security Alliance peephole

A view from the Cloud Security Alliance peephole A view from the Cloud Security Alliance peephole Cloud One million new mobile devices - each day! Social Networking Digital Natives State Sponsored Cyberattacks? Organized Crime? Legal Jurisdiction & Data

More information

A Big Picture for Big Data

A Big Picture for Big Data Supported by EU FP7 SCIDIP-ES, EU FP7 EarthServer A Big Picture for Big Data FOSS4G-Europe, Bremen, 2014-07-15 Peter Baumann Jacobs University rasdaman GmbH p.baumann@jacobs-university.de Our Stds Involvement

More information

A Flexible and Comprehensive Approach to a Cloud Compliance Program

A Flexible and Comprehensive Approach to a Cloud Compliance Program A Flexible and Comprehensive Approach to a Cloud Compliance Program Stuart Aston Microsoft UK Session ID: SPO-201 Session Classification: General Interest Compliance in the cloud Transparency Responsibility

More information

INTERNATIONAL TELECOMMUNICATION UNION

INTERNATIONAL TELECOMMUNICATION UNION INTERNATIONAL TELECOMMUNICATION UNION TELECOMMUNICATION STANDARDIZATION SECTOR STUDY PERIOD 2009-2012 English only Original: English Question(s): 4/17 Geneva, 11-20 February 2009 Ref. : TD 0244 Rev.2 Source:

More information

Terms of Reference. ITU-T Focus Group on Smart Cable Television (FG SmartCable)

Terms of Reference. ITU-T Focus Group on Smart Cable Television (FG SmartCable) Terms of Reference ITU-T Focus Group on Smart Cable Television (FG SmartCable) 1. Scope The Focus Group (FG), established in accordance with Recommendation ITU-T A.7 and under the auspices and charter

More information

ISO/IEC Information & ICT Security and Governance Standards in practice. Charles Provencher, Nurun Inc; Chair CAC-SC27 & CAC-CGIT

ISO/IEC Information & ICT Security and Governance Standards in practice. Charles Provencher, Nurun Inc; Chair CAC-SC27 & CAC-CGIT ISO/IEC Information & ICT Security and Governance Standards in practice Charles Provencher, Nurun Inc; Chair CAC-SC27 & CAC-CGIT June 4, 2009 ISO and IEC ISO (the International Organization for Standardization)

More information

TOOLS and BEST PRACTICES

TOOLS and BEST PRACTICES TOOLS and BEST PRACTICES Daniele Catteddu Managing Director EMEA, Cloud Security Alliance ABOUT THE CLOUD SECURITY ALLIANCE To promote the use of best practices for providing security assurance within

More information

Why & How Cloud computing is enabling the digital transformation of financial services institutions

Why & How Cloud computing is enabling the digital transformation of financial services institutions Why & How Cloud computing is enabling the digital transformation of financial services institutions There s no one billion customer bank yet, because there s no way to do it without cloud. Next generation

More information

Information Security ISO Standards. Feb 11, 2015. Glen Bruce Director, Enterprise Risk Security & Privacy

Information Security ISO Standards. Feb 11, 2015. Glen Bruce Director, Enterprise Risk Security & Privacy Information Security ISO Standards Feb 11, 2015 Glen Bruce Director, Enterprise Risk Security & Privacy Agenda 1. Introduction Information security risks and requirements 2. Information Security Management

More information

Comparative Analysis of SOA and Cloud Computing Architectures using Fact Based Modeling

Comparative Analysis of SOA and Cloud Computing Architectures using Fact Based Modeling Comparative Analysis of SOA and Cloud Computing Architectures using Fact Based Modeling Baba Piprani 1, Don Sheppard 2, Abbie Barbir 3 1 MetaGlobal Systems, Canada 2 ConCon Management Services, Canada

More information

Cloud Computing Governance & Security. Security Risks in the Cloud

Cloud Computing Governance & Security. Security Risks in the Cloud Cloud Computing Governance & Security The top ten questions you have to ask Mike Small CEng, FBCS, CITP Fellow Analyst, KuppingerCole This Webinar is supported by Agenda What is the Problem? Ten Cloud

More information

Standards in the Digital Single Market: setting priorities and ensuring delivery

Standards in the Digital Single Market: setting priorities and ensuring delivery Case Id: c2b48264-98a2-4dab-b05c-7e21b2b028b9 Date: 24/12/2015 15:19:42 Standards in the Digital Single Market: setting priorities and ensuring delivery Fields marked with are mandatory. General information

More information

The standards landscape in cloud

The standards landscape in cloud The standards landscape in cloud PRESENTATION computing TITLE GOES HERE Vincent Franceschini CTO Distributed Architectures, Hitachi Data System Chairman Emeritus, SNIA Governing Board Member, SNIA Cloud

More information

The identity management (IdM) ecosystem: minding the gaps

The identity management (IdM) ecosystem: minding the gaps The identity management (IdM) ecosystem: minding the gaps Tony Rutkowski trutkowski@verisign.com Georges Sebek sebek@itu.int Telecommunication Standardization Sector (ITU-T) International Telecommunication

More information

yvette@yvetteagostini.it yvette@yvetteagostini.it

yvette@yvetteagostini.it yvette@yvetteagostini.it 1 The following is merely a collection of notes taken during works, study and just-for-fun activities No copyright infringements intended: all sources are duly listed at the end of the document This work

More information

NIS Direktive und Europäische sicherheitsrelevante Projekte Udo Helmbrecht Executive Director, ENISA

NIS Direktive und Europäische sicherheitsrelevante Projekte Udo Helmbrecht Executive Director, ENISA NIS Direktive und Europäische sicherheitsrelevante Projekte Udo Helmbrecht Executive Director, ENISA ViS!T - Verwaltung integriert sichere Informationstechnologie, Wien, 29.10.2014 European Union Agency

More information

Privacy Management Standards: What They Are and Why They Are Needed Now

Privacy Management Standards: What They Are and Why They Are Needed Now ITU-T Q10/17 Identity Summit Geneva December 10, 2010 Privacy Management Standards: What They Are and Why They Are Needed Now John Sabo Director Global Government Relations Chair, OASIS IDtrust Member

More information

AIOTI ALLIANCE FOR INTERNET OF THINGS INNOVATION

AIOTI ALLIANCE FOR INTERNET OF THINGS INNOVATION Workshop "Platforms for connected Factories of the Future Brussels, October 5 th 2015 WG03 IoT Standardisation Juergen Heiles, Siemens AG, Germany 1 Introduction to Alliance for IoT Innovation - was launched

More information

Standardising privacy and security for the cloud

Standardising privacy and security for the cloud Standardising privacy and security for the cloud Chris Mitchell Royal Holloway, University of London www.chrismitchell.net 1 Acknowledgements Like to thank organisers of event for inviting me to contribute.

More information

Securing The Cloud. Foundational Best Practices For Securing Cloud Computing. Scott Clark. Insert presenter logo here on slide master

Securing The Cloud. Foundational Best Practices For Securing Cloud Computing. Scott Clark. Insert presenter logo here on slide master Securing The Cloud Foundational Best Practices For Securing Cloud Computing Scott Clark Agenda Introduction to Cloud Computing What is Different in the Cloud? CSA Guidance Additional Resources 2 What is

More information

Trusted Inter-Cloud Challenges

Trusted Inter-Cloud Challenges ITU Workshop on Future Trust and Knowledge Infrastructure, Phase 2 Geneva, Switzerland 1 July 2016 Trusted Inter-Cloud Challenges Dr Emil Kowalczyk Orange Polska, Emil.Kowalczyk@orange.com Motivation Inter-cloud

More information

Cloud Security Panel: Real World GRC Experiences. ISACA Atlanta s 2013 Annual Geek Week

Cloud Security Panel: Real World GRC Experiences. ISACA Atlanta s 2013 Annual Geek Week Cloud Security Panel: Real World GRC Experiences ISACA Atlanta s 2013 Annual Geek Week Agenda Introductions Recap: Overview of Cloud Computing and Why Auditors Should Care Reference Materials Panel/Questions

More information

Information Security, PII and Big Data

Information Security, PII and Big Data ITU Workshop on ICT Security Standardization for Developing Countries (Geneva, Switzerland, 15-16 September 2014) Information Security, PII and Big Data Edward (Ted) Humphreys ISO/IEC JTC 1/SC 27 (WG1

More information

EUK-02-2016: South Korea: IoT joint research

EUK-02-2016: South Korea: IoT joint research HORIZON 2020 WP 2016-17 EUK-02-2016: South Korea: IoT joint research DG CONNECT/DG AGRI/DG MOVE/DG RTD European Commission RIA EUK-02-2016: South Korea: IoT joint research Challenge: IoT has moved from

More information

EU Threat Landscape Threat Analysis in Research ENISA Workshop Brussels 24th February 2015

EU Threat Landscape Threat Analysis in Research ENISA Workshop Brussels 24th February 2015 EU Threat Landscape Threat Analysis in Research ENISA Workshop Brussels 24th February 2015 Aristotelis Tzafalias Trust and Security Unit H.4 DG Connect European Commission Trust and Security: One Mission

More information

Achievements and ongoing work in the ITU-T standardization of the Internet of Things

Achievements and ongoing work in the ITU-T standardization of the Internet of Things ITU Workshop on Standardization on IMT, M2M, IoT, Cloud Computing and SDN (Algiers, Algeria, 8 September 2013) Achievements and ongoing work in the ITU-T standardization of the Internet of Things Marco

More information

ISO/IEC JTC 1/SC 38 N 282

ISO/IEC JTC 1/SC 38 N 282 ISO/IEC JTC 1/SC 38 N 282 ISO/IEC JTC 1/SC 38 Distributed application platforms and services (DAPS) Secretariat: ANSI Document type: Request for comments Title: Draft Study Group on Cloud Computing Report

More information

STORAGE SECURITY TUTORIAL With a focus on Cloud Storage. Gordon Arnold, IBM

STORAGE SECURITY TUTORIAL With a focus on Cloud Storage. Gordon Arnold, IBM STORAGE SECURITY TUTORIAL With a focus on Cloud Storage Gordon Arnold, IBM SNIA Legal Notice The material contained in this tutorial is copyrighted by the SNIA. Member companies and individual members

More information

Security in the Green Cloud

Security in the Green Cloud Security in the Green Cloud Smart and Green infrastructure symposium 2011 Prague May 19 th 2011 Steinthor Bjarnason sbjarnas@cisco.com 2011 Cisco and/or its affiliates. All rights reserved. Cisco Public

More information

Cloud Computing Risk and Rewards

Cloud Computing Risk and Rewards Cloud Computing Risk and Rewards John Lazarine Vice President and Chief Audit Executive Mark Salamasick Director of Center for Internal Auditing For Dallas CPA Society Convergence 2013 May 8, 2013 John

More information

Cloud Security. DLT Solutions LLC June 2011. #DLTCloud

Cloud Security. DLT Solutions LLC June 2011. #DLTCloud Cloud Security DLT Solutions LLC June 2011 Contact Information DLT Cloud Advisory Group 1-855-CLOUD01 (256-8301) cloud@dlt.com www.dlt.com/cloud Your Hosts Van Ristau Chief Technology Officer, DLT Solutions

More information

Accelerating Cloud adoption with Security Level Agreements automation, monitoring and industry standards compliance

Accelerating Cloud adoption with Security Level Agreements automation, monitoring and industry standards compliance Accelerating Cloud adoption with Security Level Agreements automation, monitoring and industry standards compliance Cirrus Workshop, Vienna, Austria, November 19, 2013 Dr. Said Tabet Senior Technologist

More information

Cloud up to business processes

Cloud up to business processes Chris Francis IBM Technical Relations and Regulatory Affairs Cloud up to business processes Chris Francis Existing state of play Conventional solutions Software as a Service Platform as a Service Infrastructure

More information

NIST Cloud Computing Program Activities

NIST Cloud Computing Program Activities NIST Cloud Computing Program Overview The NIST Cloud Computing Program includes Strategic and Tactical efforts which were initiated in parallel, and are integrated as shown below: NIST Cloud Computing

More information

EUROPEAN COMMISSION ENTERPRISE AND INDUSTRY DIRECTORATE-GENERAL. Space, Security and GMES Security Research and Development

EUROPEAN COMMISSION ENTERPRISE AND INDUSTRY DIRECTORATE-GENERAL. Space, Security and GMES Security Research and Development Ref. Ares(2011)193990-22/02/2011 EUROPEAN COMMISSION ENTERPRISE AND INDUSTRY DIRECTORATE-GENERAL Space, Security and GMES Security Research and Development Brussels, 17 th February 2011 M/487 EN PROGRAMMING

More information

Cloud Computing Standards: Overview and first achievements in ITU-T SG13.

Cloud Computing Standards: Overview and first achievements in ITU-T SG13. Cloud Computing Standards: Overview and first achievements in ITU-T SG13. Dr ITU-T, Chairman of Cloud Computing Working Party, SG 13 Future Networks Orange Labs Networks, Cloud & Future Networks Standard

More information

CLOUD SERVICE LEVEL AGREEMENTS Meeting Customer and Provider needs

CLOUD SERVICE LEVEL AGREEMENTS Meeting Customer and Provider needs CLOUD SERVICE LEVEL AGREEMENTS Meeting Customer and Provider needs Eric Simmon January 28 th, 2014 BACKGROUND Federal Cloud Computing Strategy Efficiency improvements will shift resources towards higher-value

More information

A Funny Thing Happened On The Way To OASIS: From Specifications to Standards

A Funny Thing Happened On The Way To OASIS: From Specifications to Standards A Funny Thing Happened On The Way To OASIS: From Specifications to Standards Tom Millar Chief of Communications, US-CERT FIRST Berlin, June 18 th, 2015 Disclaimer This presentation is intended for informational

More information

Potential standardization items for the cloud computing in SC32

Potential standardization items for the cloud computing in SC32 WG2 N1665 Potential standardization items for the cloud computing in SC32 ISO/IEC JTC 1/SC 32 Plenary Meeting, Berlin, Germany, June 2012 Sungjoon Lim, Korea Database Agency (KDB) Dongwon Jeong, Kunsan

More information

GRC Stack Research Sponsorship

GRC Stack Research Sponsorship GRC Stack Research Sponsorship Overview Achieving Governance, Risk Management and Compliance (GRC) goals requires appropriate assessment criteria, relevant control objectives and timely access to necessary

More information

NIST Cloud Computing Security Reference Architecture (SP 500-299 draft)

NIST Cloud Computing Security Reference Architecture (SP 500-299 draft) NIST Cloud Computing Security Reference Architecture (SP 500-299 draft) NIST Cloud Computing Security Working Group Dr. Michaela Iorga, NIST Senior Security Technical Lead for Cloud Computing Chair, NIST

More information

Cloud Standards Coordination Final Report November 2013 VERSION 1.0

Cloud Standards Coordination Final Report November 2013 VERSION 1.0 November 2013 VERSION 1.0 Executive Summary The European Commission Communication on the European Cloud strategy identifies a key action for standardisation in this context: Key action 1: Cutting through

More information

Standardization Requirements Analysis on Big Data in Public Sector based on Potential Business Models

Standardization Requirements Analysis on Big Data in Public Sector based on Potential Business Models , pp. 165-172 http://dx.doi.org/10.14257/ijseia.2014.8.11.15 Standardization Requirements Analysis on Big Data in Public Sector based on Potential Business Models Suwook Ha 1, Seungyun Lee 2 and Kangchan

More information

The European Alliance for IoT Innovation

The European Alliance for IoT Innovation The European Alliance for IoT Innovation An Innovation Perspective Rolf Riemenschneider Thibaut Kleiner DG CONNECT E1 Network Technologies European Commission 1 Value creation from digitisation: Products,

More information

A HYPE-FREE STROLL THROUGH CLOUD STORAGE SECURITY

A HYPE-FREE STROLL THROUGH CLOUD STORAGE SECURITY A HYPE-FREE STROLL THROUGH CLOUD STORAGE SECURITY Eric A. Hibbard, CISSP, CISA, ISSAP, ISSMP, ISSEP, SCSE Hitachi Data Systems Author: Eric A. Hibbard, Hitachi Data Systems SNIA Legal Notice The material

More information

Status Report on Storage Security Initiatives

Status Report on Storage Security Initiatives Status Report on Storage Security Initiatives Eric A. Hibbard, CISSP, CISA Sr. Director, Data Networking Technology Hitachi Data Systems Abstract This presentation will review the storage security initiatives

More information

A HYPE-FREE STROLL THROUGH CLOUD STORAGE SECURITY

A HYPE-FREE STROLL THROUGH CLOUD STORAGE SECURITY Eric A. Hibbard, CISSP, CISA, ISSAP, ISSMP, ISSEP, SCSE Hitachi Data Systems A HYPE-FREE STROLL THROUGH CLOUD STORAGE SECURITY Subhash Sankuratripati NetApp SNIA Legal Notice The material contained in

More information

Robert Brammer. Senior Advisor to the Internet2 CEO rfbtech@internet2.edu. Internet2 NET+ Security Assessment Forum. 8 April 2014

Robert Brammer. Senior Advisor to the Internet2 CEO rfbtech@internet2.edu. Internet2 NET+ Security Assessment Forum. 8 April 2014 Robert Brammer Senior Advisor to the Internet2 CEO rfbtech@internet2.edu Internet2 NET+ Security Assessment Forum 8 April 2014 INTERNET2 NET+ Security Initiative Primary objective -- develop guidance to

More information

IEEE Standards Association (IEEE-SA)

IEEE Standards Association (IEEE-SA) IEEE Standards Association (IEEE-SA) NetFutures Conference Brussels, Belgium April 2016 Dr. Konstantinos Karachalios Managing Director IEEE Standards Association About us Global Markets, Global Standards

More information

Guiding principles for security in a networked society

Guiding principles for security in a networked society ericsson White paper Uen 307 23-3230 February 2014 Guiding principles for security in a networked society The technological evolution that makes the Networked Society possible brings positive change in

More information

A Comprehensive Study on Cloud Computing Standardization

A Comprehensive Study on Cloud Computing Standardization A Comprehensive Study on Cloud Computing Standardization Dr. Mukesh Chandra Negi Project Manager, Tech Mahindra Ltd, Noida, India ABSTRACT: Standard is a trust between standardization body, buyers and

More information

CEN and CENELEC response to the EC Consultation on Standards in the Digital Single Market: setting priorities and ensuring delivery January 2016

CEN and CENELEC response to the EC Consultation on Standards in the Digital Single Market: setting priorities and ensuring delivery January 2016 CEN Identification number in the EC register: 63623305522-13 CENELEC Identification number in the EC register: 58258552517-56 CEN and CENELEC response to the EC Consultation on Standards in the Digital

More information

Smart Grid Information Security

Smart Grid Information Security CEN-CENELEC-ETSI Smart Grid Coordination Group Date: 2014-12 Secretariat: CCMC CEN-CENELEC-ETSI Smart Grid Coordination Group M490-SGCG-SGIS-Intermediate-Report-V1.pdf 1 Contents Page 2 3 4 5 6 7 8 9 10

More information

Cloud computing and personal data protection. Gwendal LE GRAND Director of technology and innovation CNIL

Cloud computing and personal data protection. Gwendal LE GRAND Director of technology and innovation CNIL Cloud computing and personal data protection Gwendal LE GRAND Director of technology and innovation CNIL 1 Data protection in Europe Directive 95/46/EC Loi 78-17 du 6 janvier 1978 amended in 2004 (France)

More information

Approach to Information Security Architecture. Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera

Approach to Information Security Architecture. Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera Approach to Information Security Architecture Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera About TeliaSonera TeliaSonera provides network access and telecommunication services that help

More information

TRUSTED CLOUD. Our commitment to provide a cloud you can trust. Fernando Machado Píriz September 2014

TRUSTED CLOUD. Our commitment to provide a cloud you can trust. Fernando Machado Píriz September 2014 TRUSTED CLOUD Our commitment to provide a cloud you can trust Fernando Machado Píriz September 2014 Technology Trends Driving cloud adoption 71% of strategic buyers cite scalability, cost and business

More information

PCI Compliance and the Cloud: What You Can and What You Can t Outsource Presented By:

PCI Compliance and the Cloud: What You Can and What You Can t Outsource Presented By: PCI Compliance and the Cloud: What You Can and What You Can t Outsource Presented By: Peter Spier Managing Director PCI and Risk Assurance Fortrex Technologies Agenda Instructor Biography Background On

More information

Testimony of. Kevin Stine. Leader, Security Outreach and Integration Group. Computer Security Division. Information Technology Laboratory

Testimony of. Kevin Stine. Leader, Security Outreach and Integration Group. Computer Security Division. Information Technology Laboratory Testimony of Kevin Stine Leader, Security Outreach and Integration Group Computer Security Division Information Technology Laboratory National Institute of Standards and Technology United States Department

More information

Cloud Security considerations for business adoption. Ricci IEONG CSA-HK&M Chapter

Cloud Security considerations for business adoption. Ricci IEONG CSA-HK&M Chapter Cloud Security considerations for business adoption Ricci IEONG CSA-HK&M Chapter What is Cloud Computing? Slide 2 What is Cloud Computing? My Cloud @ Internet Pogoplug What is Cloud Computing? Compute

More information

Smart Grid Standardization

Smart Grid Standardization Smart Grid Standardization CONFERENCE ON ROLLING PLAN ON ICT STANDARDISATION Session 3: Sustainable Growth: Smart grids and smart meters, ICT environment Brussels, 2014-03-25 Page 1 CEN-CENELEC-ETSI Smart

More information

HIPAA CRITICAL AREAS TECHNICAL SECURITY FOCUS FOR CLOUD DEPLOYMENT

HIPAA CRITICAL AREAS TECHNICAL SECURITY FOCUS FOR CLOUD DEPLOYMENT HIPAA CRITICAL AREAS TECHNICAL SECURITY FOCUS FOR CLOUD DEPLOYMENT A Review List This paper was put together with Security in mind, ISO, and HIPAA, for guidance as you move into a cloud deployment Dr.

More information

Toward global Interoperable Identity Management

Toward global Interoperable Identity Management ITU-T Joint Meeting on the IdM Focus Group Reports Toward global Interoperable Identity Management Anthony-Michael Rutkowski Vice-President, VeriSign Chair, ITU-T IdM FG Requirements WG Geneva, 10-11 September

More information