Addressing Security for Hybrid Cloud

Transcription

1 Addressing Security for Hybrid Cloud Sreekanth Iyer Executive IT Architect IBM Cloud (CTO Office) sreek.iyer@in.ibm.com Blog: July 18, 2015

2 Cloud is rapidly transforming the enterprise Data archive HR, CRM, SCM IBM IBM Offerings Offerings Online website IaaS Infrastructure services PaaS Development services SaaS Business applications App development Traditional Enterprise IT External Stakeholders Private Cloud Public Cloud

3 Clients security objectives reflect their Cloud adoption Securely connect and consume Cloud business applications (SaaS) Services Organization Security Responsibilities and Objectives Software as a Service (SaaS) CxOs (CIO, CMO, CHRO,...) Complete visibility to enterprise SaaS usage and risk profiling Governance of user access to SaaS and identity federation Securely migrate workloads and applications to Cloud (IaaS, PaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS) Application teams, LOBs CIO, IT teams Enable developers to compose secure cloud applications and APIs, with enhanced user experience Visibility and protection against fraud and applications threats Protect the cloud infrastructure to securely deploy workloads and meet compliance objectives Have full operational visibility across hybrid cloud deployments, and govern usage

4 Traditional perimeter based security controls Trusted Intranet DMZ Untrusted Internet Online Banking Application Employee Application 4

5 are changing to security centered around applications and data Cloud Local (IaaS/PaaS) Trusted Intranet DMZ Untrusted Internet Investment API Services Consume Apps and Services (SaaS) Online Banking Application Build and Deliver Apps, Services (PaaS) Apps, APIs Services Employee Application Leverage Public Clouds (IaaS) 5

6 Cloud presents the opportunity to radically transform security practices Traditional Security Manual, static, and reactive Dynamic Cloud Security Standardized, automated, agile, and elastic Cloud security is not only achievable, it is an opportunity to drive the business, improve defenses and reduce risk

7 Clients focus on three imperatives for improving security How can I understand who is accessing the cloud from anywhere, at anytime? How can I fix vulnerabilities and defend against attacks before they re exploited? How can I obtain a comprehensive view of cloud and traditional environments? Govern the usage of cloud Protect workloads and data in the cloud Detect threats with visibility across clouds Going to the cloud gives me a single choke point for all user access it provides much more control. Cloud gives me security APIs and preconfigured policies to help protect my data and workloads I can take advantage of centralized cloud logging and auditing interfaces to hunt for attacks.

8 We see three key cloud scenarios to help our customers Cloud Security Capabilities Client Consumption Models SaaS: Secure usage of business applications Bluemix PaaS: Secure service composition and apps Manage Access Manage identities and govern user access Protect Data Protect infrastructure, applications, and data from threats Gain Visibility Auditable intelligence on cloud access, activity, cost and compliance Security SaaS APIs Virtual Appliances Managed Security Services Professional Security Services IaaS: Securing infrastructure and workloads

9 Examples - Enterprise hybrid cloud adoption requires integrated security solutions Manage Access Protect Data Gain Visibility Software as a service (SaaS) Enable employees to connect securely to SaaS SaaS access governance Identity federation Secure connectivity and data movement to SaaS Data tokenization Secure proxy to SaaS Application control Monitoring and risk profiling of enterprise SaaS usage Monitor SaaS usage Risk profiling of SaaS apps Compliance reporting Integrate identity and access into services and applications Build and deploy secure services and applications Log, audit at service and application level Platform as a Service (PaaS) DevOps access management Authentication and authorization APIs Database encryption App security scanning Threat and Fraud protection Monitor application, services and platform Service vulnerabilities Compliance reporting Manage cloud administration and workload access Protect the cloud infrastructure to securely deploy workloads Security monitoring and intelligence Infrastructure as a Service (IaaS) Privileged admin management Access management of web workloads Storage encryption Network protection firewalls, IPS Host security, vulnerability scanning Monitor hybrid cloud infrastructure Monitor workloads Log, audit, analysis and compliance reporting Note: Listed capabilities in the above table are examples of capabilities, and not a comprehensive list

10 Structured Approach to Cloud Security IaaS PaaS SaaS IBM Cloud Security Manage Access Protect Data Gain Visibility Optimize Security Operations

11 Securing Cloud JKE Scenario 11

12 Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in these materials may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.