CONSIDERING CLOUD? LEARN ABOUT CURRENT TRENDS IN CLOUD COMPUTING

Transcription

1 CONSIDERING CLOUD? LEARN ABOUT CURRENT TRENDS IN CLOUD COMPUTING Jeff Jones Microsoft Trustworthy Computing Frank Simorjay Microsoft Trustworthy Computing Session ID: ARCH-W08 Session Classification: Intermediate

2 Who are these guys? Company Microsoft Corporation Trustworthy Computing group Jeff Jones Director, Trustworthy Computing 25-year Security Guy : DoD, TIS, McAfee, PGP, MSFT Microsoft Security Blog & Trustworthy Computing Frank Simorjay Sr. Product Manager, Trustworthy Computing Author and designer of CSRT, OSA paper many others Work extensively with community -ISSA Distinguished Fellow Worked at NFR (small world Jeff and I both worked with Marcus) #RSAC Presenter Logo

3

4 Session Objectives The reality of security controls in data centers Understand potential cloud adoption benefits Quickly assess your security control Assess the impact of cloud adoption We are data geeks Our idea of fun is strange, maybe yours is as well #RSAC Presenter Logo

5 What You Will Hear Today #RSAC Presenter Logo

6 #RSAC Overview

7 Measured service Resource pooling IaaS PaaS SaaS Broad network access Selfservice Rapid elasticity

8 RESPONSIBILITY: IaaS PaaS SaaS Data classification Client and end point protection CLOUD CUSTOMER Identity and access management Application level controls Host security Network controls CLOUD PROVIDER Physical security

9 BENEFITS CONCERNS scalability increased agility flexibility Reduced costs privacy security reliability

10 Most Individuals confused by cloud computing

11 Microsoft Cloud Security Readiness Tool #RSAC

12

13

14 Cloud Security Readiness Tool

15 How it works

16 security policies and procedures? employee change/termination process? security policies and procedures? capacity planning efforts? security policies review process? physical security access method? staging to production requirements? selects its data center location(s)? Control security program is updated? equipment support contracts? application testing using customer data? redundancy if utility service outages should occur? /question personnel background checks? data classification efforts? asset inventory program? patch management processes? (NDA) requirements? grants access to data? conducts risk assessments? antivirus efforts? physical access by role? data retention and recovery program? responds to an incident? firewalls to protect data? security policies and procedures? destroys data? disaster recovery plan? time setting policies?

17

18 #RSAC CSRT Demo

19

20 #RSAC Cloud Trends

21

22 50% 40% 30% Infrastructure As A Service (IaaS) 20% Platform As A Service (PaaS) 10% Software As A Service (SAAS) 0% 1 4 PCs 5 24 PCs PCs PCs PCs PCs PCs PCs PCs

23 USA/ME/Africa/Australia Europe/Asia ISO/IEC NIST Guidelines PCI DSS v2.0 Enisa NIST Guidelines PCI DSS v2.0

24 24

25 20% 10% 0% -10% -20% -30% -40% -50% -60% -26.9% -26.5% -22.8% -15.7% -41.0% -5.8% -24.0% -24.2% -39.4% -34.9% -52.4% Incident reporting -12.7% -31.6% -25.3% -9.0% Employee agreement % -30.6% -35.6% Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8 Q9 Q10 Q11 Q12 Q13 Q14 Q15 Q16 Q17 Q18 Q19 Q20 Q21 Q22 Q23 Q24 Q25 Q26 Q % -25.7% -44.3% -28.7% -32.8% -16.4% 14.7% -12.6% Capacity planning Anti-malware -0.4% Values were assigned to each of the four possible answers for each question: If the answer was Almost There or Streamlined, a +1 value was assigned for maturity. If the answer was Getting Started or Making Progress, a -1 value was assigned for maturity.

26 Which of these statements best describes your organization's antivirus efforts?

27 100% Worldwide Europe North America 80% 60% 40% 20% 0% Getting Started Making Progress Almost There Streamlined

28 100% Worldwide Europe North America 80% 60% 40% 20% 0% Getting Started Making Progress Almost There Streamlined

29 Unprotected Intermittently protected Always protected

30 Which of these statements best describes your organization's nondisclosure agreement (NDA) requirements?

31 100% 80% Worldwide Asia Europe North America 60% 40% 20% 0% Getting Started Making Progress Almost There Streamlined

32 Which of these statements best describes your organization's capacity planning efforts?

33 100% Worldwide Asia Europe North America 80% 60% 40% 20% 0% Getting Started Making Progress Almost There Streamlined

34 25% Small/Mid Enterprize 20% 15% 10% 5% 0% Getting Started Making Progress Almost There Streamlined

35 security policies and procedures? employee change/termination process? security policies and procedures? capacity planning efforts? security policies review process? physical security access method? staging to production requirements? selects its data center location(s)? Control security program is updated? equipment support contracts? application testing using customer data? redundancy if utility service outages should occur? /question personnel background checks? data classification efforts? asset inventory program? patch management processes? (NDA) requirements? grants access to data? conducts risk assessments? antivirus efforts? physical access by role? data retention and recovery program? responds to an incident? firewalls to protect data? security policies and procedures? destroys data? disaster recovery plan? time setting policies?

36 Which of these statements best describes how your organization responds to an incident?

37 100% Worldwide Asia Europe North America 80% 60% 40% 20% 0% Getting Started Making Progress Almost There Streamlined

38 100% Worldwide Europe North America 80% 60% 40% 20% 0% Getting Started Making Progress Almost There Streamlined

39 20% 10% 0% -10% -20% -30% -40% -50% -60% -26.9% -26.5% -22.8% -15.7% -41.0% -5.8% -24.0% -24.2% -39.4% -34.9% -52.4% Incident reporting -12.7% -31.6% -25.3% -9.0% Employee agreement % -30.6% -35.6% Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8 Q9 Q10 Q11 Q12 Q13 Q14 Q15 Q16 Q17 Q18 Q19 Q20 Q21 Q22 Q23 Q24 Q25 Q26 Q % -25.7% -44.3% -28.7% -32.8% -16.4% 14.7% -12.6% Capacity planning Anti-malware -0.4% Values were assigned to each of the four possible answers for each question: If the answer was Almost There or Streamlined, a +1 value was assigned for maturity. If the answer was Getting Started or Making Progress, a -1 value was assigned for maturity.

40

41 Thank you! Jeff Jones Microsoft Trustworthy Computing Frank Simorjay Microsoft Trustworthy Computing #RSAC

42