Trust but Verify. Vincent Campitelli. VP IT Risk Management

Transcription

1

2 Trust but Verify Vincent Campitelli VP IT Risk Management McKesson Corporation

3 Trust but Verify Cloud Security 3

4 Agenda Cloud Defined Cloud Opportunities Cloud Challenges What s Different? How to Verify Key Takeaways 4

5 The Cloud defined? 5

6 Attributes ELASTIC SERVICE DELIVERY MULTI-TENANT ON-DEMAND FLEXIBLE BILLING SELF-SERVICE 6

7 Cloud Service offerings Software-as-a Service (SaaS) Platform-as-a Service (PaaS) Infrastructure-as a Service (IasS) 7

8 SaaS Definition Software deployment model in which a Third party owns, hosts and manages the software application and ddelivers it as a service to the end customer Target Market End-user with specific business functionality requirements Examples Salesforce.com, Google Docs, MS Office Live/Online 8

9 PaaS Definition Target Market Software deployment platform available as a service that supports the end-to-end software development lifecycle, including design,testing and deployment. Software developers and independent software vendors Examples Windows Azure, Google App Engine 9

10 IaaS Definition Target Market Service-based model for provisioning core computing power - servers, storage and network resources - for deployment and execution of externally hosted applications Software architects, infrastructure groups network/system administrators Examples Amazon EC2/S3, Oracle Coherence 10

11 Cloud Business Models Public clouds - make resources available dynamically over the Internet from third-party providers - the most commonly described model Private cloud - models deploying advanced use of virtualization technologies inside an enterprise to emulate cloud computing benefits via an internal infrastructure Managed Cloud - provided by designated service providers on a single tenant or multi-tenant operating environment. The physical infrastructure is owned by and /or physically located in the organization s data centers with management and security functions provided by a designated service provider Hybrid cloud - combine features public and private cloud models - (leverage virtualized architecture inside the enterprise to an external, off premise cloud architecture) 11

12 Cloud Business Models Who manages it? Who owns it? Where is it located? Who has access to it? How is it accessed? 12

13 Cloud Opportunities 13

14 Cloud Attractions PERCENT RESPONDING 14

15 Cloud Challenges 15

16 FEAR OF UNAUTHORIZED ACCESS/DATA LEAKAGE RE:CUSTOMER DATA FEAR OF UNAUTHORIZED ACCESS/DATA LEAKAGE RE: IP OTHER FEATURES /MATURITY OF TECHNOLOGY UNPREDICTABLE COSTS VENDOR LOCK-IN = PROVIDER SUSTAINABILITY = EMBEDDED SECURITY DEFECTS 16 APPLICATION/SYSTEM PERFORMANCE

17 WHAT S DIFFERENT? New delivery paradigm New technology abstractions 17

18 Moving out of the DC OLD Specification, configuration and operation Enterprise policies,procedures, controls Physical / logical access controls Configuration status/monitoring Patch testing / management Data/application controls-linked to physical device Network controls - connected to devices Security Standards Techniques 18 NEW Security Standards Techniques

19 Moving into the Cloud Virtualization 19

20 SECURITY IMPLICATIONS INFRASTRUCTURE PROCESS DISCIPLINE ACCESS RIGHTS NEW RISKS 20

21 Infrastructure Best Practices Network security Segmentation Audit logging 21

22 Infrastructure Best Practices Platform Hardening Configuration Change Management 22

23 Infrastructure t Best Practices Reporting Monitoring Automation 23

24 Access Rights Applications Applications OS Applications OS OS Hypervisor Hardware Hardware 24

25 New Risks Increased DR complexity Virtual Network Traffic Application of Reg/Stds ( PCI) Software Licensing i Host Server - administration E-discovery 25

26 How to Verify? PRE-CLOUD 26 In the Cloud

27 Verification Fundamentals Standards Portability Transparency 27

28 Cloud customer expectations 1 46 % 46 % 26% 33% 17% 16% 3% 13% 5% 3% PERCENT RESPONDING 1= Information week 2010 Cloud GRC Survey 28

29 Yes, BUT 29

30 Solutions Strategic deployment Self-service appliances The Uber Cloud 30

31 Strategic deployment H PRIVATE CLOUD BUSINESS RISK HYBRID CLOUD PUBLIC CLOUD L CLOUD RISK 31 H

32 Self Service Configuration Vulnerability Anchoring Audit Log Service Management 32

33 Uber Cloud Decision Support Automated arrangement coordination Cloud Audit 33

34 Key Takeaways Define Business Risk Define Cloud Risk Match reward with risk Design assurance program Implement and monitor 34

35 Thank you!