CLOUD SECURITY: THE GRAND CHALLENGE

Transcription

1 Government Ware: GovWare Singapore September 29, 2010 CLOUD SECURITY: THE GRAND CHALLENGE Glen Gooding Asia Pacific Security Leader IBM Corporation

2 Rest safe: Google saves the day

3 Agenda Components of Cloud Market Basic Security Concepts Today and tomorrow IBM s vision of a Security Framework IBM Cloud Security Guidance Conceptual findings from Security Framework Government Authentication Cloud Example 3

4 Workloads Most Considered for Cloud Delivery Top public workloads Audio/video/Web conferencing Service help desk Infrastructure for training and demonstration WAN capacity and VoIP infrastructure Desktop Test environment infrastructure Storage Data center network capacity Server Top private workloads Data mining, text mining, or other analytics Security Data warehouses or data marts Business continuity and disaster recovery Test environment infrastructure Long-term data archiving/preservation Transactional databases Industry-specific applications ERP applications Infrastructure and collaboration workloads emerge as most appropriate Database, application and infrastructure workloads emerge as most appropriate Source: IBM Market Insights, Cloud Computing Research, July n=1,090 4

5 CLOUD MODEL APPLIES AT ALL LEVELS OF THE IT STACK Resulting in Different Security Requirements, Different Responsibilities The Cloud Curtain The Cloud Curtain Curtain 5

6 WHAT IS CLOUD SECURITY? Confidentiality, Integrity, Availability of business-critical IT assets Stored or processed on a cloud computing platform Cloud Computing Software as a Service Utility Computing Grid Computing 6 There is nothing new under the sun but there are lots of old things we don't know. Ambrose Bierce, The Devil's Dictionary

7 CLOUD SECURITY: SIMPLE EXAMPLE Today s Data Center Tomorrow s Public Cloud We Have Control It s located at X. It s stored in server s Y, Z. We have backups in place. Our admins control access. CLOUD SECURITY: SIMPLE EXAMPLE Our uptime is sufficient. The auditors are happy. Our security team is engaged.?????? Who Has Control? Where is it located? Where is it stored? Who backs it up? Who has access? How resilient is it? How do auditors observe? How does our security team engage? 7

8 CATEGORIES OF CLOUD COMPUTING RISKS Control Many companies and governments are uncomfortable with the idea of their information located on systems they do not control. Data Migrating workloads to a shared network and compute infrastructure increases the potential for unauthorized exposure. Providers must offer a high degree of security transparency to help put customers at ease. Reliability High availability will be a key concern. IT departments will worry about a loss of service should outages occur. Authentication and access technologies become increasingly important. Compliance Complying with regulations may prohibit the use of clouds for some applications. Comprehensive auditing capabilities are essential. Mission critical applications may not run in the cloud without strong availability guarantees. Security Management Even the simplest of tasks may be behind layers of abstraction or performed by someone else. Providers must supply easy controls to manage security settings for application and runtime environments. 8

9 IBM SECURITY FRAMEWORK Built to meet four key requirements: Provide Assurance Enable Intelligence Automate Process Improve Resilience Introducing the IBM Security Framework and IBM Security Blueprint to Realize Business-Driven Security; IBM RedGuide REDP , July

10 IBM approach to security on a Smart Planet Secure by Design Assurance Enable trust and confidence in IT through software and system assurance IBM Integrated Product Development Process System z Integrity Statement Trusted Foundry IBM High Assurance Platform Continuous Software Quality IBM Secure Blue Foundational Controls Intelligence Stay ahead of the threat by monitoring the attack landscape and anticipating new threats IBM X-Force IBM Managed Security Services System S Event & Streaming System High Performance Computing Information Risk & Compliance Smart Surveillance Powered by IBM Research Open standards leadership in DMTF, IETF, OASIS, TCG, W3C, SOA & Web Services Security IBM Security Blueprint IBM Trusted Identity Fine-grained Security Trusted Virtual Data Center UK/US ITA, IBM OCR, EU FP7 open research Enable security and privacy with an open, standards-based architectural approach Standards IBM Service Management Platform asset management, problem & incident management, change & release management, etc. IBM Process Reference Model for IT (PRM-IT) IBM Rational Unified Process Patch management for virtual images Provide visibility, control and automation through CoBIT and ITIL-based service management Governance 10

11 TYPICAL CLIENT SECURITY REQUIREMENTS Governance, Risk Management, Compliance 3rd-party audit (SAS 70(2), ISO27001/2, PCI) Client access to tenant-specific log and audit data Effective incident reporting for tenants Visibility into change, incident, image management, etc. SLAs, option to transfer risk from tenant to provider Support for forensics Support for e-discovery Application and Process Application security requirements for cloud are phrased in terms of image security Compliance with secure development best practices Physical Monitoring and control of physical access People and Identity Privileged user monitoring, including logging activities, physical monitoring and background checking Federated identity / onboarding: Coordinating authentication and authorization with enterprise or third party systems Standards-based SSO Data and Information Data segregation Client control over geographic location of data Government: Cloud-wide data classification Network, Server, Endpoint Isolation between tenant domains Trusted virtual domains: policy-based security zones Built-in intrusion detection and prevention Vulnerability Management Protect machine images from corruption and abuse Government: MILS-type separation Based on interviews with clients and various analyst reports 11

12 IBM CLOUD SECURITY GUIDANCE DOCUMENT Based on cross-ibm research on cloud security Highlights a series of best practice controls that should be implemented Broken into 7 critical infrastructure components: Building a Security Program Confidential Data Protection Implementing Strong Access and Identity Application Provisioning and De-provisioning Governance Audit Management Vulnerability Management Testing and Validation 12

13 Security governance, risk management and compliance IBM Security Framework Customers require visibility into the security posture of their cloud. Implement a governance and audit management program Establish 3rd-party audits (ISO27001, PCI) Provide access to tenant-specific log and audit data IBM Cloud Security Guidance Document Create effective incident reporting for tenants Visibility into change, incident, image management, etc. Understand applicable regional, national and international laws Support for forensics and e-discovery 13

14 People and Identity Customers require proper authentication of cloud users. IBM Security Framework Implement strong identity and access management Privileged user monitoring, including logging activities, physical monitoring and background checking IBM Cloud Security Guidance Document Utilize federated identity to coordinate authentication and authorization with enterprise or third party systems A standards-based, single sign-on capability 14

15 Data and Information IBM Security Framework Customers cite data protection as their most important concern within the cloud. Ensure confidential data protection IBM Cloud Security Guidance Document Use a secure network protocol when connecting to a secure information store. Implement a firewall to isolate confidential information, and ensure that all confidential information is stored behind the firewall. Sensitive information not essential to the business should be securely destroyed. 15

16 Application and Process IBM Security Framework Customers require secure cloud applications and provider processes. Establish application and environment provisioning Implement a program for application and image provisioning. IBM Cloud Security Guidance Document Develop all Web based applications using secure coding guidelines. Ensure external facing Web applications are black box tested A secure application testing program should be implemented. Ensure all changes to virtual images and applications are logged. 16

17 Network, Server and End Point IBM Security Framework Customers expect a secure cloud operating environment.. Maintain environment testing and vulnerability/intrusion management Implement vulnerability scanning, anti-virus, intrusion detection and prevention on all appropriate images IBM Cloud Security Guidance Document Ensure isolation exists between tenant domains Trusted virtual domains: policy-based security zones Ensure provisioning management is strictly controlled Protect machine images from corruption and abuse Ensure provisioned images apply appropriate access rights Ensure destruction of outdated images 17

18 Physical Security IBM Security Framework IBM Cloud Security Guidance Document Customers expect cloud data centers to be physically secure.. Implement a physical environment security plan Ensure the facility has appropriate controls to monitor access. Prevent unauthorized entrance to critical areas within facilities e.g. servers, routers, storage, power supplies Biometric access of employees Ensure that all employees with direct access to systems have full background checks. Provide adequate protection against natural disasters. 18

19 My thoughts on critical components IBM Security Framework Customers want to hear how IBM can deliver secure Government cloud solutions.. Areas of expertise IBM can deliver on Enterprise wide Government security and compliance Database security compliance IBM Cloud Security Guidance Document Virtualization and security implication IBM s involvement in Government Cloud Solutions A Real Use Case 19

20 Virtualization First Step in Journey to Cloud Computing Rapid deployment of infrastructure and applications. Request-driven service management. Service Catalog. Cloud Computing Virtualization. Better hardware utilization. Improved IT agility. Server Consolidation. Streamline Operations manage physical and virtual systems. Lower power consumption. Integrated service lifecycle mgmt. Expose resources asa-service. Integrated Security infrastructure. Rapid provisioning of IT resources, massive scaling. Dynamic service mgmt. Energy saving via auto workload distribution. 20

21 Security Challenges with Virtualization: New Risks Traditional Threats New threats to VM environments Traditional threats can attack VMs just like real systems Management Vulnerabilities Secure storage of VMs and the management data Requires new skill sets Insider threat Virtual server sprawl Dynamic state Dynamic relocation Resource sharing Single point of failure Loss of visibility Stealth rootkits MORE COMPONENTS = MORE EXPOSURE 21

22 Server and Network Convergence 22

23 Cloud compliance: Security Information and Event Management How to provide a single, integrated product that delivers insider threat, audit and compliance. Key Features Single, integrated product Log Management Reporting Unique ability to monitor user behavior Enterprise compliance dashboard Compliance management modules and regulation-specific reports Broadest, most complete log and audit trail capture capability W7 log normalization translates your logs into business terms Easy ability to compare behavior to regulatory and company policies Multi-tennancy support through scoping 24

24 Real-Time Database Security & Monitoring DB2 SQL SQL Server Server Non-invasive No DBMS changes Minimal impact Does not rely on traditional DBMS-resident logs that can easily be disabled by DBAs Granular policies & monitoring Who, what, when, how Real-time alerting Monitors all activities including local access by privileged users 25

25 Australian Federal Government Cloud based Authentication Hub 26

26 In a browser, hit IBM 27Insight Forum 09

27 Click Login to myaccount IBM 28Insight Forum 09

28 Provide your logon details 29 IBM Insight Forum 09

29 IBM 30Insight Forum 09

30 Provide the correct answer to your previously registered secret question IBM 31Insight Forum 09

31 I And am now have access to authenticated Centrelink and Medicare IBM 32Insight Forum 09

32 Clicking on the Medicare link, takes me to Medicare s site IBM 33Insight Forum 09

33 Return to myaccount page IBM 34Insight Forum 09

34 I have access to Centrelink and Medicare IBM 35Insight Forum 09

35 Return to myaccount page Clicking on the Centrelink link, takes me to Centrelink s site IBM 36Insight Forum 09

36 IBM 37Insight Forum 09

37 SUMMARY Cloud is a new consumption and delivery model inspired by consumer Internet services. Security Remains the Top Concern for Cloud Adoption One sized security doesn t fit all Take a structured approach to securing your cloud environment Documented guidance is available for download to assist you in securing your cloud environment IBM has a view from End to End when it addresses your security needs 38

38 Thank You. ONE voice for security. IBM SECURITY SOLUTIONS INNOVATIVE products and services. IBM SECURITY FRAMEWORK COMMITTED to the vision of a Secure Smarter Planet. SECURE BY DESIGN 39