Trust but Verify Vincent Campitelli VP IT Risk Management McKesson Corporation
Trust but Verify Cloud Security 3
Agenda Cloud Defined Cloud Opportunities Cloud Challenges What s Different? How to Verify Key Takeaways 4
The Cloud defined? 5
Attributes ELASTIC SERVICE DELIVERY MULTI-TENANT ON-DEMAND FLEXIBLE BILLING SELF-SERVICE 6
Cloud Service offerings Software-as-a Service (SaaS) Platform-as-a Service (PaaS) Infrastructure-as a Service (IasS) 7
SaaS Definition Software deployment model in which a Third party owns, hosts and manages the software application and ddelivers it as a service to the end customer Target Market End-user with specific business functionality requirements Examples Salesforce.com, Google Docs, MS Office Live/Online 8
PaaS Definition Target Market Software deployment platform available as a service that supports the end-to-end software development lifecycle, including design,testing and deployment. Software developers and independent software vendors Examples Windows Azure, Google App Engine 9
IaaS Definition Target Market Service-based model for provisioning core computing power - servers, storage and network resources - for deployment and execution of externally hosted applications Software architects, infrastructure groups network/system administrators Examples Amazon EC2/S3, Oracle Coherence 10
Cloud Business Models Public clouds - make resources available dynamically over the Internet from third-party providers - the most commonly described model Private cloud - models deploying advanced use of virtualization technologies inside an enterprise to emulate cloud computing benefits via an internal infrastructure Managed Cloud - provided by designated service providers on a single tenant or multi-tenant operating environment. The physical infrastructure is owned by and /or physically located in the organization s data centers with management and security functions provided by a designated service provider Hybrid cloud - combine features public and private cloud models - (leverage virtualized architecture inside the enterprise to an external, off premise cloud architecture) 11
Cloud Business Models Who manages it? Who owns it? Where is it located? Who has access to it? How is it accessed? 12
Cloud Opportunities 13
Cloud Attractions PERCENT RESPONDING 14
Cloud Challenges 15
FEAR OF UNAUTHORIZED ACCESS/DATA LEAKAGE RE:CUSTOMER DATA FEAR OF UNAUTHORIZED ACCESS/DATA LEAKAGE RE: IP OTHER FEATURES /MATURITY OF TECHNOLOGY UNPREDICTABLE COSTS VENDOR LOCK-IN = PROVIDER SUSTAINABILITY = EMBEDDED SECURITY DEFECTS 16 APPLICATION/SYSTEM PERFORMANCE
WHAT S DIFFERENT? New delivery paradigm New technology abstractions 17
Moving out of the DC OLD Specification, configuration and operation Enterprise policies,procedures, controls Physical / logical access controls Configuration status/monitoring Patch testing / management Data/application controls-linked to physical device Network controls - connected to devices Security Standards Techniques 18 NEW Security Standards Techniques
Moving into the Cloud Virtualization 19
SECURITY IMPLICATIONS INFRASTRUCTURE PROCESS DISCIPLINE ACCESS RIGHTS NEW RISKS 20
Infrastructure Best Practices Network security Segmentation Audit logging 21
Infrastructure Best Practices Platform Hardening Configuration Change Management 22
Infrastructure t Best Practices Reporting Monitoring Automation 23
Access Rights Applications Applications OS Applications OS OS Hypervisor Hardware Hardware 24
New Risks Increased DR complexity Virtual Network Traffic Application of Reg/Stds ( PCI) Software Licensing i Host Server - administration E-discovery 25
How to Verify? PRE-CLOUD 26 In the Cloud
Verification Fundamentals Standards Portability Transparency 27
Cloud customer expectations 1 46 % 46 % 26% 33% 17% 16% 3% 13% 5% 3% PERCENT RESPONDING 1= Information week 2010 Cloud GRC Survey 28
Yes, BUT 29
Solutions Strategic deployment Self-service appliances The Uber Cloud 30
Strategic deployment H PRIVATE CLOUD BUSINESS RISK HYBRID CLOUD PUBLIC CLOUD L CLOUD RISK 31 H
Self Service Configuration Vulnerability Anchoring Audit Log Service Management 32
Uber Cloud Decision Support Automated arrangement coordination Cloud Audit 33
Key Takeaways Define Business Risk Define Cloud Risk Match reward with risk Design assurance program Implement and monitor 34
Thank you!