Diana Gligorijević, direktor marketinga INFOTECH 2012 29.5.2012. Vrnjačka Banja TELEGROUP PROFILE
TELEGROUP OVERVIEW 1992 Telegroup LTD, UK 1996 TeleGroup Banja Luka 2001 TeleGroup Beograd 2007 TeleGroup Sofia One of the leading Solution Providers in the ICT & Energy areas in Western Balkan territories; Belgrade HQ
OVERALL SERVICES Consulting Designing of telecommunication, IT & energy networks and systems Creation & implementation of ICT Solutions Sales of ICT equipment (active & passive) Engineering of telecommunication, IT & energy infrastructure Cloud Services Software engineering End users System Management Project Management Technical Support 24x7 Trainings
ICT PORTFOLIO IT SOLUTIONS UNIFIED COMMUNICATIONS IP PBX, Contact Centers, Unified Messaging, Presence Voice and Video conferencing systems Critical Communications Recording solutions Total expense management VoIP gateways and controllers Video surveillance, Access Control, Fire protection and Intrusion prevention Wireless broadband access network systems Radio - relay and Functional systems Enterprise Mobility Solutions Network equipment and Server systems Network and Data Protection Data storage, preserving and archiving solutions Software solutions mpayment, mhealth, mticketing PASSIVE EQUIPMENT Heat shrink & cold shrink joints and pipes Splitters, modules, surge arrestors for modules, holders & connectors Cable locators Self supported cable and other telecommunication accessories Racks, patch panels, patch cords, adapters, modules, sockets...
TECHNICAL SUPPORT SERVICES Laboratory testing Testing and analysis of work of existing installed systems Installation of equipment and commissioning Diagnostics of irregularities in the working of the equipment Repair of devices Maintenance during warranty and post-warranty period Trainings for all systems included in TeleGroup business portfolio End users are provided with training for system use and maintenance Partners are provided with training for system installation and maintenance
Recovery time Response time 3 WAYS TO CONTACT TECHNICAL SUPPORT SERVICE Call Center +381 11 3081999 e-mail: helpdesk@telegroup-ltd.com http://helpdesk.telegroup-ltd.com Contact with responsible engineer Service Center On site consulting and/or Remote support Mutual work Technical Support Service center Head engineer On site intervention team Recovery work in progress System recovery Starting Intervention report Intervention report & technical level of a fault Completing Intervention report INTERVENTION PROCEDURE
CLOUD SECURITY
WHAT IS CLOUD? Today everybody talks about Cloud, but the fact is that everyone uses different although similar definition depending on their positions. One of the definitions. Cloud is computing area in which highly scalable IT capacities are provided to the external users as a service delivered over appropriate network infrastrucure!
ACTUAL TRENDS Global statistics is that almost 40% IT services users have migrated to Cloud services!!!
WHAT LED TO CLOUD EXPANSION? In introducing new IT solutions, most of the time we spent on defining the infrastructure (hardware and software) Cloud services increases productivity and enables easy upgrade Efficient delivery of IT Solutions Accelerations of all inovations in this area All solutions based on Cloud are much cheaper and more efficient All this facts led to the SOA (Service Oriented Architecture) where Cloud computing separates applications from the infrastructure
IT TRENDS AND SECURITY Megatrends in IT: mobility new mobile platforms cloud computing Megatrends impacting security highly sophisticated threats growing use of mobile devices new IT delivery models (SaaS) Rapid growth in security investment and important changes in the Security Solution Market Worldwide security spending will reach $63 billion in 2012 (10% of total IT budgets)
CLIENT INQUIRIES IN CLOUD SECURITY Clients are still looking for basic guidance for the security issues of enterprise use of cloud services. This client inquiry data can be used to align security professionals' priorities with those of their peers who are also evaluating cloud security measures
CLIENT INQUIRIES IN CLOUD SECURITY Clients strong interest in this area of security. This reflects the still-evolving state of both cloud computing and cloud security Clients are currently more concerned about identifying and assessing cloud security risks than about evaluating specific cloud security solutions The industry segments most concerned with cloud security are those that handle sensitive data and those that are subject to rigorous regulatory requirements. Client inquiries suggest a disproportionate interest in cloud security in Europe and among small-and-midsize enterprises.
CLIENT INQUIRIES IN CLOUD SECURITY Top 10 Cloud Security Search Terms
CLIENT INQUIRIES IN CLOUD SECURITY Industry Type
CLIENT INQUIRIES IN CLOUD SECURITY Region
CLIENT INQUIRIES IN CLOUD SECURITY Enterprise size
CRITICAL SECURITY QUESTIONS TO ASK A CLOUD SERVICE PROVIDER Issues Cloud security standards will not mature before 2H12 Many cloud service providers do not provide transparency into their security practices The global nature of cloud service providers complicates their compliance with local or national security regulations and requirements. What to do? Ensure that regulatory, corporate, industry or other applicable security standards apply to all cloud service providers Use checklist of independent security organizations as a starting point until cloud security standards mature Use a third-party vulnerability assessment firm to validate the responses to this checklist or any other questionnaire approach
CRITICAL SECURITY QUESTIONS TO ASK A CLOUD SERVICE PROVIDER Security must be a key criterion in any decision to use external cloud service providers when critical customer and business information is involved. A simple checklist is no substitute for a full standards-based security assessment, but will often be the only choice at this early stage of cloud service maturity.
CRITICAL SECURITY QUESTIONS TO ASK A CLOUD SERVICE PROVIDER Network Does the cloud service provider require the use of two-factor authentication for the administrative control of servers, routers, switches and firewalls? Does it support IPsec or Secure Sockets Layer with Extended Validation certificates and two-factor authentication for connecting to the service? Does it provide redundancy and load balancing for firewalls, intrusion prevention, and other critical security elements? Does it perform external penetration tests at least quarterly, and internal network security audits at least annually? Can it show documented requirements (and audit procedures) for network security Does it contract for, or provide protection against, denial-of-service attacks against its Internet presence?
CRITICAL SECURITY QUESTIONS TO ASK A CLOUD SERVICE PROVIDER Platform Can the cloud service provider present a documented policy for "hardening" the underlying virtualized infrastructure that its services run on? Can it provide validated procedures for configuration management, patch installation and malware prevention for all servers and PCs involved in cloud service delivery? Does it have a documented set of controls that it uses to ensure the separation of data and security information among customer applications?
CRITICAL SECURITY QUESTIONS TO ASK A CLOUD SERVICE PROVIDER Applications and Data How does the cloud service provider review the security of applications and any supporting code that it develops and uses? Does it use content monitoring and filtering, or data loss prevention inappropriate for data flows? Does it have documented procedures for configuration management, including the installation of security patches, for all applications? If the cloud service involves data that is covered by regulatory or other compliance requirements then does the provider meet the applicable requirements for data protection?
CRITICAL SECURITY QUESTIONS TO ASK A CLOUD SERVICE PROVIDER Operations Does the cloud service provider perform background checks on personnel with administrative or other privileged access to servers, applications or customer data? Does the provider have super user privilege management and database activity monitoring controls or the equivalent to detect inappropriate behavior by provider employees with administrative access? Can it show a documented process for evaluating security alerts from OS and application vendors, shielding systems from attack until patched, and installing security patches and service packs? Does it employ security monitoring and log management functions, and use write-once technology or other secure approaches for storing audit trails and security logs? Can it demonstrate established procedures for vulnerability management, intrusion prevention, incident response, and incident escalation and investigation?
CRITICAL SECURITY QUESTIONS TO ASK A CLOUD SERVICE PROVIDER End Services Does the cloud service provider's security staff average more than four years' experience in information and network security? Does more than 75% of its security staff have security industry certification. The cloud provider also should have vendor certification for the specific firewall equipment it will manage. Can it show documented identity management and help desk procedures for authenticating callers and resetting access controls, as well as for establishing and deleting accounts
CRITICAL SECURITY QUESTIONS TO ASK A CLOUD SERVICE PROVIDER Recommendations Enterprises' security organizations must be involved in the evaluation of prospective cloud service providers. Security organizations should have an established set of security requirements or standards that can be used as evaluation criteria for cloud service security providers. If a cloud service provider is already being used without enterprise security involvement, request visibility into any security audits that the provider has undergone.
THE GROWING ADOPTION OF CLOUD-BASED SECURITY SERVICES Cloud-based security services offer the promise of easy deployment and lower cost of ownership, but buyers must choose appropriate controls and weigh potential benefits against operational requirements.
THE GROWING ADOPTION OF CLOUD-BASED SECURITY SERVICES The suitability of various security controls for cloud-based delivery controls differs across controls based on the characteristics of those controls, including ability to customize and sensitivity to network latency and capacity The successful adoption of cloud-based security depends on the suitability of controls to that style of delivery, but also on the ability to integrate with premises-based controls Cloud-based security controls will play an increasingly important role in securing the use of cloud computing services
THE GROWING ADOPTION OF CLOUD-BASED SECURITY SERVICES Benefits and Customer expectations: Efficiency Effectiveness Flexibility Availability Scalability Customization Integration Location Visibility Control Expertise
THE GROWING ADOPTION OF CLOUD-BASED SECURITY SERVICES List of Security Controls Secure Email Gateway Secure Web Gateway (SWG) Remote Vulnerability Assessment (VA) Security Information and Event Management (SIEM) Distributed Denial of Service (DDoS) Identity as a Service Application Security Testing Website Protection Cloud-Based Encryption Services Cloud Access Security Brokers (CASBs)
ENTERPRISES MUST BALANCE OPPORTUNITY AND RISK IN CLOUD AND MOBILE SECURITY Cloud computing and mobile devices hold the potential to make enterprises more agile, more efficient and more competitive. They also introduce new security risks that must be addressed immediately! Gartner analysts covering security, cloud computing and mobile devices have collaborated to develop a set of key predictions for 2012 and beyond. Chief information security officers (CISOs) and other enterprise decision makers should consider these forward-looking Strategic Planning Assumptions when allocating resources and selecting products and services!
CLOUD SECURITY AND RISK STANDARDS The current lack of agreement on cloud risk standards ensures that cloud provider risk evaluation will remain an inexact and inconvenient process for the next several years. It is easier to evaluate operational processes than technology quality, but both are equally relevant to cloud risk assessment. The use of questionnaires continues to grow in significance as a mechanism for evaluating service provider risk, with most buyers developing them from in-house expertise.
CLOUD SECURITY AND RISK STANDARDS Several standards for cloud practices have been published and can legitimately be considered as constituting today's understanding of "best practice. Four current initiatives show potential for meeting the needs for a cloud security standard. All are adapting and supplementing existing standards, such as ISO/IEC 27001/27002 and BS 25999, to create a written framework of control standards directly applicable to cloud service providers: Cloud Security Alliance The Shared Assessments Program Common Assurance Maturity Model (CAMM) FedRAMP
CLOUD SECURITY AND RISK STANDARDS Certification Programs: ISO/IEC 27001 certification American Institute of Certified Public Accountants (AICPA) In critical situations, providers must be required to document not just whether they meet the standard, but how they meet it. They must also allow annual audits for neutral verification. Vendors that refuse transparency should be avoided for mission-critical, corporate proprietary or regulated scenarios.
SECURITY TESTING OF CLOUD SERVICES PROVIDERS IS A MUST All kinds of cloud services (application, data, infrastructure, security) should be tested for the security of the Web interfaces and systems they use to provide services. Such testing, often performed by application security providers, will be critical for the security of cloud services. Security testing helps enterprises ensure that the cloud services providers they entrust with their assets and processes are secure and compliant with established policies.
SECURITY TESTING OF CLOUD SERVICES PROVIDERS IS A MUST Security Testing of Cloud Services Enterprises moving business-critical information and processes into the cloud must ensure that their cloud providers meet enterprises' security policies. This will be a somewhat painful issue for many enterprises, because business benefits (for example, lower cost and faster delivery) will often favor cloud solutions, while security concerns will stand as obstacles against achieving those benefits. However, enterprises should consider cloud business benefits and security risks, and make security an explicit clause in contractual agreements with cloud providers.
SECURITY TESTING OF CLOUD SERVICES PROVIDERS IS A MUST The following models of cloud security testing could be used: The prospective enterprise client, the cloud provider and the thirdparty security testing provider negotiate a trilateral agreement. The cloud provider agrees to the third-party security testing provider's inspection, which results in a report being sent to the prospective enterprise client. Based on the report, the enterprise decides whether the cloud provider's security measures meet its requirements. The cloud provider uses independent security testing and provides proof of such testing to its cloud services prospects and clients. The cloud provider adopts application security testing technologies, grows its own skills and expertise, and conducts its own security testing.
SECURITY TESTING OF CLOUD SERVICES PROVIDERS IS A MUST The Benefits of Independent Testing of Cloud Services Providers: Vendor independence Vendor expertise Cost savings Security Testing Certification Certification must meet enterprise or industry security standards. Certification should include a clause assuring that the cloud provider has been continually retested.
VENDORS IN SECURITY SERVICES AND CLOUD SECURITY Security as a Service product vendors McAfee Symantec Trend Micro Zscaler Panda Software Websense HP Barracuda
COOL VENDORS IN SECURITY SERVICES AND CLOUD SECURITY Enterprises and technology providers are increasingly looking to service- and cloud-based models to deliver more effective, more cost-efficient security practices. Chief information security officers (CISOs) and other security professionals should familiarize themselves with Gartner's 2012 Cool Vendors in service and cloud security, as well as the potential business benefits they offer. Services and Cloud Security Vendors: Certes Networks FireHost OpenDNS Zettaset Dasient WhiteHat Security
CONCLUSION Cloud computing is an efficient, scalable and effective way of delivering IT services today, but as an open system is subject to numerous of security problems However, if you use a centralized identity, access policy and appropriate standards that can dramatically increase the level of security
CONCLUSION Cloud computing is offered as a service and part of security issues are service provider's responsibility, but a higher level of security commonly used resources and solutions that are not associated with IT service provider If you plan to become a Cloud service user soon, TeleGroup can implement all the Cloud Security control based on recognized IT security framework and industry best practices!!!
www.telegroup.ba www.telegroup-ltd.com www.telegroup-bg.com THANK YOU! Feel free to contact us via: security@telegroup.rs