Global Efforts to Secure Cloud Computing

www.cloudsecurityalliance.orgwww.cloudsecurityalliance.orgCopyright © 2013 Cloud Security Alliance
Cloud
One million new
mobile devices -
each day!
Social Networking
Digital Natives
www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
Copyright © 2013 Cloud Security Alliance

www.cloudsecurityalliance.orgwww.cloudsecurityalliance.orgCopyright © 2013 Cloud Security Alliance www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance www.cloudsecurityalliance.org
State Sponsored Cyberattacks?
Organized Crime?
Legal Jurisdiction & Data Sovereignty?
Global Security Standards?
Privacy Protection for Citizens?
Transparency & Visibility from Cloud Providers?

Shift the balance of power to consumers of IT
Enable innovation to solve difficult problems of
humanity
Give the individual the tools to control their digital
destiny
Do this by creating confidence, trust and
transparency in IT systems
Security is not overhead, it is the enabler

www.cloudsecurityalliance.org
7
enterprise
boundary
public clouds
private clouds
cloud of users
Notional
organizational
boundary
• Cloud + Mobile
• Dispersal of applications
• Dispersal of data
• Dispersal of users
• Dispersal of endpoint
devices

https://cloudsecurityalliance.org/research/top-threats/

Sunlight is the best
disinfectant,”
U.S. Supreme Court Justice Louis
Brandeis

Control
Requirements
Provider
Assertions

GRC Stack
Family of 4 research projects
Cloud Controls Matrix (CCM)
Consensus Assessments Initiative
(CAI)
Cloud Audit
Cloud Trust Protocol (CTP)
Impact to the Industry
Developed tools for governance,
risk and compliance management
in the cloud
Technical pilots
Provider certification through
STAR program
Control
Requirements
Provider
Assertions

2 Registered
(December 2012)
30 Registered
(April 2013)

DG 4.2: Do you have a documented procedure for responding to requests
for tenant data from governments or third parties?
Amazon AWS
AWS errs on the side of protecting customer privacy and is vigilant in
determining which law enforcement requests we must comply with. AWS
does not hesitate to challenge orders from law enforcement if we think the
orders lack a solid basis.
Box.net
Box does have documented procedures for responding to requests for tenant
data from governments and third parties.
SHI
Customer responsibility. SHI has no direct access, so requests for data
through third parties will be responded to by the customer themselves,
however, SHI can sanitize and delete customer data upon migration from the
cloud.
Verizon/Terremark Yes

OPEN CERTIFICATION FRAMEWORK
CONTINUOUS
ATTESTATION | CERTIFICATION
SELF ASSESSMENT
TRANSPERANCY
ASSURANCE

Clear GRC objectives
3rd Party
Assessment
Real time,
continuous
monitoring
+
+
Self Assessment
+

Our research includes
fundamental projects needed
to define and implement trust
within the future of
information technology
CSA continues to be
aggressive in producing
critical research, education
and tools

Previously known as Trusted Cloud
Initiative
Security reference architecture for cloud
Architecture in use by early adopters of cloud in
Global 2000
Cloud brokering
To do:
Management tools
Technical implementation guides
Documented case studies & use cases

Certificate of Cloud Security
Knowledge (CCSK)
Benchmark of cloud security
competency
Online web-based examination
www.cloudsecurityalliance.org/certifyme
Training partnerships
Developing new curriculum for
audit, software development and
architecture
Partnership with (ISC)2 for cloud
security architecture certification

Please contact Jim Reavis at
jreavis@cloudsecurityalliance.
org for more information on the
Cloud Security Alliance
I will see you at the CSA
EMEA Congress, September
24-26 in Edinburgh
https://cloudsecurityalliance.org/events/csa-emea-congress-2013/

Global Efforts to Secure Cloud Computing

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (8)

Ähnlich wie Global Efforts to Secure Cloud Computing

Ähnlich wie Global Efforts to Secure Cloud Computing (20)

Mehr von InnoTech

Mehr von InnoTech (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Global Efforts to Secure Cloud Computing

Hinweis der Redaktion