1. Securing the Cloud (Don’t get lost in the fog) Chris Munt M/Gateway Developments Ltd

3. Real world view

4. Assessing risk What risks are you exposed to?

5. Assessing risk

6. Assessing risk Indentify weaknesses

7. Assessing risk Can technology help?

8. Assessing risk Source: XKCD web comic: http://xkcd.com/

9. Assessing risk Lost in the fog of fanciful terms used to describe technology?

10. Assessing risk Cyberspace Virtualization Cloud computing Private Cloud Public Cloud Hybrid Cloud Cloudware IaaS, PaaS, SaaS

12. Real databases

13. Real networks Who’s watching you?

14. Assessing risk What about human factors?

15. Assessing risk

16. Assessing risk

17. Assessing risk “ You must change your password every few weeks and it must be constructed from no less than twelve characters which will include a mixture of upper and lower case letters, digits and punctuation characters”

18. Assessing risk Security versus Convenience?

19. Assessing risk

20. Assessing risk Why would anyone want to break your security?

21. Assessing risk

22. Assessing risk What’s your data worth to you? What’s it worth to someone else?

23. Assessing risk Lindisfarne Castle, Holy Island ~1797 by Thomas Girtin (1775–1802)

25. Corporate/Lawyers view

28. Suggest questions to be directed at service provider

31. Who administers the systems?

32. Governance

34. Do you store sensitive information about others?

35. Is the supplier subject to external audit in the same way as conventional suppliers of outsourcing solutions?

37. Can the Cloud provider sign up to local privacy requirements on behalf of their customers?

41. How long will a full recovery take?

42. Granularity of recovery?

44. To what extent do you have to account for illegal activity involving your application and/or data?

46. What happens if the supplier is taken over by another company?

47. How would you get your data back (and port it to another platform) if you needed to?

48. Technical view

52. More than 6 million transactions per year

53. Systems designed by credit card companies

54. Annual on-site security audit

57. Annual compliance questionnaire

58. Quarterly system perimeter scans

60. Annual compliance questionnaire

61. Quarterly system scans

63. Annual self-assessment questionnaires

64. Quarterly scans

67. PCI Compliance in the Cloud Source: http://cloudsecurity.org

69. Personal financial data

70. Perception of risk is as important as actual risk

72. ‘ Root index’ stored outside the cloud

73. Data in the cloud cannot be related to a particular individual without the ‘root index’.

74. Cloud Computing: Securing confidential information PATIENT Patient_ID Name Birth_Date Address ADMISSION Patient_ID Admission_Date Ward Consultant TEST Test_Date Specimen_ID Patient_ID Specimen_Type TEST_RESULT Test_Date Specimen_ID Test_ID Result

79. Use customized error pages

81. Client credentials passed to server in the clear

83. Some compatibility issues with browsers

89. Content protection

91. Code can be viewed by the client

92. Protect against users modifying URLs used in Ajax calls

95. Charged by usage

97. Be particularly careful with JavaScript

98. Keys should only be visible to a ‘proxy layer’ mediating between client and server