A providers view of security in the cloud. This talk shows how the main cloud providers (AWS & Azure) build security into their cloud services and how they contribute to the shared responsibility model for security in the cloud.

1. SECURITY OF THE CLOUD
a providers view of security
@marknca

2. Mark Nunnikhoven
Vice President, Cloud & Emerging Technologies
Trend Micro
@marknca

3. Modelling security
for the cloud

4. TRADITIONAL ResponsibilitY
Physical Operating System
Infrastructure Application
Network Data
Virtualization

5. SHARED ResponsibilitY
Physical Operating System
Infrastructure Application
Network Data
Virtualization Service Options

6. SHARED ResponsibilitY
Physical Operating System
Infrastructure Application
Network Data
Virtualization Service Options
Verify

7. Physical
Network
Virtualization
Operation System
Application
Data
DIY SaaSIaaS PaaS
*you

8. Less responsibilities
CONSUMER

9. More responsibilities
Less responsibilities
CONSUMER

10. More responsibilities
PROVIDER

11. Less responsibilities
More responsibilities
PROVIDER

12. OF the cloud

13. SHARED ResponsibilitY
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data

14. SHARED ResponsibilitY
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data

15. SHARED ResponsibilitY
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Physical
Infrastructure
Network
Virtualization
SaaS
PaaS
IaaS

16. PHYSICAL
Multiple data centres per region
Multiple regions available [ 11 | 17 ]
Operation endpoints around the world
AWS: h‫מּ‬p://aws.amazon.com/about-aws/global-infrastructure/
Azure: h‫מּ‬p://azure.microsoﬞ.com/en-gb/regions/

17. INFRASTRUCTURE
Redundant interconnects
Hardline connects to customers
Redundant power, HVAC
AWS: h‫מּ‬p://aws.amazon.com/directconnect/
Azure: h‫מּ‬p://azure.microsoﬞ.com/en-gb/services/expressroute/

18. NETWORK
Publicly accessible know IPv4 space
IPv6 support (*AWS ELB only)
Private routing, subnet, ACLs

19. VIRTUALIZATION
Process isolation [ XEN, HyperV ]
Image integrity
Resource isolation

20. Verify

21. AWS
More details at h‫מּ‬p://aws.amazon.com/compliance/
PCI DSS Level 1
SOC 1/ISAE 3402
SOC 2
SOC 3
ISO 9001
IRAP (.au)
FIPS 140-2
Current certifications
CJIS
CSA
FERPA
HIPAA
FedRAMP (SM)
DoD CSM 1-2, 3-5
DIACAP
ISO 27001
MTCS 3
ITAR
MPAA
G-Cloud
Section 508/VPAT
FISMA

22. Azure
More details at h‫מּ‬p://azure.microsoﬞ.com/en-us/support/trust-center/compliance/
PCI DSS Level 1
SOC 1/ISAE 3402
SOC 2
SOC 3
ISO 9001
IRAP (.au)
FIPS 140-2
ISO 27002
CCCPPF
Current certifications
CJIS
CSA
FERPA
HIPAA
FedRAMP (SM)
DoD CSM 1-2, 3-5
DIACAP
EU Model Clauses
MLPS (.cn)
ISO 27001
MTCS 1
ITAR
MPAA
G-Cloud
Section 508/VPAT
FISMA
FDA 21 CFR

23. FOCUS
PCI DSS Level 1
SOC 2/3
SOC 1/ISAE 3402
Certifications

24. FOCUS
Certifications
Security
Security
Baseline
PCI DSS Level 1
SOC 2
SOC 1/

25. AWS Compliance
h‫מּ‬p://aws.amazon.com/compliance/
Microsoﬞ Azure Trust Center
h‫מּ‬p://azure.microsoﬞ.com/en-us/support/trust-center/

26. Just because the provider is certified
doesn’t mean your deployment will be.
You have work to do.
Anonymous AWS employee

27. Options : Responsibilities

28. TREND MICRO’s DEEP SECURITY
Anti-malware
Content filtering
Firewall
Intrusion Prevention
Integrity Monitoring
Log Inspection
Learn more at aws.trendmicro.com

29. @marknca
Thank you.Learn more at aws.trendmicro.com