1.
Cloud Security Evolution
Jay Harrison
Technical Operations Site Reliability Engineering Manager, EMEA

2.
My credentials
22 years in the industry, a decade in the cloud Technical
Operations & SRE at
● Okta - billion dollar cloud SaaS integrator
● Centrica Hive - IoT company - millions of devices
● EA Games, Playfish - social media games - over a
billion players
Previous talks on this topic at
● AWS London Summit 2018
● Computing Cloud & Infrastructure Summit 2017
● Cloud World Forum 2015
Who am I and why am I here
Leading independent provider of identity for the
enterprise
- 2017 & 2018 Leader, Gartner Magic Quadrant for Access
Management, Worldwide
● Built in the cloud, compatible with on-prem
● Over 6,000 pre-built applications and
infrastructure provider integrations
● Over 6,100 customers, including 21st Century
Fox, Experian, Adobe, Gatwick Airport,
Western Union.
● Hundreds of millions of users & billions of
authentications per month

3.
Evolution of
Cloud Services
Amazon Web Services (AWS) in 2006
Google Cloud Platform (GCP) in 2008
Rackspace Cloud in 2009
Microsoft Azure & OpenStack in 2010
Oracle Cloud Infrastructure v2 in 2018
All started with compute and storage as MVP
All have iterated towards full IaaS, SaaS, PaaS vendors
Compliance is built in - SOC, PCI-DSS, FIPS, ISO, HIPAA
Public cloud services accrued $175.8 billion in revenue
in 2018
… we can be far more secure in the
cloud and achieve a higher level of
assurance at a much lower cost …
- John Brady, FINRA, 2017

4.
Evolution of
Threats
Phone Phreaks & Script Kiddies
Organised Hacker groups
Virus & Malware distributors
Cyber Vandalism
Phishers & Social Engineers
Ransomware & Botnet collectives
Nation State Actors
Ever more sophisticated attacks
With threat actors now able to access data
owned by larger organisations through
smaller businesses within the chain, it’s no
longer enough for enterprises to
understand just their own security set up.
- Chris O’Brien, EclecticIQ, 2018

5.
Distribution of Threats
Victims
● 10% financial industry
● 15% healthcare organisations
● 16% public sector entities
● 43% small business
Tactics
● 4% physical action
● 15% misuse by authorised users
● 21% caused by errors
● 28% malware
● 33% social attack component
● 52% hacking
Actors
● 34% involved internal actors
● 69% involved outsiders
● 23% identified as nation-state or state-affiliated
● 39% organised criminal groups
Commonalities
● 25% for strategic advantage gain (espionage)
● 29% use of stolen credentials
● 32% involved phishing
● 56% took months or longer to discover
● 71% financially motivated
Verizon 2019 Data Breach Investigations Report

6.
Evolution of the
Responses
Dedicated roles
● DevSecOps
● Offensive/Defensive Engineers (Red/Blue Teams)
● Security Data Scientist
● Security and Compliance Analyst
● Security Automation
● Security Architect
● CSO/CISO
Dedicated products
● Security information and event management (SIEM)
● Intrusion Detection/Prevention
● Customer Identity and Access Management (CIAM)
● Penetration & DDOS protection
● Device Trust & Endpoint Protection
● External Audit & Compliance
More and more security frameworks and
regulations require a dedicated security
officer, and it is a best practice in all but the
smallest of organizations.
- Derek Boczenowski, Compass Compliance, 2018

7.
Evolution of
Technology
Cloud vendors know their services & have
the closest integrations
Cloud Vendor Solutions
● AWS Guardduty
● Azure Sentinel
● GCP Cloud Security Scanner
Traditional tools & approaches rarely work
● Unable to cope with scale & pace of change
● Don’t account for new factors
Security as Code
● Automated Policy Governance
● Security configuration under source control
Enterprise Cloud Security is a
big-data problem
- Shannon Leitz, Intuit, 2015

8.
Evolution of
Security Models
The network perimeter can no longer be the
only line of defence
Defence in Depth
● Physical Security
● Secure Hiring Practices
● Secure User Access with MFA
● Secure Local Environments
● Policy, Procedure & Awareness
● Defensive Programming
● Data Encryption at rest and on the wire
● Network Compartmentalisation
● Least Privilege for both users and software
● Vulnerability Management
● Secure OS
● Attack & Intrusion detection
● Monitoring & Alerting
Thanks to the rise of cloud services and
remote working … what matters now is how
people access their resources, no matter
where in the world they come from.
- Yassir Abousselham, Okta, 2018

9.
Evolution of the
Perimeter
Zero trust approach
● People, workloads, and devices are just as
untrustworthy as network traffic
● 81% of data breaches involve stolen/weak
credentials
● 91% of phishing attacks target credentials
● 73% of passwords are duplicates
Authentication and Authorisation
● Pervasive
● Skeptical
● Adaptive
● Contextual
● Automated
● Centralised
Identity is the new perimeter
- John Hawley, CA Technologies, 2012

10.
Security as a
Keystone
It’s not just the remit of Engineering,
CSO/CISO, HR or Building Security
Keys to success
● Detect and resolve issues quickly
● Use native security capabilities wherever possible
● Enlist and enable the entire organisation
● Educate progressively and in simple chunks
● Review policy, procedure and permissions regularly
Security is everyone’s problem
- Robert Reeves, Datical, 2016

11.
Thank you
Questions?