Cloud Security Alliance Research & Roadmap Jim Reavis , Executive Director, CSA

www.cloudsecurityalliance.orgCopyright © 2011 Cloud Security Alliance

Cloud Security Alliance Research & Roadmap

Jim Reavis, Executive Director, CSA

http://www.cloudsecurityalliance.org/



About the Cloud Security Alliance

Global, not-for-profit organizationOver 23,000 individual members, 100 corporate members, 50 chaptersBuilding best practices and a trusted cloud ecosystemAgile philosophy, rapid development of applied research

GRC: Balance compliance with risk managementReference models: build using existing standardsIdentity: a key foundation of a functioning cloud economyChampion interoperabilityEnable innovationAdvocacy of prudent public policy

“To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud

Computing to help secure all other forms of computing.”




http://cloudsecurityalliance.org/research/

RESEARCH




CSA Guidance ResearchPopular best practices for securing cloud computingFlagship research projectV2.1 released 12/2009V3 research underway, targeting Q3 2011 releasewiki.cloudsecurityalliance.org/guidance

Ope

rati

ng in

the

Cl

oud

Governing the Cloud

Guidance > 100k downloads: cloudsecurityalliance.org/guidance



http://cloudsecurityalliance.org/guidance

http://cloudsecurityalliance.org/guidance



CSA GRC StackFamily of 4 research projects

Cloud Controls MatrixConsensus Assessments InitiativeCloud AuditCloud Trust Protocol

Tools for governance, risk and compliance management Control

RequirementsProvider

Assertions

Private, Community

& Public Clouds





Cloud Controls Matrix Tool

Controls derived from guidanceMapped to familiar frameworks: ISO 27001, COBIT, PCI, HIPAA, FISMA, FedRAMPRated as applicable to S-P-ICustomer vs. Provider roleHelp bridge the “cloud gap” for IT & IT auditors





Consensus Assessment Initiative

Research tools and processes to perform shared assessments of cloud providersIntegrated with Controls MatrixVersion 1 CAI Questionnaire released Oct 2010, approximately 140 provider questions to identify presence of security controls or practices Use to assess cloud providers today, procurement negotiation, contract inclusion, quantify SLAs





CloudAudit

Open standard and API to automate provider audit assertionsChange audit from data gathering to data analysis Necessary to provide audit & assurance at the scale demanded by cloud providersUses Cloud Controls Matrix as controls namespace Use to instrument cloud for continuous controls monitoring





Cloud Trust Protocol (CTP)

Developed by CSC, transferred to CSAOpen standard and API to verify control assertions“Question and Answer” asynchronous protocol, leverages SCAP (Secure Content Automation Protocol)Integrates with Cloud AuditNow we have all the components for continuous controls monitoring





CSA STAR RegistryCSA STAR (Security, Trust and Assurance Registry)Public Registry of Cloud Provider self assessmentsBased on Consensus Assessments Initiative Questionnaire

Provider may substitute documented Cloud Controls Matrix compliance

Voluntary industry action promoting transparencyFree market competition to provide quality assessments

Provider may elect to provide assessments from third parties

Available October 2011





Trusted Cloud InitiativeComprehensive Cloud Security Reference ArchitectureSecure & interoperable Identity in the cloudGetting SaaS, PaaS to be “Relying Parties” for corporate directoriesScalable federationOutline responsibilities for Identity ProvidersAssemble reference architectures with existing standardswww.cloudsecurityalliance.org/trustedcloud.html



http://www.cloudsecurityalliance.org/trustedcloud.html



TCI Reference Model Structure

TCI Reference Architecture





Security as a Service

Information Security Industry re-inventedDefine Security as a ServiceArticulate solution categories within Security as a ServiceGuidance for adoption of Security as a ServiceAlign with other CSA researchDevelop deliverables as a proposed 14th domain within CSA Guidance Version 3.www.cloudsecurityalliance.org/secaas.html



http://www.cloudsecurityalliance.org/secaas.html



Data Governance Project

Survey of current Cloud Provider data governance practices in the market (e.g. backup, encryption, secure deletion, etc.)Structure based on Domain 5: Information Lifecycle ManagementProject co-sponsored by CSA Silicon Valley and CSA SingaporeTarget Sept. 2011 Report releaseCharter and participation info to be posted on CSA website 1st week of August.





Consensus research for emergency response in Cloud

Enhance community’s ability to respond to incidentsStandardized processesSupplemental best practices for SIRTsHosted Community of Cloud SIRTsBeing spun out into a separate, related entityFully functional SIRT to be launched at CSA Congress Nov. 2011www.cloudsecurityalliance.org/cloudsirt.html

CloudSIRT



http://www.cloudsecurityalliance.org/cloudsirt.html



Telecom Working Group

Industry a key stakeholder in future of cloudDelivery of cloud security solutionsIncident responseCSA’s liaison to ITU-T





Trusted Standards

CSA “open door” policy with standards bodiesEstablished CAT C Liaison with ISO/IEC SC 27, WGs 1, 4 & 5Co-editor of ISO/IEC SC 27 WG1 Cloud Computing Security Study PeriodCo-editor ISO 27036Formal Liaison with ITU-T




http://cloudsecurityalliance.org/chapters/

GLOBAL CHAPTERS




Chapters Around the World

50 chapters and growingEvery continent except AntarcticaTranslating guidanceAdapting research to local needsCreating their own research projects




http://cloudsecurityalliance.org/education/

TRAINING & CERTIFICATION




Certificate of Cloud Security Knowledge (CCSK)

Benchmark of cloud security competencyMeasures mastery of CSA guidance and ENISA cloud risks whitepaperUnderstand cloud issuesLook for the CCSKs at cloud providers, consulting partnersOnline web-based examinationwww.cloudsecurityalliance.org/certifyme



http://www.cloudsecurityalliance.org/certifyme



Training Courses CCSK Basic

One day course to enable student to pass CCSK

CCSK Plus Two day course includes practical cloud lab work

GRC Stack Training One day course to use GRC Stack components

PCI/DSS In the Cloud Achieving PCI compliance in cloud computing

http://cloudsecurityalliance.org/education/training/



http://cloudsecurityalliance.org/education/training/


http://cloudsecurityalliance.org/events/

CONFERENCES & EVENTS




Upcoming Conferences

CSA Summit Korea, Sept. 29, SeoulCSA Summit Europe, Oct. 10, London (with RSA Europe)CSA Congress, Nov. 16-17, OrlandoCSA Summit RSA, Feb. 27, 2012, San FranciscoSecureCloud 2012 (partnership with ENISA)





Contact

Help Us Secure Cloud Computingwww.cloudsecurityalliance.orginfo@cloudsecurityalliance.orgLinkedIn: www.linkedin.com/groups?gid=1864210Twitter: @cloudsa




http://www.linkedin.com/groups?gid=1864210



THANK YOU!


Date post:	22-Mar-2016
Category:	Documents
Upload:	lorie
View:	65 times
Download:	0 times

Cloud Security Alliance Research & Roadmap Jim Reavis , Executive Director, CSA

Documents