Cloud Security Alliance Research & Roadmap
June 2012
Presenter Name
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Global, not-for-profit organization
Over 35,678 individual members, 123 corporate members,
20 affiliate members, 64 chapters worldwide
Building best practices and a trusted cloud ecosystem
Agile philosophy, rapid development of applied research
GRC: Balance compliance with risk management
Reference models: build using existing standards
Identity: a key foundation of a functioning cloud economy
Champion interoperability
Enable innovation
Advocacy of prudent public policy
“To promote the use of best practices for providing security assurance within Cloud
Computing, and provide education on the uses of Cloud Computing to help
secure all other forms of computing.”
Copyright © 2012 Cloud Security Alliance
www.cloudsecurityalliance.org
Developed first comprehensive best practices for secure cloud computing,
Security Guidance for Critical Areas of Focus for Cloud Computing
(updated October 2011)
First and only user certification for cloud security, the CCSK
(Certificate of Cloud Security Knowledge, September 2010)
Tools for managing Governance, Risk and Compliance in the Cloud
Registry of cloud provider security practices, the CSA STAR
(Security, Trust & Assurance Registry, Q4 2011)
Industry leading security practices, education and tools developed by 30+
working groups
Selection of CSA venue by US White House to announce the US Federal Cloud
Strategy in 2011
Leadership in developing new security standards addressing cloud computing
Trusted advisor to governments and Global 2000 firms around the world
“To promote the use of best practices for providing security assurance within Cloud
Computing, and provide education on the uses of Cloud Computing to help
secure all other forms of computing.”
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
http://cloudsecurityalliance.org/research/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Global resource and
research coverage through
our corporate membership,
affiliate members, chapters
and
Connected to great minds:
Research contributors
represent some of the top
minds in information
security and cloud
computing
Copyright©©2012
2011Cloud
CloudSecurity
SecurityAlliance
Alliance
Copyright
Copyright © 2012 Cloud Security Alliance
www.cloudsecurityalliance.org
www.cloudsecurityalliance.org
Popular best practices
for securing cloud
computing
Flagship research
project
V 3.0 Released
(November 2011)
In alignment with
international
standards
> 100k downloads:
cloudsecurityalliance.org/guidance
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Family of 4 research
projects
Cloud Controls Matrix
Consensus Assessments
Initiative
Cloud Audit
Cloud Trust Protocol
Tools for governance, risk
and compliance
management
Control
Requirements
Copyright © 2011 Cloud Security Alliance
Private,
Community &
Public Clouds
Provider
Assertions
www.cloudsecurityalliance.org
Controls derived from guidance
Mapped to familiar frameworks:
ISO 27001, COBIT, PCI,
HIPAA, FISMA, FedRAMP, etc.
Rated as applicable to S-P-I
Customer vs. Provider role
Help bridge the “cloud gap” for
IT & IT auditors
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Research tools and processes to perform shared
assessments of cloud providers
Integrated with Controls Matrix
Version 1 CAI Questionnaire released Oct 2010,
approximately 140 provider questions to identify presence of
security controls or practices
Use to assess cloud providers today, procurement
negotiation, contract inclusion, quantify SLAs
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Open standard and API to automate provider audit
assertions
Change audit from data gathering to data analysis
Necessary to provide audit & assurance at the
scale demanded by cloud providers
Uses Cloud Controls Matrix as controls
namespace
Use to instrument cloud for continuous controls
monitoring
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Developed by CSC, transferred to CSA
Open standard and API to verify control assertions
“Question and Answer” asynchronous protocol, leverages
SCAP (Secure Content Automation Protocol)
Integrates with Cloud Audit
Now we have all the components for continuous controls
monitoring
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
CSA STAR
(Security, Trust and Assurance Registry)
Public Registry of Cloud Provider self assessments
Based on Consensus Assessments Initiative Questionnaire
Provider may substitute documented Cloud Controls Matrix
compliance
Voluntary industry action promoting transparency
Free market competition to provide quality assessments
Provider may elect to provide assessments from third parties
Available October 2011
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
To Promote Education, Research and Certification
of Secure and Interoperable Identity
Comprehensive Cloud Security Reference
Architecture
Assemble reference architectures with existing
standards
www.cloudsecurityalliance.org/trustedcloud.html
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
TCI Reference Architecture
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Information Security Industry Re-invented
Define Security as a Service (SecaaS)
Identify Ten Categories within SecaaS
Develop Domain 14 within CSA Guidance V3
Implementation Guidance for each SecaaS Category
Align with international standards and other CSA research
www.cloudsecurityalliance.org/secaas.html
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
To identify the current state of public cloud provider
maturity identified in CSA Guidance research
Cloud Data Governance Maturity Survey of current Cloud
Provider practices in the market (e.g. backup, encryption,
secure deletion, etc.)
Structure based on Domain 5: Information Lifecycle
Management
Re-define Data Life Cycle Model
Identify Key Concerns for Stakeholders
Data Governance in Emerging Technologies in the Cloud
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Consensus research for emergency response
in Cloud
Enhance community’s ability to respond to incidents
Standardized processes
Supplemental best practices for CERTs
Hosted Community of Cloud CERTs
Being spun out into a separate, related entity
www.cloudsecurityalliance.org/cloudsirt.html
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Industry a key stakeholder in future of cloud
CSA’s liaison to ITU-T
5 Telecom Initiatives
Telecom and the GRC Stack
ISO 27017 Interviews to CSP’s
SIEM
Compliance Monitoring
Cloud Forensics and Legal
https://cloudsecurityalliance.org/research/telecom/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Provide needed context to assist
organizations in making educated risk
management decisions regarding their
cloud adoption strategies
V.2 of Top Threats Report released in July
2012
“Top Threats” document will be updated
regularly to reflect expert consensus on the
probable threats which customers should
be concerned about.
https://cloudsecurityalliance.org/research/to
p-threats
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Securing application stores and other public
entities deploying software to mobile
devices
Analysis of mobile security capabilities and
features of key mobile operating systems
Cloud-based management, provisioning,
policy, and data management of mobile
devices to achieve security objectives
Guidelines for the mobile device security
framework and mobile cloud architectures
Solutions for resolving multiple usage roles
related to BYOD, e.g. personal and
business use of a common device
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Scalable authentication from mobile devices to
multiple, heterogeneous cloud providers
Best practices for secure mobile application
development
Identification of primary risks related to
individually owned devices accessing
organizational systems (commonly known as
BYOD – Bring Your Own Device)
https://cloudsecurityalliance.org/research/mobile
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Identifying scalable techniques for data-centric
security and privacy problems
Lead to crystallization of best practices for
security and privacy in big data
Help industry and government on adoption of
best practices
Establish liaisons with other organizations in
order to coordinate the development of big data
security and privacy standards
Accelerate the adoption of novel research aimed
to address security and privacy issues
https://cloudsecurityalliance.org/research/big-data
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Provide direct influence on how health
information service providers deliver secure
cloud solutions (services, transport, applications
and storage) to their clients, and foster cloud
awareness within all aspects of healthcare and
related industries
2 Health Initiatives
HIPAA and HiTech Best Practices
Healthcare Recommendations Guidance to
V.3
https://cloudsecurityalliance.org/research/him/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
The Cloud Security Alliance (CSA) and
ISACA announced the availability of a
new survey on cloud market maturity,
part of the first collaborative project
between the two organizations
The survey will be open to the public
through June 1, and can be found here:
https://www.surveymonkey.com/s/Clou
dMarketSurvey
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
The CSA Projects will begin migrating to the "new" Basecamp
found at the following URL:
https://launchpad.37signals.com/
This site will give you access to all of your CSA projects on the
new Basecamp and the pre-existing projects found in the
renamed "Basecamp Classic". The 37Signals Launchpad will
help you navigate to both Basecamp sites if you are
participating in multiple CSA Working Groups.
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Learn how you can participate in Cloud
Security Alliance's goals to promote the
use of best practices for providing security
assurance within Cloud Computing
http://www.linkedin.com/groups?gid=1864210
https://cloudsecurityalliance.org/get-involved/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Submit Your
Research Ideas
Do you have an idea for a research project
on a cloud security topic? If so, please
take the time to describe your concept. Ideas are
monitored by the CSA research team, who will review
your proposal and respond to you with feedback.
https://cloudsecurityalliance.org/research/, the Submit Ideas tab
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Contribute to the
CSA library
The Cloud Security Alliance is a community non-profit
which is driven by its members. Have a white paper or
information on a cloud security product you want to
contribute?
https://cloudsecurityalliance.org/education/white-papers-andeducational-material/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
http://cloudsecurityalliance.org/chapters/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
50 chapters and growing
Every continent except Antarctica
Translating guidance
Adapting research to local needs
Creating their own research projects
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
http://cloudsecurityalliance.org/education/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Benchmark of cloud security competency
Measures mastery of CSA guidance and ENISA cloud risks
whitepaper
Understand cloud issues
Look for the CCSKs at cloud providers, consulting partners
Online web-based examination
www.cloudsecurityalliance.org/certifyme
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
CCSK Basic
One day course to enable student to pass CCSK
CCSK Plus
Two day course includes practical cloud lab work
GRC Stack Training
One day course to use GRC Stack components
PCI/DSS In the Cloud
Achieving PCI compliance in cloud computing
http://cloudsecurityalliance.org/education/training/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
http://cloudsecurityalliance.org/events/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Re-visit the SecureCloud 2012
Presentations from select speakers will be available soon at:
https://cloudsecurityalliance.org/events/securecloud-2012/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Re-visit the inaugural CSA “Building Trust in Cloud Computing”
Summit 2012 hosted by the CSA Hong Kong & Macau Chapter
held on May 17, 2012 at Hong Kong’s Cyberport.
http://www.isoc.hk/2012/04/building-trust-in-cloud-computing-summit-2012.html
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
September 25-26, 2012
Amsterdam, Netherlands
For more information visit:
http://www.cloudsecuritycongres
s.com/
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
CSA Congress USA
Workshops November 7,8, 9
Venue: Hilton Disney World Resort
To register and for more information
visit: https://misti.com/cloud
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Help Us Secure Cloud Computing
www.cloudsecurityalliance.org
info@cloudsecurityalliance.org
LinkedIn: www.linkedin.com/groups?gid=1864210
Twitter: @cloudsa
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org
Copyright © 2011 Cloud Security Alliance
www.cloudsecurityalliance.org