Uploaded byMoshe Ferber
What the auditor need to know about cloud computing
The document discusses cloud security and the roles of various stakeholders in ensuring safe cloud computing practices. It emphasizes the importance of understanding the shared responsibility model, evaluating cloud service providers, and implementing proper governance, data classification, and security measures. Additionally, it outlines the need for continuous monitoring and auditing of cloud services to maintain compliance and security.
In this document
Powered by AI
Introduces the speaker, Moshe Ferber, and outlines his credentials and experience in cloud security.
Defines cloud computing and highlights its key characteristics that distinguish it from traditional computing.
Explains different cloud service models (SaaS, PaaS, IaaS) and discusses the shared responsibility model between provider and consumer.
Outlines the major challenges faced by Chief Information Security Officers in evaluating cloud providers and ensuring best practices.
Details steps for creating a cloud strategy, including data migration guidelines and stakeholder identification.
Discusses the need for balancing cloud policies with laws, regulations, standards, and the importance of data classification.
Importance of identifying stakeholders' roles and their responsibilities related to cloud security and risk management.
Focus on evaluating cloud service providers, including required audits, trust, accountability, and ongoing monitoring.
Explains the security foundations necessary for SaaS and IaaS, including encryption, identity management, and security assessments.
Discusses contract management elements and the implications of data privacy laws on cloud services.
Summarizes key takeaways from the presentation about cloud security and provides contact information for further learning.
More Related Content
Similar to What the auditor need to know about cloud computing
What the auditor need to know about cloud computing
- 1. Cloud Security For auditors MosheFerber, CCSK, CCSP, CCAK Onlinecloudsec.com When the winds of change blow, some people build walls and others build windmills. - Chinese Proverb
- 2. #About Information securityprofessional for over 20 years Founder, partner and investor at various cyber initiatives and startups Popular industry speaker & lecturer (DEFCON, RSA, BLACKHAT, INFOSEC and more) Co-hosting the Silverlining podcast – lean about security engineering Founding committee member for ISC2 CCSP and CSA CCSK, CCAK certification Member of the board at Macshava Tova – Narrowing societal gaps Chairman of the Board, Cloud Security Alliance, Israeli Chapter Cloud Security Course Schedule can be found at: http://www.onlinecloudsec.com/course-schedule
- 3. So, what iscloud computing?
- 4. Actually, cloud doeshave a definition…
- 5. Cloud characteristics: • Cloudcomputing characteristics distinguish cloud from other forms of compute (i.e. hosting, outsourcing , static virtualization) • Mostly relevant for certain regulations
- 6. מזה זה שוניםמאוד הענן שירותי .... SaaS PaaS IaaS Private Hybrid Public
- 7. The Share responsibilitymodel Physical Security Network & Data Center Security Hypervisors Security Virtual Machines & OS security Data layer & development platform Application Identity Management DATA Audit & Monitoring IaaS PaaS SaaS Consumer responsibility Provider responsibility
- 8. The CISO Challenge SaaS PaaS IaaS Gainthe expertise for building secure applications Evaluate providers correctly Very hard to provide best practices
- 9.
- 10.
- 11. Building a cloudstrategy: relevant steps Guidelines for which data/app can migrate Threats & Risks to consider Identifying key Stakeholders Evaluating the provider maturity and security controls. Additional controls that should be implemented in the service.
- 12. Cloud Policy: Balancingthe requirements Laws (i.e. Privacy laws) Regulations (sector specific) Standards (PCI, ISO) Contracts
- 13. Data classification ismandatory Data that can be migrated Data that can not be migrated Data that can only migrate to certain providers Data that can only migrated to certain jurisdiction Data that can only migrated if encrypted / anonymized UK gov data classification: • Official • Secret • Top secret Official is allowed at public cloud
- 14. Dealing with riskand threats
- 15. Identifying key stakeholders Internalstakeholder • IT department • Business owners • R&D department • Legal Department • GRC Department • Procurement department External Stakeholder • Integration & Implementation partners • Brokers • Software development companies • Auditors • Security consultant Often internal stakeholder will form sort of Cloud Computing Center of Excellence
- 16. Stakeholder responsibilities •Monitor ShadowIT •Authorized providers list •Budget management - IaaS/PaaS •SaaS license management Procurement •Building cloud architecture •Integrating new tools •Vision and roadmap Architecture •Guidelines for compliance program •Provider screening process •Specific controls GRC/CRO •Automation •Monitoring •Security (secdevops) Operations/devops
- 17. Specific controls examples Cloud migration committee Mandatory provider certifications MFAusage Data encryption at rest Security assessments
- 18. Evaluating providers (cloudassessments)
- 19. Hi diversity inthe market (specially in SaaS) • Could you do an audit? • Should you do an audit? In many cases you must settle for 3rd party attestation. Cloud provider A Cloud provider B
- 20. Provider evaluation Is theservice adequate? How mature is the provider? Are the provider responsibilities clear? Are customer responsibilities clear? Are there gaps?
- 21. Provider evaluation –what do I really looking for? Trust Accountability Is the provider accountable for his responsibilities? Transparency Is the information I am receiving accurate and actionable? Assurance Wil the provider perform as planned?
- 22. Provider evaluation (mostlyon SaaS) Reviewing security policy Evaluating the provider Evaluating the service Evaluating the supply chain Analyzing gaps Setting special requirements Contract signing Ongoing monitoring
- 23. Tools for providerevaluation https://cloudsecurityalliance.org/star/registry/
- 24. SaaS services –security foundation Encryption • Encrypting data at the cloud provider (who has the keys)? Identity Management • Who control the user store? • Who is responsible for authentication? Governance & Audit • Who does what? • Suspicious events detection
- 25. IaaS/PaaS – performingsecurity testing Security assessment • Usually assessing the cloud infrastructure • Require knowledge in the cloud platform • Usually made against a checklist • Evaluating the security posture of the environment Penetration testing • Usually cover the application layer • Mostly black box • Require coordination with the provider • Assessing the application resilience
- 26. Assessing with asecurity framework Security framework (non cloud specific) • ISO27001 • SOC 2/3 • COBIT • EU-Sec Security framework (cloud specific) • ISO27017 / 27018 (Cloud Security & privacy) • CSA STAR • BSI C5 • NIST 800-53 • PCI DSS cloud guidelines • CIS benchmark Considuration: Cloud Native vs. Migrated to the cloud
- 27. Contract management Usually madefrom 3 parts: • Agreement • SLA • ToS Usually not negotiable Must address the shared responsibility model Must address sub- processors Cloud specific • Location of services • Conflict resolution • Breach notification Must address end-of- service and migration
- 28. Privacy considerations Data privacylaws are turning the world into privacy islands Important topics: • Data residency • Processor vs. controller roles • Data subject's rights • Breach notifications Check put the CSA Privacy Level Agreement: https://cloudsecurityalliance.org/research/working-groups/privacy-level-agreement/
- 29. Summary The wordcloud describes many different types of services, with different security considerations. Pick your battles – • Large mature IaaS/PaaS providers – focus on customer maturity • SaaS services – Choose your partners wisely • Practical cloud policy is the place to begin, everything else will follow Cloud Security Course Schedule can be found at: ty Course http://www.onlinecloudsec.com/course-schedule
- 30. KEEP IN TOUCH CloudSecurity Course Schedule can be found at: http://www.onlinecloudsec.com/course-schedule
- 31.