Cloud Security Demystified

This presentation simplifies Cloud, Cloud Security and Cloud Security Certifications. This includes the following:
- Understanding Cloud
- Understanding Cloud Security using the Risk Management and Cloud Security Control Frameworks
- Cloud Security Certifications
- Key Definitions

Transcript

1. Michael Torres NVCC Professor, IT & Cybersecurity Mtorres@nvcc.edu Linkedin: http://www.linkedin.com/in/michaelto Slidedeck Presentation Repository: https://speakerdeck.com/michaelto Presentation Download: https://speakerdeck.com/michaelto/cloud-security-demystified NOVA CyCON – Cybersecurity Conference (Cytalks.com) Cloud Security Demystified June 2018
2. • Name: Michael Torres • Title: NVCC Professor, IT & Cybersecurity • Education: Master In Management Information Systems & GWU Doctoral Candidate (ABD) – Ed.D. Human and Organizational Learning • Certifications: • Related Experience: 20+ Years • Linkedin: http://www.linkedin.com/in/michaelto 2  Program/Project Mgmt.  Transformation/Alignment  Technology Governance  IT Policy Development  Process Improvement  System Assessments  IT Security Assessment & Authorization  Enterprise IT Service Architecture  Cloud Architecture & Security  Enterprise Architecture  Agile Development Lifecycle  Data Center Consolidation  Identity Management/Active Directory Architecture  Budget Management ($160m+)  Capital Investment Planning  Cost Modeling & Analysis  Contract Management  Project Management Professional(PMP)  FAC-P/PM Level III  FAC-COR Level III  Project +  ITIL Foundations  Certified Scrum Master(CSM)  Certified Scrum Product Owner(CSPO)  GSA Federal CIO Certificate  Microsoft Certified Professional (MCP)  Microsoft Certified Technology Specialist ﴾MCTS﴿  Microsoft Certified IT Professional ﴾MCITP﴿  Microsoft Certified Solutions Associate (MCSA)  Microsoft Certified Systems Engineer: Security  Microsoft Certified Systems Administrator: Security  MCT-MODL  HDI – Support Center Director (HDI-SCD) (exp)  Security +  Network +  INet+  A+  CCNA (exp)  CCDA (exp) About your Speaker
3. Agenda • Understanding Cloud (15 min) • Understanding Cloud Security (25 Min) • Cloud Security Certifications (5 Min) 3
4. Understanding Cloud 4
5. Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Source: NIST 800-145 NIST Definition of Cloud What is Cloud Computing (aka The Cloud)? 5
6. Source: NIST 800-145 NIST Definition of Cloud -- Consumer Graphics: MS Office Online What are Tenets of the Cloud Computing Model? Multi-tenancy 6
7. Cloud Deployment Models NIST’s Visual model of cloud deployment model Source: http://www.cloudsecurityalliance.org 7
8. Who are the 5 major cloud actors? Source: NIST 500-291 Cloud Computing Standards Roadmap 8
9. What are Cloud Actor Roles and Responsibilities? Source: NIST 500-291 NIST Cloud Computing Standards Roadmap 9
10. What are Consumer vs Provider Activities in the cloud? Source: NIST 500-291 Cloud Computing Standards Roadmap 10
11. Source: NIST 500-299 NIST Cloud Computing Security Reference Architecture What are Cloud Infrastructure Layers? Abstract Layer (Software) Physical Layer (Hardware) 11
12. What are the Service Model layers? 12
13. Who Manages the Cloud Infrastructure? 13
14. Cloud Service Model Example: Pizza Source: https://www.ebcgroup.co.uk 14
15. Understanding Cloud Security using the Risk Management and Cloud Security Control Frameworks 15
16. Source: NIST 500-292 Cloud Computing Reference Architecture What are the Cloud Security Layers? 16
17. Source: NIST 500-299 Cloud Computing Security Reference Architecture What is the Cloud Security Ecosystem and what needs to be secured? 17
18. Source: NIST 800-37 Risk Management Framework What is a Risk Management? Risk Management: The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system, and includes: (i) the conducting of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security state of the information system. 18
19. Source: NIST 800-37 Risk Management Framework How to determine an Organization’s Risk Tolerance Level for Information Systems? 19
20. What are we determining risk for? • CONFIDENTIALITY: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information… [44 U.S.C., Sec. 3542] A loss of confidentiality is the unauthorized disclosure of information. • INTEGRITY: Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity… [44 U.S.C., Sec. 3542] A loss of integrity is the unauthorized modification or destruction of information. • AVAILABILITY: Ensuring timely and reliable access to and use of information… [44 U.S.C., SEC. 3542] A loss of availability is the disruption of access to or use of information or an information system. Source: NIST FIPS PUB 199 20
21. What is Security Categorization? Rating Impact Cause Result Low limited adverse effect degradation in mission capability -minor damage to organizational assets -minor damage to organizational assets - result in minor financial loss - result in minor harm to individuals. Medium serious adverse effect significant degradation in mission capability - significant damage to organizational assets - significant financial loss - significant harm to individuals that does not involve loss of life or serious life threatening injuries. High severe or catastrophic adverse effect severe degradation in or loss of mission capability - major damage to organizational assets - major financial loss - severe or catastrophic harm to individuals involving loss of life or serious life threatening injuries. Source: NIST FIPS PUB 199 Security categorization is how we rate the potential impact to a system’s confidentiality, integrity, or availability. CIA can have the same or different determinations of risk (e.g. IT System is rated as C=High, I=Medium, A=Low)
22. Source: NIST 800-37 Risk Management Framework How do we select and implement controls? 22
23. What are security controls? Security Controls: The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. Cloud Security Framework: The standard baseline set of confidentiality, authentication and integrity security requirements and controls needed to minimize or eliminate security risks and privacy threats for information systems and data. Source: NIST 800-53 Security and Privacy Controls for Federal IS and Organizations 23
24. International Security Control Framework ISO/IEC 27017 International Organization for Standardization 27017 - Code of practice for information security controls Source: ISO.org - ISO/IEC 27017 - Code of practice for information security controls 11 Control Categories Total # of 133 Controls ISO/IEC 17017 Control Framework Control Type Security policy 2 Organization of information security 11 Asset Management 5 Human resources security 9 Physical and environmental security 13 Communications and operations management 32 Access control 25 Information systems acquisition, development and maintenance 16 Information security incident management 5 Business continuity management 5 Compliance 10 # of Controls Category Rating Not Defined 24
25. Industry Security Control Framework Cloud Security Alliance (CSA)-STAR CSA Security, Trust & Assurance Registry (STAR) Source: cloudsecurityalliance.org CSA Security, Trust & Assurance Registry (STAR) Control Framework Control Type Low Moderate High Application & Interface Security 4 Audit Assurance & Compliance 3 Business Continuity Management & Op Resilience 11 Change Control & Configuration Management 5 Data Security & Information Management 7 Datacenter Security 9 Encryption & Key Management 4 Governance & Risk Management 11 Human Resources Security 11 Identity & Access Management 13 Infrastructure & Virtualization 13 Interoperability & Portability 5 Mobile Security 20 Security Incident Management, E-Disk & Cloud Forensics 5 Supply Chain Management, Transparency & Accountability 9 Threat & Vulnerability Management 3 # of Controls 16 Control Categories Total # of 133 Controls 25
26. Government Security Control Framework FedRAMP 17 Control Categories Total Number of Controls • Low systems: 129 • Moderate systems: 316 • High systems: 419 FedRAMP Control Framework Control Type Low Moderate High Access Control 11 43 54 Awareness Training 4 5 7 Audit and Accountability 10 10 30 Security Assessment and Authorization 9 16 16 Configuration Management 11 26 36 Contingency Planning 6 23 35 Identification and Authentication 15 27 32 Incident Response 7 17 26 Maintenance 4 12 14 Media Protection 4 10 12 Physical and Environmental Protection 10 20 26 Planning 3 6 6 Personnel Security 8 9 10 Risk Assessment 4 10 12 System and Services Acquisition 6 22 26 System and Communications Protection 10 32 39 System and Information Integrity 7 28 38 # of Controls Federal Risk and Authorization Management Program (FedRAMP) Source: Fedramp.gov & NIST 800-53 26
27. Source: NIST 800-37 Risk Management Framework What is Assessment & Authorization (A&A)? 27
28. Source: NIST 800-37 Risk Management Framework Authorizing Official (AO): a senior organizational official that authorizes the operation of an information system, based on the Security Authorization Package, and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. Authorization: The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls. Security Authorization Package Contains: - The System Security Plan (SSP): Formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements. - The Security Assessment Report: The Assessment Report of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. - The Plan of Action and Milestones (POA&M): A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones. What is the Assessment & Authorization (A&A)? 28
29. Source: NIST 800-37 Risk Management Framework What is the Assessment & Authorization (A&A) Process? 29
30. Source: NIST 800-37 Risk Management Framework What is the Security Authorization Process? 30
31. Source: NIST 800-37 Risk Management Framework What is the Risk Monitoring? 31
32. Source: NIST 800-137 Information Security Continuous Monitoring (ISCM) What is Continuous Monitoring and the benefits of System Automation? Continuous Monitoring Process System Automation Domains 32
33. Cloud Security Certifications 33
34. What are the Certification Organization? Vender Neutral Certifiers • CompTIA • ISACA • ISC2 • Cloud Credential Council • Cloud Security Alliance • EC-Council Vender Specific Certifiers • Amazon • Cisco • Microsoft • VMware There are many more certifying organizations and certifications 34
35. What are the Security Certifications? 35
36. Laws & Policies • 44 USC Chapter 35: Coordination of Federal Information Policy • Federal Information Security Modernization Act (FISMA) • FedRAMP Cloud Computing Policy Guidance & Standards • NIST 500-291 NIST Cloud Computing Standards Roadmap • NIST 500-292 NIST Cloud Computing Reference Architecture • NIST 500-299 NIST Cloud Computing Security Reference Architecture • NIST 800-37 Risk Management Framework • NIST 800-53 Security and Privacy Controls for Federal IS and Organizations • NIST 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations • NIST 800-145 NIST Definition of Cloud • NIST FIPS PUB 199 • ISO/IEC 27017: Code of practice for information security controls • ISO/IEC 27018: Code of practice for protection of personally identifiable information (PII) in public clouds • FedRAMP.gov • Cloud Alliance Security Guidance for critical areas of focus in cloud computing Resources 36
37. • Cloud Computing: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. (NIST 800-145) • On-demand self-service: A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. (NIST 800-145) • Broad network access: Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations). (NIST 800-145) • Resource pooling: The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth. (NIST 800-145) • Rapid elasticity: Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time. (NIST 800-145) • Measured service: Cloud systems automatically control and optimize resource use by leveraging a metering capability1 at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service. (NIST 800-145) • Multi-tenancy: Multi-tenancy can be referred to an organizational pattern in which a single instance of an application is hosted on the service provider, and multiple companies, so-called tenants, access the same instance. (Pinto et al. (2016) A Systematic Mapping Study on the Multi-tenant Architecture of SaaS Systems) Key Definitions: Cloud Computing & Characteristics 37
38. • Infrastructure as a Service (IaaS): The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls). (NIST 800-145) • Platform as a Service (PaaS): The capability provided to the consumer is to deploy onto the cloud infrastructure consumer- created or acquired applications created using programming languages, libraries, services, and tools supported by the provider.3 The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application- hosting environment. (NIST 800-145) • Software as a Service (SaaS): The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. (NIST 800-145) • Private cloud: The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises. (NIST 800-145) • Community cloud: The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises. (NIST 800-145) • Public cloud: The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider. (NIST 800-145) • Hybrid cloud: The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds). (NIST 800-145) Key Definitions: Service and Deployment Models 38
39. • Risk Management: The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system, and includes: (i) the conducting of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security state of the information system. (NIST 800-37) • Confidentiality: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information… [44 U.S.C., Sec. 3542] A loss of confidentiality is the unauthorized disclosure of information. (NIST FIPS PUB 199) • Integrity: Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity… [44 U.S.C., Sec. 3542] A loss of integrity is the unauthorized modification or destruction of information. (NIST FIPS PUB 199) • Availability: Ensuring timely and reliable access to and use of information… [44 U.S.C., SEC. 3542] A loss of availability is the disruption of access to or use of information or an information system. (NIST FIPS PUB 199) • Security Controls: The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. (NIST 800-53) • Cloud Security Framework: The standard baseline set of confidentiality, authentication and integrity security requirements and controls needed to minimize or eliminate security risks and privacy threats for information systems and data. Key Definitions: Risk Management & Controls 39
40. • Authorizing Official (AO): a senior organizational official that authorizes the operation of an information system, based on the Security Authorization Package, and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. (NIST 800-37) • Authorization: The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed- upon set of security controls. (NIST 800-37) • System Security Plan (SSP): Formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements. (NIST 800-37) • Security Assessment Report: The Assessment Report of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. (NIST 800-37) • Plan of Action and Milestones (POA&M): A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones. (NIST 800-37) Key Definitions: Assessment & Authorization 40