Cloud computing is a fact of life for enterprise IT delivery. Over the past few years, enterprise culture has shifted to accept that cloud computing is the way forward. But the end result isn't that simple. Due to the variety of requirements and available solutions, enterprises implement a array of cloud services, from multiple providers, using all three SPI deployment models (IaaS, PaaS, and SaaS). While there is strong guidance available on a strategic level, it rarely addresses the reality of an enterprise implementation. How do today's enterprises reconcile the diverse risk profiles of these services? How do they monitor that risk in order to inform their defense? This talk focuses on how a modern security practice addresses these challenges in the reality of multi-model delivery.

1. This session was 1st given at the
CSA Summit in San Francisco
29–Feb–2016

3. Defending The Whole
IaaS, PaaS, and SaaS

4. Mark Nunnikhoven
Vice President, Cloud Research
@marknca

5. Builder User
Sympathy
Roadmap
Understanding
Tactics

6. Problems

7. # of services

8. # of services
# of controls

9. # of services # of controls

10. No. of Cloud Services In Use
AllNone

11. Lots
AllNone
No. of Cloud Services In Use

12. Reported numbers vary widely depending
You can be confident saying, ‘more then a couple’
AllNone
No. of Cloud Services In Use
Lots

13. # of services # of controls

14. Shared Responsibility Model
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
Cloud Provider Cloud Consumer

15. Shared Responsibility Model
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
IaaS

16. Shared Responsibility Model
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
IaaS
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
PaaS

17. Shared Responsibility Model
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
IaaS
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
PaaS SaaS

18. Shared Responsibility Model
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
IaaS
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
Physical
Infrastructure
Network
Virtualization
Operating System
Application
Data
Service Configuration
PaaS SaaS

19. Consumer Controls
IDS/IPS
Anti-malware
Integrity monitoring
Access control
Content filtering
…
IaaS
CASB
Secure design
Anti-malware
Access control
…
CASB
Education program
…
PaaS SaaS

20. Pace of Uptake
FastSlow
Security Tools
Cloud Services

21. Pace of Uptake
FastSlow
Security Tools
Cloud Services
This is hard to keep up with

22. How do you manage security
for all of these services?

23. Where We’re Heading

24. Cloud Control
Matrix

25. Cloud Security
Open API

26. Better Tools

27. Where We Are

28. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS

29. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS
Unique controls
for each SPI

30. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS
Unique controls
for each SPI

31. Tactics

32. P P P
Successful Security

33. People Process Products
Successful Security

34. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS

35. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS
Reduce Exposure
Education and awareness
Strong policy (CCM)
Responsive internal IT services

36. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS
Centralized Monitoring
Lowest common denominator
Spit, glue, and hope
Manual follow-ups

37. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS
Smart Service Choices
Easy to get data in and out
Supports standard APIs
Strong reputation

38. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS
Realizing you’re unlikely to influence
Smart Service Choices
Easy to get data in and out
Supports standard APIs
Strong reputation

39. Wins

40. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS

41. Where is my data?
Is it adequately secured?

42. Reduce exposure
Centralized monitoring
Smart service choices

43. VMs ERP Docs Files Files
[ other ]
IaaS PaaS SaaS

44. Thank You
Follow Mark @marknca