Loading presentation...

Present Remotely

Send the link below via email or IM

Copy

Present to your audience

Start remote presentation

  • Invited audience members will follow you as you navigate and present
  • People invited to a presentation do not need a Prezi account
  • This link expires 10 minutes after you close the presentation
  • A maximum of 30 users can follow your presentation
  • Learn more about this feature in our knowledge base article

Do you really want to delete this prezi?

Neither you, nor the coeditors you shared it with will be able to recover it again.

DeleteCancel

Make your likes visible on Facebook?

Connect your Facebook account to Prezi and let your likes appear on your timeline.
You can change this under Settings & Account at any time.

No, thanks

Security in Cloud Computing

No description
by

Mark Ottenberg

on 5 December 2014

Comments (0)

Please log in to add your comment.

Report abuse

Transcript of Security in Cloud Computing

What is cloud computing?
Cloud services
Cloud deployment models
Cloud Security
Overview

What is Cloud Computing?
Internet-based computing in which large groups of remote servers are networked to allow the centralized data storage, and online access to computer services or resources.


Security in Cloud Computing
By Mark Ottenberg

Cloud Computing
Services
Software as a Service (SaaS)

Platform as a Service (PaaS)

Infrastructure as a Service (IaaS)
What is Software as a Service?
SaaS is a software delivery method that provides access to software and its functions remotely as a Web-based service.
Software as a Service
SaaS applications often offer a great tool for collaboration, portability, ease of use, and widespread acceptance.
Google Docs is an example of a well known SaaS.
Provides online word processors, spreadsheets, and presentation packages to its users remotely.
What is Platform as a Service?
Platform as a Service (PaaS) - PaaS is a cloud-based environment with everything required to support the complete lifecycle of building and delivering web-based applications.
Platform as a Service
PaaS can be used to provide the tools needed to create new web and cloud applications.
A popular example of a PaaS is Microsoft Azure Platform.
Azure is an open and flexible cloud platform that enables you to quickly build, deploy and manage applications across a global network of data centers.
What is Infastructure as a
Service?
Infrastructure as a Service (IaaS) -
IaaS provides companies with computing resources including servers, networking, storage, and data center space on a pay-per-use basis.
Infastructure as a Service
The most common utilization of IaaS is enterprise infrastructure, cloud hosting, and virtual data centers (VDC)
Amazon Web Services was the very first cloud provider to offer IaaS
Amazon's EC2 (Elastic Compute Cloud) removed the need for servers and on-site data.
EC2 continues to be the industry standard and is the go-to cloud host.
What is a Public Cloud?
Public clouds are operated by the companies that use them to offer rapid access to affordable computing resources to other organizations or individuals.
Users don’t need to purchase hardware, software or supporting infrastructure, which is owned and managed by providers.


Public Cloud

Private Cloud

Hybrid Cloud
Cloud Computing
Deployment Models
What is a Public Cloud?
Owned and operated by a single company that controls the way virtualized resources and automated services are customized and used .
Takes advantage of many cloud’s efficiencies, while providing more control of resources and steering clear of multi-tenancy.

What is a Hybrid Cloud?
A hybrid cloud is an integrated cloud service utilizing both private and public clouds to perform distinct functions within the same organization.

They use the foundations of a private cloud combined with the strategic use of public cloud services.

Ex) A hybrid cloud may employ public cloud services for all non-sensitive operations, while still using a private cloud for more sensitive operations.
Cloud Security
The security and privacy concerns while using cloud services are very similar to those of any traditional online service.

Only these concerns are amplified because cloud computing gives users external control over organizational assets.

Creates the potential for assets to be mismanaged.
10 Major Security Risks in Cloud Computing
1. Loss of governance -
In public cloud services, consumers cede control to the cloud provider over a number of issues that affect security. This can leave gaps in security defense.


2. Responsibility ambiguity-
Responsibility for aspects of security spans across both the consumer and providers organization when cloud services are used. This creates a scenario where security responsibilities can be left unattended if there is a clear failure of allocated responsibility.


3. Isolation failure -
Multi-tenancy and shared resources within public cloud services creates the risk of failure mechanisms separating the usage of storage, memory, and routing between different users. Isolation failures can often times be vulnerable to guest‐hopping attacks.


4. Vendor lock‐in -
Organizations can become dependent on the services of particular cloud providers. This can lead to being tied to a providers services that do not support portability of applications and data to other providers. This can greatly increase the risk of data and service unavailability.




Security Risks Continued...
7. Data protection -
Cloud computing poses several data protection risks for both cloud consumers and
providers. The major concerns with data protection is the potential loss or release of sensitive data.


8.Malicious behavior of insiders -
Malicious actions from insiders working within cloud consumers and providers can be especially devastating given the access and authorization they may have.


9. Service unavailability-
Failure of communication between the consumer systems and providers services can render render data and applications essential to the consumer's business unavailable. An example of this could be a equipment or software failure within the provider's data center.


10. Insecure or incomplete data deletion -
Requests to delete cloud resources may not result in true wiping of the data. An example of this request might arise when a consumer cancels their service with a provider. In some cases adequate data deletion may prove to be impossible , either because extra copies of data are stored but are not available, or because the disk to be deleted also stores data from other clients.



8 steps to Secure Cloud Environment
1. Ensure effective governance, risk and compliance processes exist -
Consumers must ensure their cloud hosted applications and data will be secured in accordance with their organizations security and compliance policies.

2. Audit operational and business processes -
Organizations must audit the compliance of their cloud services to ensure their applications and data are effectively hosted in accordance to their corporate, industry or government
requirements and policies. 

3. Manage people, roles and identities -
Consumers must ensure that their cloud provider has processes and functionality that governs who has access to their data and applications. This ensures access to their cloud environments is controlled and managed.


8 steps to Secure Cloud Environment
6. Assess the security provisions for cloud applications
- Organizations must effectivly asses cloud providers services to ensure the applications is enabling the business to suceed rather than introducing additional risk.

7. Ensure cloud networks and connections are secure -
A cloud service provider must monitor network traffic to ensure both internal and external requirements are met. It is the providers duty to allow try to allow all legitimate network traffic and drop any malicious network
traffic.

8. Evaluate security controls on physical infrastructure and facilities -
Cloud consumers must ensure that all infrastructure and facilities owned by the service provided have the proper security controls in place.
Sources
"IBM Cloud." IBM Cloud Computing: What Is Cloud Computing? N.p., n.d. Web. 30 Oct. 2014.

Rutkowski, Matt. "Security for Cloud Computing 10 Steps to Ensure Success." (n.d.): n. pag. Cloud Standard Customer Council. 1 Aug. 2012. Web. 11 Nov. 2014.

"What Is Cloud Computing?" Interoute. N.p., n.d. Web. 12 Nov. 2014.


Security Risks Continued...
5. Handling of security incident -
The detection, reporting, and management of security breaches is a vital component of cloud security. Service providers must ensure that these matters are properly handled.


6. Management interface vulnerability -
Consumer management interfaces are usually accessible through the internet and connect to larger sets of resources. This characteristic paired with remote access and web browser vulnerabilities creates an increased security risk.


7. Data protection -
Cloud computing poses several data protection risks for both cloud consumers and
providers. The major concerns with data protection is the potential loss or release of sensitive data.



8 steps to Secure Cloud Environment
4. Ensure proper protection of data-
Proper protocols must be put in place to help reduce the risk of data theft, risk of unauthorized data disclosure, risk of tampering or unauthorized modification of data, and risk of loss or unavailability of data.

5. Enforce privacy policies -
Privacy policies should be reached within the cloud contract and service level agreement (SLA) between the consumer and provider. These policies must be enforced in accordance to the SLA.

Full transcript