Maintaining Security Parity in the Shift to Cloud and Mobile Applications. Jamie Yu, Clark Sessions Cisco Systems October 2016

Transcription

1 Maintaining Security Parity in the Shift to Cloud and Mobile Applications Jamie Yu, Clark Sessions Cisco Systems October 2016

2 Speakers Background Application Security Team Cloud and Mobile Application Review 12+ Years of Corporate Cloud Assessment Program Hundreds of Cloud Providers 2015 Cisco and/or its affiliates. All rights reserved. 2

3 Partnership Collaboration Corporate Cloud Provider Trust Transparency 2015 Cisco and/or its affiliates. All rights reserved. 3

4 Requirements & Standards Design Basic Stool New Materials Innovation Transformation Corporate There is NO one-size-fits-all for Assessment Criteria! Internal Corporate Standards. Industry Standards Requirements & Specifications Materials & Processes Customer Safety Environment & Health Factory Workers Logistics 2015 Cisco and/or its affiliates. All rights reserved. 4

5 Stand Out CloudLock Q Cloud Cybersecurity Report Cloud Provider on Security 2015 Cisco and/or its affiliates. All rights reserved. 5

6 Concept 6+ million Apps Today Cisco s Cloud Provider Assessment Interview Internal Spreadsheet Outsourced Online Tool Brought Back In House Scale Up 2015 Cisco and/or its affiliates. All rights reserved. 6

7 Governance & Partnership Corporate Legal & Purchasing Contract Agreements Financial Risk Business Risk Business & IT Architectural Alignment Portfolio Mgmt. & Ownership Information Security Policy Compliance Application & Data Risks 2015 Cisco and/or its affiliates. All rights reserved. 7

8 On-Boarding CSP Off-Boarding CSP Corporate Approval Discovery Continuous Cloud Service Provider (CSP) Review Remediation Assessment 2015 Cisco and/or its affiliates. All rights reserved. 8

9 Audit Report Certifications Cloud Provider Certifications WILL speed up assessments Cisco and/or its affiliates. All rights reserved. 9

10 Cloud Provider Assessments Conditional Questions Method Filters Data Class Criticality Service Type Corporate Restricted C1/C2 IaaS Highly4Confiden-al C3 PaaS Regulatory Reqs Confiden-al Public C4 C5 SaaS DaaS Sensi-ve4PII PCI SOX HIPAA Country4Specific Data4=4HC,4Restricted Encryp-on4at4Rest Location of CSP US EU Embargoed Other Cri-cality4=4C1/2/3 Offsite4Backup Reten-on4&4Labeling Encryp-on IaaS,4PaaS4!= AWS,4CCS,4Rackspace,4 Azure Full4PaaS4and4IaaS4Ques-ons App/Infra4Password4Mgmt Infrastructure4Hardening Infra4Vuln4Scans Infra4Logs Mul-Hfactor4Admin4Access Enhanced4Logging4and4Audi-ng Media/Data4Sani-za-on Data4Loss4Preven-on 3rd4Party4Pen4Tests Data Sharing Partners/Analytics Privacy4Sharing4Disclosure SOC42/SSAE16/ISO Privacy4Impact4Assessment Vulnerability4Management Vulnerability4Disclosures Encryp-on4In4Transit Common MultiTenancy? Method4of4Separa-on Separa-on4Controls Dev/QA/Prod4Separa-on Std4Opera-ng4Procedures Security4Awareness4Training Std4Logging4&4Audi-ng4Req Data4Reten-on SaaS Secure4Development4Process App4Vuln4Scans OWASP4Top4104Preven-on/Test TLS4Vers,4SSL4Cert4Algorithm No4Prod4Data4in4Test Single4SignHOn4Integra-on Number of Users User4Password4Controls 2015 Cisco and/or its affiliates. All rights reserved. 10

11 SaaS PaaS IaaS DaaS Hybrid Cloud Mobile App Data Classification Business Criticality Corporate Security & Privacy Application Data Security Identity Mgmt. Infrastructure Vulnerability Incident Logging & Operations 2015 Cisco and/or its affiliates. All rights reserved. 11

12 SaaS PaaS IaaS DaaS Hybrid Cloud Mobile App Data Classification Business Criticality Corporate Scenarios: Lack of Response From Provider - Contract Signed Lack of Response From Provider - Too Much Red Tape Lack of Readiness From Provider Well-Prepared Provider 2015 Cisco and/or its affiliates. All rights reserved. 12

13 Corporate Take-Aways Cloud Provider Embrace the Change Align Business Strategy Leverage Industry Standards Integrate Security Management Program for the Cloud and Mobile Differentiate with Security Anticipate and Prepare for Security Assessments Obtain Service Provider Certifications Earn Trust through Transparency 2015 Cisco and/or its affiliates. All rights reserved. 13

14