THE EMERGING CLOUD ECOSYSTEM:

Transcription

1 Day 2, Thursday, 2012 Jan 19, hrs SESSION 4: Security in the Cloud THE EMERGING CLOUD ECOSYSTEM: cyber security plusli/rd Tony Rutkowski, Yaana Technologies 7 th ETSI Security Workshop, Jan 2011 ETSI All rights reserved

2 Outline Security as a Business opportunity: A winning driver to ensure technology success and increase confidence and trust amongst end users! Current tcloud developments Cyber security and LI/RD developments Business opportunities 2

3 The Basics: a new cloud based global communications infrastructure is emerging Global network architectures are profoundly, rapidly changing PSTNs/mobile networks are disappearing Internet is disappearing Powerful end user devices for virtual services are becoming ubiquitous End user behavior is nomadic Huge data centers optimized for virtual services combined with local access bandwidth are emerging worldwide as the new infrastructure These changes are real, compelling, and emerging rapidly Bringing about a holistic cloud ecosystem is occupying industry in almost every venue around the world 3

4 The Basics: a new cloud virtualized global communications architecture Virtualized devices Line or air interfaces Access, IdM & transport cloud virtualization services Intercloud services Other cloud virtualization services, especially for application support Access, IdM & transport General services Intercloud Access, IdM & transport General services Access, IdM & transport Intercloud General services Access, IdM & transport Intercloud General services Access, IdM & transport General services 4

5 Current Cloud developments Implementations Industry Collaboration and Reports 5

6 Implementers Top 50 in early 2011* 10gen Cloud Passage FluidInfo Nimbula Akamai Amazon Cloud.com Cloudera Fusion IO GoGrid Nutanix Power Assure Apigee CloudSwitch Google Rackspace Apple Couchbase Green Revolution Red Hat ARM CSC IBM RightScale Aryaka Dell Intel Salesforce.com Aspera DotCloud IO Turbine SeaMicro Boundary Embrane Joyent Sentilla Calxeda Enomaly Juniper SynapSense China Telecom Cisco Citrix Eucalyptus Systems Facebook Microsoft New Relic Nicira Verizon/Terremark VMware Zeus Technology * Source: Washington Technology/Gigacom (underline = top 8) 6

7 Most new applications/services especially for mobile smartphones are cloud based Amazon Apple, including Apple OS applications Baidu Facebook Google, including Android OS applications Microsoft, including Microsoft OS applications RIM, including BlackBerry App World Skype Yahoo 7

8 Major providers and vendors collaborating innewcloudtelecom new forums ATT BT China Telecommunications China Unicom Cisco Systems Datang France Télécom Orange Fujitsu Hitachi Huawei Technologies IBM KDDI KT Corporation Microsoft NEC Nokia Siemens Networks NTT Oracle RIM Samsung Electronics SAP Telecom Italia Telefon AB LM Ericsson Telekomunikacja Polska Verizon Vdf Vodafone & O2 ZTE * Sources: ITU-T Cloud Focus Group participant list, 2011; ETSI Cloud workshop 8

9 Industry Technical Collaboration Venues Almost everyone ATIS CSA CSCC DMTF ENISA ETSI GICTF IEEE IETF ISO ITU T NIST OASIS ODCA OGF OMG SNIA TMF Alliance for Telecommunications Industry Solutions Cable Labs Cloud Security Alliance Cloud Standards Customer Council Distributed Management Task Force European Network and Information Security Agency European Telecommunications Standards Institute Global Inter Cloud Technology Forum Institute of Electrical and Electronics Engineers Internet Engineering Task Force International Organization for Standardization International Telecommunication Union Telecommunications Standardization National Institute of Standards and Technology Organization for the Advancement of Structured Information Standards Open Data Center Alliance Open Grid Forum Object Management Group Storage Networking Industry Association The Open Group TeleManagement Forum Sources: ITU-T Focus Group on Cloud Computing, NIST Cloud Standards Wiki 9

10 ITU T Focus Group on Cloud Computing Global initiative during to produce first comprehensive conceptualization and integration of all technical information Ecosystem Requirements and reference architecture Infrastructure for network enabled clouds Security Standards activities Telecommunication benefits Resource Management Deliverables were just delivered 9 Jan 2012 Sets a stage for widespread industry activity and structured implementations worldwide 10

11 Identified Cloud Computing Services Short List of Cloud Services Extended List of Cloud Services Cloud Software as a Service (SaaS) Communications as a Service (CaaS) Cloud Platform as a Service (PaaS) Cloud Infrastructure as a Service (IaaS) Application services (SaaS) Resource services (IaaS) Platform services (PaaS) Network services (NaaS) Communication services (CaaS) Network as a Service (NaaS) Private cloud Community cloud Public cloud Hybrid cloud Personal cloud Inter cloud Business Process as a Service (BPaaS) Application Platform as a Service(APaaS) Application Infrastructure as a Service (AIaaS) Everything as a Service (XaaS) Storage as a service Database as a service Information as a service Process as a service Security as a service Integration as a service Management/governance as a service Testing as a service 11

12 A cloud computing functionalreference architecture Source: ITU-T Focus Group on Cloud Computing, Final Report, Dec

13 A cloud computing network infrastructure model 13 Source: ITU-T Focus Group on Cloud Computing, Final Report, Dec 2011

14 Resource management framework Standards intended to address: Awareness of logical and physical resources used How to dynamically reconfigure resources How to expose additional interfaces How to evaluate security controls 14 Source: ITU-T Focus Group on Cloud Computing, Final Report, Dec 2011

15 Cyber Security and LI/RD developments 15

16 Cloud cyber security 16 Threats for Cloud Security Threats for Cloud Service Users Threats for Cloud Service Providers Security Requirements for CloudSecurity Requirements for Cloud Service Users Requirements for Cloud Service Providers Study Subjects on Cloud Security Security Architecture/Model and Framework Security Management and Audit technology Business Continuity Planning (BCP) and Disaster Recovery Storage Security Data and Privacy protection Account/Identity Management Network Monitoring and Incident Response Network Security Management Interoperability and Portability Security Virtualization Security Obligatory Predicates (including LI/RD) Source: ITU-T Focus Group on Cloud Computing, Final Report, Dec 2011

17 Cloud computing service opportunities Short List of Cloud Services Extended List of Cloud Services Cloud Software as a Service (SaaS) Communications as a Service (CaaS) Cloud Platform as a Service (PaaS) Cloud Infrastructure as a Service (IaaS) Application services (SaaS) Resource services (IaaS) Platform services (PaaS) Network services (NaaS) Communication services (CaaS) Network as a Service (NaaS) 17 Deliberately omitted from ITU T list Private cloud Community cloud Public cloud Hybrid cloud Personal cloud Inter cloud Business Process as a Service (BPaaS) Application Platform as a Service(APaaS) Application Infrastructure as a Service (AIaaS) Everything as a Service (XaaS) Storage as a service Database as a service Information as a service Process as a service Security as a service Integration as a service Management/governance as a service Testing as a service Lawful Interception as a Service Retained Data as a service Law Enforcement Monitoring Facility as a service

18 Obligatory predicates: functionality identifiedfor for allcloudbasedservices services Potential security monitoring and acquisition interfaces Challenges will be LI implementations across multiple clouds RD security and scaling Inconsistencies among cloud infrastructure and service implementations Potential application of ETSI TCLI ewarrant, DR handover, and Dynamic Triggering specifications Necessitates widespread d use of DPI capabilities i 18

19 Business opportunities Retained Data as a Service 19

20 Retained Data as a Service (RDaaS) Retained Data obligatorypredicates are numerous Securities and financial transaction regulatory requirements ediscovery civil litigation evidence requirements USA rules being adopted by judiciaries worldwide Data Retention criminal investigation requirements EU Data Retention Directive Potential new cloud requirements under the Directive Data Preservation criminal investigation requirements Includes quick freeze capabilities Cybersecurity/infrastructure protection requirements Includes Continuous Security Monitoring event analysis capabilities Billing record requirements 20

21 RDaaS value propositions RDaaS capabilities are ideal Cloud service obligations Large scale non cloud services Almost unlimited scaling of storage and processing resources High security and protection of personally identifiable information Technique re use can occur across multiple implementations Lowered costs Faster and more complex discovery and analysis capabilities Specialized customer remote access apps Facilitated by new CybOX observables initiative 21