Agenda. I. Related Policies to Cloud Computing. Cloud Security Certification Scheme in KOREA. Guidelines for Information Security of Cloud Computing

Transcription

1 Agenda I. Related Polices to Cloud Computing Cloud Security Certification Scheme in KOREA April. 11, 2017 II. III. Guidelines for Information Security of Cloud Computing Cloud Security Certification Program in Korea Jungduk (JD) KIM, Ph. D. Head, Department of Industrial Security Chair, Research Institute of Security Policies 1/ Act on the Cloud Computing Promotion & the Protection of its Users I. Related Policies to Cloud Computing 3/15 1

2 1.2. Guidelines for Information Security of Cloud Computing Main contents of measure II. Guidelines for Information Security of Cloud Computing 4/ Case Study (1/3) 2.1 Case Study (2/3) Country Certification Scheme Certification Criteria Certification USA FedRAMP NIST SP R4 FedRAMP PMO JAPAN SINGAPORE UK AUSTRALIA JCISPA ASP SaaS IaaS PaaS Data Centre MTCS-SS UK-G Cloud Risk Management ASD Cloud Standards for Cloud Information Security Information Disclosure Certification Systems for Safety and Reliability of Cloud Services JASA ASPIC ITSC Audit/Assessment Certification (Total 38) JASA ASPIC Certification (Total 7) CESG - ASD IRAP Control Items USA FedRAMP Republic of Korea Certification area Cloud service for federal government Cloud service for public org. Numbers of Items Basis Features Certification Audit/Assessment 17 Domains 325 Controls based on moderate Inspect on functional requirements for information systems 14 Domains 117 Controls Reflect legal requirements and additional requirements of public org. Reference NIST SP Rev4 ISO/IEC 27001/17 Cloud First Policy FedRAMP PMO (FedRAMP Program Management Office) Certification (Total 40) ) Law of Cloud Development Article 23 (3) KISA KISA 6/15 7/15 2

3 2.1 Case Study (3/3) 2.2 Summary Information Security Management System(ISMS) Cloud Security certification Program (CSAP) Assessment subject All Information system service Cloud Service Service for public org. v Composed of total 14 domains and 117 controls Assessment method Document review, On-site inspection Document review, On-site Inspection, Technical Inspection (Penetration test, Vulnerability test) Main contents of measure Certificate Criteria Number of Items 18 Domains 104 Controls Reference ISO/IEC Domains 117 Controls ISO/IEC Specialized Controls (Security of Virtualization, Law of Cloud Development, public org. requirements) 8/15 9/ Additional protection measure for public org. (1/3) 2.3 Additional protection measure for public org. (2/3) v Legal Requirements Obligation Notification method Fine Intrusion Notify promptly to users User Information Leakage Service Interruption Notify promptly to users, Notify promptly to Minister of Science, Notify promptly to users Notifying with Phone, Cell Phone, mail, , text messaging, cloud computing services or any of the similar methods Less than 10,000 USD 10/15 11/15 3

4 2.3 Additional protection measure for public org. (3/3) III. Cloud Security Certification Program 12/ Cloud Security Certification Program Summary Purpose 3.2 Assessment Method Vulnerability Assessment Definition v On-site verification that the technical measures are appropriately implemented in accordance with the cloud security certification program guidelines for the assets negotiated in the preliminary inspection Related Law Auditor and Duration v Auditor team: About 5 people(lead Auditor, Source code, CVE, CCE Inspectors) v Duration: 10 business day (Depends on Volume of asset and Service Scope) Standard Assessment method public org. 14 domains and 117 controls Assessment Method 14/15 15/15 4

5 3.2 Assessment Method Penetration Test Purpose v Examine the possibility of penetration through external network to ensure the cloud service is properly implemented / operated in accordance with the cloud security certification program standard Auditor and Duration v Auditor team: closed v Duration: 10 business day(adjustable) Subject to assessment v Penetration into cloud service portal through external network v Penetration to the hypervisor or other VM via the user VM v VPN Communication Advanced request v Account Information (2 or more), Test allowed time Recommendation v CSP periodically training Penetration test / Response Team Internally Jungduk Kim jdkimcau@gmail.com 16/15 5