Securing Your Cloud Introduction Presentation Slides originally created by IBM Partial deck derived by Continental Resources, Inc. (ConRes) Security Division Revision March 17, 2017 1 IBM Security
Today s Inhibitors for Cloud Adoption COMPLIANCE SECURITY SKILLS GAP VISIBILITY INSIDER THREATS DATA PROTECTION 2 IBM Security
Are your customers ready to secure the cloud? 1/3 Fewer security failures for those that implement cloud security visibility and control tools 60 % fewer security incidents in IaaS vs traditional datacenters in 2020 50% of IaaS customers will add 3 rd party security products in 2017 Source: Gartner Predicts 2017: Cloud Security, Nov 2016 BUT: My team is not equipped to handle cloud security complexity 3 IBM Security
What s holding organizations back from switching to cloud? Question: Which of the following best describe your organization's main concerns about Cloud and are IMPORTANT INHIBITORS for your organization in considering Public Cloud services or Private Cloud technologies? Security concerns Regulatory / Compliance issues IT Governance Reliability / Downtime Vendor lock-in Hard to integrate Loss of operational control Will cost too much OP / Performance concerns Worries around network infrastructure Not convinced of ROI Reduced customization opportunities Insufficient internal buy-in Don t have the IT skills Cloud user Non-user of Cloud 15% 20% 25% 30% 35% 40% 45% 50% 4 IBM Security IDC# US41636817 (August 2016) Source: IDC CloudView, January, 2016, n=11,350 worldwide respondents; weighted by GDP and company size
Common security perceptions cause organizations to re-think how they can manage cloud risks more effectively Perception Perception Perception Cloud computing is Cloud security is Cloud security is less secure complex and costly difficult to maintain Reality Reality Reality 62% of respondents said their levels of privacy protection increased as a result of moving to the cloud 1 69% Since moving to the cloud, of respondents said they have saved money 1 Understanding the risks with a cloud vendor s capabilities will allow organizations to overcome these perceptions 55% of cloud users have reduced the amount of time they spend managing security since moving to the cloud 1 1 Microsoft Cloud Trust Study 5 IBM Security IBM Security
Cloud capabilities to securely deliver and consume cloud services Intelligence Mobile Network Data Analytics Access ISAM CIS Guardium App Security QRadar XGS Multi Cloud Encryption BigFix Secure DevOps Deliver security FOR the cloud Access Apps Consume security FROM the cloud Fraud QRadar on Cloud Maas360 Trusteer Application Security on Cloud Enforcer ACCESS NETWORK DATA APPLICATION VISIBILITY & WORKLOAD MANAGEMENT SECURITY PROTECTION SECURITY INTELLIGENCE MANAGEMENT 6 IBM Security
Six Cloud Security Must Have s for any Cloud 1 2 3 4 5 6 Cloud Imperative ACCESS MANAGEMENT Users, privileges, clients NETWORK SECURITY Anomalies, threats, activities DATA PROTECTION Databases, workloads, content APPLICATION SECURITY Threat prevention VISIBILITY and INTELLIGENCE Anomalies, threats, activities WORKLOAD CENTRIC Security and DevOps management Capability Identity and access management Identity Governance Privileged identity Management Federation and SSO Monitoring events Threat detection and prevention Inter-workload protection File and Folder Encryption Key Lifecycle Management Data Loss Prevention Vulnerability scanning PII discover and monitoring Secure application development Application vulnerability assessment and management Event Correlation Monitoring and alerting Multi-cloud and on premise integration Cloud security policy management Patch management Auditing of controls
Security For the Cloud is a shared responsibility between the customer and Cloud Infrastructure Provider Customer Security Operations: Bring Your Own 3 rd party cloud security products, policies, practices and 1. Workload isolation 2. Secure DevOps 3. Harden VMs & Containers 4. Pen testing 5. Compliance/Certification processes Security Must Have Capabilities 1. Identity 2. Network 3. Data Protection 4. Application Security 5. Security Visibility 6. Security management Platform Security Services: Built in 1. Identity and Access 2. Network security 3. Data protection 4. Vulnerability & patch mgmt 5. Monitoring & Intelligence 6. Workload Management
Brief Cloud Security Checklist Get Access Under Control Who is using un-sanctioned Saas Apps? What is the risk? Are you protecting the IaaS cloud platform management console appropriately? Disparate registries and authentication methods Protecting Data Is sensitive data shared inappropriately Are you encrypting storage in IaaS and PaaS workloads? Is PII masked? Are you monitoring the integrity of cloud workload (configuration) files? Visibility Are you seeing new resources being deployed? Are you monitoring system calls and processes? Protecting networks Do you have cloud workload IDS/IPS and host-based firewalls? Do you have VPN connecting workloads on diverse IaaS platforms? BYO- Tools, Policies and Processes What do you already own that can be extended to the cloud? 9 IBM Security