Charting the Course Through Disruption with CSA Research
0 likes63 views
The document discusses the Cloud Security Alliance's (CSA) research activities. It notes that CSA has produced over 165 research artifacts through 34 active working groups. It highlights some of CSA's 2018 research releases and lists CSA's active and dormant working groups. The document promotes connecting with CSA and learning more about their research through various online resources.
Charting the Course Through Disruption with CSA Research
- 1. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE CHARTING THE COURSE THROUGH DISRUPTION WITH CSA RESEARCH J.R. SANTOS, EXECUTIVE VICE PRESIDENT OF RESEARCH
- 2. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE I O T C O N N E C T E D D E V I C E S B Y 2 0 2 0 The total number of “things” in the Internet of Things (IoT) is forecast to reach 20.4 billion in 2020, which is lower than Gartner’s previous prediction of 20.8 billion, published in 2015. The consumer segment is tipped to make up 63 per cent of the total IoT application market in 2017 with 5.2 billion units. Businesses are on pace to employ 3.1 billion connected things in 2017. 20.4B 3 1 % UP FROM 2016 8 . 4 B FOR EC AST IN 2017 TITLE GOES H ER E Quis nostrud exercitation.
- 3. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE T HE ZET TABYTE E RA The document presents some of the main findings of Cisco’s global IP traffic forecast and explores the implications of IP traffic growth for service providers.
- 4. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE “The cyber security industry faces a massive problem: there are simply not enough highly-skilled cyber security professionals. This is already a massive issue, but fast-forward to 2020 and the shortfall is expected to reach 1.5 million” - ISC2 Workforce Study EX IST ING EMPLOYEES CAN’ T KEEP UP WIT H T HE CHANG ES IN OUR INDUST RY COLLEG E G RADUAT ES LACK T HE SKILL AND EX PERIENCE 1 .5 M ILLION C Y BE R SE C U RITY P RO FE SSIONA LS NE E D E D BY 2020
- 5. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE O UR ENVIRO NMENT IN C HANG ING TH E R EGU LATOR Y & STAN D AR D S LAN D SC APE W ILL C H AN GE AN D BEC OME MOR E C OMPLEX N EW ATTAC K SU R FAC ES TEC H N OLOGY LAN D SC APE C H AN GES R APID LY D ATA W ILL C ON TIN U E TO EXPLOD E 9 9 % TH R OU GH 2020, 99% OF VU LN ER ABILITIES EXPLOITED W ILL C ON TIN U E TO BE ON ES KN OW N BY SEC U R ITY AN D IT PR OFESSION ALS FOR AT LEAST ON E YEAR . 33.3 % BY 2020, A TH IR D OF SU C C ESSFU L ATTAC KS EXPER IEN C ED BY EN TER PR ISES W ILL BE ON TH EIR SH AD OW IT R ESOU R C ES 8 . 3 % GR OW TH R ATE FOR IN FOR MATION SEC U R ITY SPEN D . FOR C ASTED TO BR EAK 101 B BY 2020 2 5 % BY 2020, MOR E TH AN 25% OF ID EN TIFIED EN TER PR ISE ATTAC KS WILL INVOLVE IOT
- 6. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE CLOUDSECURITYALLIANCE SE C U RITY P RO FE SSIONA LS NE E D T O E VO LVE
- 7. 1 9 ACT IVE WORKING G ROUPS 2009 CSA FOUNDED SIN GAPOR E // ASIA PAC IFIC H EAD QU AR TER S ED IN BU R GH // UK HEADQUARTERS SEATTLE/BELLIN GH AM, W A // U S H EAD QU AR TER S 9 0 , 0 0 0 + INDIVIDUAL MEMBERS 300+ CORPORAT E MEMBERS 75+ CHAPT ERS Strategic partnerships with governments, research institutions, professional associations and industry CSA research is FREE! OUR COMMUNITY
- 8. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE 8 RESEARCH FOR THE INDUSTRY • CSA HAS PRODUCED OVER 165 RESEARCH ARTIFACTS • WE HAVE A TOTAL OF 34 RESEARCH WORKING GROUPS (26 CURRENTLY ACTIVE) • OVER 4500 SUBJECT MATTER EXPERTS PARTICIPATE HAVE BEEN INVOLVED • 50+ CONFERENCES IN 2018 * DOES NOT INCLUDED SOME REGIONAL RESEARCH, CCM MAPPINGS ACTIVITIES, GRANT DELIVERABLES, COMMISSIONED PROJECTS,
- 9. 9 INDUSTRY COLLABORATION FORMAL: • ISO/IEC JTC 1 – IT AND CLOUD SECURITY TECHNIQUES • ITU-T – PROCEDURES AND STANDARDS IN TELECOM • IEEE – CYBERSECURITY AND PRIVACY STANDARDS COMMITTEE • NIST – CLOUD SECURITY WORKING GROUP • FCC - TECHNOLOGICAL ADVISORY COMMITTEE ON IOT • DISA DODIN (GIG) – CLOUD COMPUTING SERVICES GUIDANCE • DOD IC - CLOUD COMPUTING STANDARDS FOCUS GROUP • ATIS - PACKET TECHNOLOGY AND SYSTEMS COMMITTEE ON 5G • CIS – CLOUD SECURITY BENCHMARKS • CLOUD SECURITY INDUSTRY SUMMIT – EXECUTIVE COUNCIL OF CLOUD • ENISA – EU FUNDED RESEARCH ON RISK, INTEROPERABILITY, SLAS, AND MORE • ISC2 – TRAINING AND EDUCATION PARTNER FOR CLOUD SECURITY CERTIFICATION • ISACA – CONTINUING EDUCATION PARTNER FOR IT CERTIFICATION • CSA CORPORATE MEMBERS – COMMISSIONED WORK TO EXPLORE TRENDING TOPICS • AND MANY OTHERS INFORMAL: MPAA, SECURITY SMART CITIES, US FEDERAL HIGHWAY ADMINISTRATION, HIMSS, HC3, FFIEC, FDIC, OCC, EBA, AND MORE
- 10. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE • COMMON FRAMEWORK FOR TECHNOLOGY, IS MANAGEMENT • ASSESSES THE OVERALL SECURITY RISK OF A CLOUD SERVICE • PROVIDES STANDARDIZED SECURITY, OPERATIONAL RISK MANAGEMENT • HARMONIZES TO SECURITY STANDARDS AND COMPLIANCE FRAMEWORKS CLOUD SECURITY CONTROLS • QUESTIONS TO ENABLE CLOUD COMPUTING ASSESSMENTS • ESTABLISH THE PRESENCE AND TESTING OF SECURITY CONTROLS • DISCOVER PRESENCE OF SECURITY CAPABILITIES AND GAPS • DOCUMENT SECURITY CONTROLS IN IAAS, PAAS, SAAS PROVIDER ASSESSMENT QUESTIONS • PROVIDER LISTING OF SECURITY CONTROLS • TRANSPARENCY, AUDITING, AND HARMONIZATION OF STANDARDS • LEVEL OF ASSURANCE MEETING REQUIREMENTS • INDUSTRY ACCEPTABLE PROVIDER ASSESSMENT REPORTS • SOLUTION TO HELP ORGANIZATIONS MANAGE COMPLIANCE • ASSIGN MATURITY AND RELEVANCE SCORING • PROVISION AND MANAGE USER ACCESS TO ASSESSMENTS • COMPARE ASSESSMENTS BASED ON COMMON CRITERIA CLOUD SOLUTIONS MANAGEMENT DASHBOARD T O O L S F O R D U E D I L I G E N C E
- 11. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE About Security Guidance V4• FUNDAMENTAL CLOUD SECURITY RESEARCHTHAT STARTED CSA • 4TH VERSION, RELEASED JULY 2017 • ARCHITECTURE • GOVERNING INTHE CLOUD • GOVERNANCE AND ENTERPRISE RISK MANAGEMENT • LEGAL • COMPLIANCE & AUDIT MANAGEMENT • INFORMATION GOVERNANCE • OPERATING INTHE CLOUD • MANAGEMENT PLANE & BUSINESS CONTINUITY • INFRASTRUCTURE SECURITY • VIRTUALIZATION & CONTAINERS • INCIDENT RESPONSE • APPLICATION SECURITY • DATA SECURITY & ENCRYPTION • IDENTITY MANAGEMENT • SECURITY AS A SERVICE • RELATEDTECHNOLOGIES
- 12. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCECOPYRIGHT © 2018 CLOUD SECURITY ALLIANCE Active Working Groups • BLOCKCHAIN/DISTRIBUTED LEDGER • CLOUD CYBER INCIDENT SHARING • CLOUD COMPONENT SPECIFICATIONS • CLOUD CONTROLS MATRIX • CLOUD SECURITY SERVICES MANAGEMENT • CONSENSUS ASSESSMENTS • CONTAINERS AND MICROSERVICES • ENTERPRISE ARCHITECTURE • ERP SECURITY • FINANCIAL SERVICES • INTERNET OF THINGS • MOBILE • OPEN CERTIFICATION • PRIVACY LEVEL AGREEMENT • QUANTUM-SAFE SECURITY • SECURITY AS A SERVICE • SECURITY GUIDANCE • SOFTWARE DEFINED PERIMETER • TOP THREATS
- 13. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCECOPYRIGHT © 2018 CLOUD SECURITY ALLIANCE Paused Working Groups • BIG DATA • CLOUD DATA CENTER SECURITY • CLOUD DATA GOVERNANCE • HEALTH INFORMATION MANAGEMENT • INCIDENT MANAGEMENT AND FORENSICS • SAAS GOVERNANCE
- 14. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCECOPYRIGHT © 2018 CLOUD SECURITY ALLIANCE Dormant Working Groups • CLOUDAUDIT • CLOUDTRUST • CLOUDTRUST PROTOCOL • CLOUD VULNERABILITIES • INNOVATION • LEGAL • OPEN API • TELECOM • VIRTUALIZATION
- 15. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE 1 5 CREATING GUIDANCE AND SECURITY CONTROLS FOR NEW TYPES OF DEVICES, SYSTEMS, AND DATA. INTERNET OF THINGS STRIVES TO AUTOMATE SECURITY TASKS BY EMBEDDING SECURITY INTO THE DEVOPS WORKFLOW. DEV(SEC)OPS PROMISES TO TRANSFORM SOCIETY ON THE SCALE OF THE INDUSTRIAL REVOLUTION BEFORE IT. BIG DATA, AI, AUTOMATION ORCHESTRATION, INTEROPERABILITY, CONNECTIVITY AND ANALYTICS AT THE EDGE.. FOG COMPUTING TO SOLVE THE PROBLEM OF STOPPING NETWORK ATTACKS ON APPLICATION INFRASTRUCTURE THE SDP WORKGROUP DEVELOPED A CLEAN SHEET APPROACH THAT COMBINES ON DEVICE AUTHENTICATION, IDENTITY- BASED ACCESS AND DYNAMICALLY PROVISIONED CONNECTIVITY. SOFTWARE DEFINED PERIMETER ACTED AS A DIGITAL LEDGER FOR CRYPTOCURRENCY BUT CAN NOW BE APPLIED IN NEW USE CASES. BLOCKCHAIN
- 16. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE 201 8 RE SE A RCH RE LE A SES APPLICATION CONTAINERS AND MICROSERVICES NIST Guidance for Containers and Microservices CLOUD CONTROLS MATRIX (CCM) Mapping Methodology ISO 27001, 27002, 27017, 27018 ENTERPRISE RESOURCE PLANNING State of ERP Security in the Cloud TOP THREATS Deep Dive Analysis INTERNET OF THINGS Blockchain for the IoT CYBER INCIDENT SHARING Best Practices for Cyber Incident Exchange
- 17. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE 201 8 RE SE A RCH RE LE A SES HEALTH INFORMATION MANAGEMENT State of Cloud in Healthcare SOFTWARE DEFINED PERIMETER (SDP) SDP Architecture Overview Document Glossary of SDP Terminology Awareness Poll/Survey (infographic) QUANTUM SAFE SECURITY A Day without RSA Whitepaper Quantum Safe Security Awareness Post Quantum Cryptography
- 18. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE 201 8 RE SE A RCH RE LE A SES NEW WORKING GROUPS ARTIFICIAL INTELLIGENCE DEVOPS CLOUD DATA GOVERNANCE • Data Classification HEALTHCARE INTERNET OF THINGS • Fog Computing
- 19. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE 201 8 R E SE A R CH RE LE A SES SECURITY AS A SERVICE SecaaS Categories of Services Document V.2 CASB Implementation Guidance CLOUD SECURITY CONTROLS FRAMEWORK (CCM) AICPA TSP 2017 NIST SP 800-53 Rev 5 Candidate Mapping CONTAINERS AND MICROSERVICES NIST 800 Level Document w/ Use Cases INTERNET OF THINGS IoT Security Controls for the Enterprise OPEN CERTIFICATION FRAMEWORK Benefits of STAR STAR Level 3 (Continuous Monitoring) FINANCIAL SERVICES Key Management for SaaS Entitlement Management Risk Assessment Guide
- 20. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE 201 8 R E SE A R CH RE LE A SES SOFTWARE DEFINED PERIMETER (SDP) State of SDP SDP Specification v2.0 ENTERPRISE RESOURCE PLANNING IaaS considerations for implementing ERP COMMISSIONED RESEARCH GDPR Survey BLOCKCHAIN Use Cases for Blockchain
- 21. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE U SE FU L C SA LINKS CLOUD CONTROLS MATRIX (CCM) https://cloudsecurityalliance.org/group/cloud-controls-matrix/ CONSENSUS ASSESSMENT INITIATIVE QUESTIONNAIRE (CAIQ) https://cloudsecurityalliance.org/group/consensus-assessments/ CSA STAR (Security, Trust and Assurance Registry), Provider Assurance Program https://cloudsecurityalliance.org/star/ CSA CloudBytes Channel https://cloudsecurityalliance.org/research/cloudbytes/#_overview STARWatch https://cloudsecurityalliance.org/star/watch/ DOWNLOAD CSA RESEARCH ARTIFACTS https://cloudsecurityalliance.org/download
- 22. COPYRIGHT © 2018 CLOUD SECURITY ALLIANCE 22 T H A N K Y O U Let’s Connect Email: lsantos@cloudsecurityalliance.org Twitter: @CSAResearchGuy LinkedIn: https://linkedin.com/in/lucianojrsantos Our Workgroups: www.cloudsecurityalliance.org/research Learn: www.cloudsecurityalliance.org/research/cloudbytes Download: www.cloudsecurityalliance.org/download