Cloud Security & Privacy Standard Slide
- 3. Source: The Global Risk Landscape 2016, World Economic Forum Cyber attacks are among Top 10 Risks WEFORUM: Global Risk Landscape 2016
- 4. Summary of 2017 Cyber Threat Landscape § Advanced Threats Targeting the Cloud § Evolution of Ransomware: Changing Data and Destroying Backups § GDPR Compliance Approaching § Increased Demand for Cyber Insurance § Shadow IT § Cyber Espionage and Warfare § Dronejacking § IoT Malware § Hacktivists exposing privacy issues
- 5. 2017 Cyber Security Trends in Thailand § Cyber security regulations improvement § More demand for cyber security skills § Attackers will target consumers § Attackers will become more bolder, more commercial and less traceable § Breaches will get more complicated and harder to beat
- 9. © ACinfotec 2017 | www.acinfotec.com Page 9 CSA Top Threats: Notorious Nine 1. Data Breaches 2. Data Loss 3. Account Hijacking 4. Insecure APIs 5. Denial of Service 6. Malicious Insiders 7. Abuse of Cloud Services 8. Insufficient Due Diligence 9. Shared Technology Issues Source: https://cloudsecurityalliance.org/group/top-threats/
- 10. Best Practice for Securing the Cloud
- 11. © ACinfotec 2017 | www.acinfotec.com Page 11 Guideline for Implementing Security Controls in the Cloud • Controls derived from guidance • Mapped to familiar frameworks: ISO 27001, PCI, COBIT • Applicable to IaaS, PaaS, SaaS • Customer vs Provider roles • Help bridges the gap for IT and IT Auditor
- 13. © ACinfotec 2017 | www.acinfotec.com Page 13 Consensus Assessment Initiatives § Self-assessment questionnaire, which can be used to assess cloud security § Latest version is v3.0.1 covering 16 governing & operating domains aligned with CCM https://cloudsecurityalliance.org/group/consensus-assessments/ § Main mechanism to be listed in CSA STAR registry (see later slide)
- 19. © ACinfotec 2017 | www.acinfotec.com Page 19 ISO 27017 Cloud Security Code of practice for security controls based on ISO/ IEC 27002 for cloud services • Cloud-specific, ISO standard • provide the necessary guidance on information security controls for the cloud • Supplemental to ISO 27001, ISO 27002 and ISO 27018 • Can be used by both Cloud users and Cloud providers
- 20. © ACinfotec 2017 | www.acinfotec.com Page 20 ISO 27017 Cloud Security Introducing ISO 27017 § The objectives of this International Standard are to provide a security control framework and implementation guidance for both cloud service customers and cloud service providers. § The guidelines of this International Standard include identification of risks and associated controls for the use of cloud services.. ISO 27017 Controls based on ISO 27002 ISO 27002 controls ISO 27017 Annex A Provided specific guidance for cloud service customers and cloud service providers base on ISO 27002 controls Provided extended control set for securing the cloud Specific guidance for cloud
- 24. Best Practice for Protecting Privacy in the Cloud
- 25. © ACinfotec 2017 | www.acinfotec.com Page 25 ISO 27018 Public Cloud Privacy Code of practice for protection of PII in public clouds acting as PII processors • Published on August 2014 • Cloud-specific, ISO standard • Based on privacy principles defined in ISO 29100 • Govern how users’ personally identifiable information (PII) should be protected by cloud providers • Supplemental to ISO 27001 and ISO 27002
- 26. © ACinfotec 2017 | www.acinfotec.com Page 26 ISO 27018 Public Cloud Privacy Introducing ISO 27018 § Typically an organization implementing ISO/IEC 27001 is protecting its own information assets. However, in the context of PII protection requirements for a public cloud service provider acting as a PII processor, the organization is protecting the information assets entrusted to it by its customers. ISO 27018 Annex A Provided specific guidance for protecting PII base on ISO 27001 controls Provided additional controls for protecting PII base on ISO 29100 principle ISO 27018 Controls based on ISO 27002 ISO 27002 controls Specific guidance for privacy in the cloud
- 31. © ACinfotec 2017 | www.acinfotec.com Page 31 What is CSA STAR? § Public and free registry of Cloud Provider self assessments, demonstrating adoption of: § Cloud Control Matrix (CCM) § Consensus Assessments Initiative Questionnaire (CAIQ) § Promoting transparency § Free market competition to provide quality assessment § Available on October 2011
- 35. © ACinfotec 2017 | www.acinfotec.com Page 35 CSA STAR Certification Level 2 – Certification §Base on ISO 27001:2013 with CSA CCM as additional or compensating controls §Measures the capability levels of the cloud service provider §Evaluates the efficiency of an organization’s ISMS and ensure the scope, processes and objectives are “Fit for Purpose” §Based on the PDCA model
- 36. © ACinfotec 2017 | www.acinfotec.com Page 36 CSA STAR Certification §A STAR Certification Certificate cannot be issued unless the organization has achieved ISO 27001 certification §The scope of ISO 27001 certification must not be less than the scope of STAR certification §The assessment cycle is the same as ISO 27001 – initial assessment followed by surveillance audits over a 3-year period
- 37. © ACinfotec 2017 | www.acinfotec.com Page 37 Certifications of Leading Cloud Service Providers
- 38. © ACinfotec 2017 | www.acinfotec.com Page 38 Certifications of Leading Cloud Service Providers
- 39. © ACinfotec 2017 | www.acinfotec.com Page 39 Certifications of Leading Cloud Service Providers
- 42. Key Takeaway – Securing the Cloud Operations § Encrypt data when possible, segregate key management from cloud provider § Adapt secure software development lifecycle § Understand provider’s patching, provisioning, protection § Logging, data exfiltration, granular customer segregation § Hardened VM images § Assess provider IDM integration, e.g. SAML, OpenID Governance § Secure cloud engagement before procurement – contracts, SLAs, architecture § Know provider’s BCM/DR, financial viability, employee screening § Identify data location when possible § Plan for provider termination & return of assets § Preserve right to audit § Reinvest provider cost savings into due diligence
- 43. For more information, contact: ACinfotec Consulting Services 02-670-8980-3 | services@acinfotec.com | www.acinfotec.com THANK YOU DRIVING BUSINESS EXCELLENCE