CSA Atlanta Q1'2016 Chapter Meeting

• 5:30-5:50
Networking
• 5:50-6:20
The Treacherous 12
Cloud Computing Top Threats in 2016
• 6:20-6:40
CSA Chapter Announcements and Research
• 2015 at a Glance
• Ways to get involved
• Research
• International Standards
• Learn, Know and Connect
• 6:40-7:00
Vote for new CSA Atlanta Chapter Board Leaders
© Cloud Security Alliance, 2016.

Our Host:
Thank you!

Our Dinner Sponsor:
Thank you!

•Global, not-for-profit organization
•Building security best practices for
next generation IT
•Research and Educational
Programs
•Cloud Provider Certification –
CSA STAR
•User Certification - CCSK
•The globally authoritative source
for Trust in the Cloud
2016
at a Glance
“To promote the use of
best practices for
providing security
assurance within Cloud
Computing, and provide
education on the uses
of Cloud Computing to
help secure all other
forms of computing.”

Mission statement
•“To promote the use of best
practices for providing security
Computing, and provide education
on the uses of Cloud Computing
to help secure all other forms of
computing.”
• Building the trusted cloud ecosystem
• Solving tomorrow’s problems today
• For the good of the community
• Agile, see problems first, solve
problems first
2016
at a Glance
best practices for
providing security
Computing, and provide
education on the uses
of Cloud Computing to
help secure all other

WAYS TO GET INVOLVED
© Cloud Security Alliance, 2016

Through Chapters
•75 + Chapters
Worldwide
• Extension of CSA Global
• Opportunities to Network
with Peers
• Local Events
• Summits
• Research (Areas of
Focus)
https://cloudsecurityalliance.org/chapters/

As an Individual Member
• Over 71,000+ Individual Members Today (…and growing)
• Join the LinkedIn Group :
• https://www.linkedin.com/groups/1864210
• Participate in Research Working Groups
• Get updates on the latest CSA Activities

Through Membership
•Over 240 Supporting
Members
•3 Membership Levels
• Executive Members (6)
• Enterprise User
Members (61)
• Solution Provider
Members (173)
• Member Profiles: Cloud providers,
tech leaders, security industry,
Global 2000 enterprise users of
cloud

Through Membership
•Executive Members (6)
•Unique Benefits
• Completely Custom
• Sponsored Research Initiatives or
Custom Research
• Inclusion of Keynotes or Speaking
spots at Major
• Seat on the Executive
Membership Board

Through Membership
•Enterprise User
Members (61)
•Growing Classification
•Unique Benefits
• Analyst Meetings
• 8 CCSK Tokens
• Seat on the Enterprise User
Council

Through Membership
•Solution Provider
Members (173)
• The foundation of our
organization
•Unique Benefits
• Marketing Opportunities
• Seat on SME Council
• Seat on the Solution Provider
(Marketing) Call
• Opportunities to showcase SME’s

https://cloudsecurityalliance.org/group/top-threats/

CSA Top Threats for 2016
• Follow up to earlier research artifacts
• Top Threats research plays a crucial role in the CSA research
ecosystem
• The report provides organizations with an up-to-date, expert-informed
understanding of cloud security concerns in order to make educated
risk-management decisions regarding cloud adoption strategies.
• The report reflects the current consensus among security experts in the
CSA community about the most significant security issues in the cloud.

The Treacherous 12
Cloud Computing Top Threats in 2016
*Ranked in order of severity per survey results
1. Data Breaches
2. Weak Identity, Credential and
Access Management
3. Insecure APIs
4. System and Application
Vulnerabilities
5. Account Hijacking
6. Malicious Insiders
7. Advanced Persistent Threats
(APTs)
8. Data Loss
9. Insufficient Due Diligence
10. Abuse and Nefarious Use of Cloud
Services
11. Denial of Service
12. Shared Technology Issues
• The 2016 Top Threats release mirrors the
shifting ramifications of poor cloud computing
decisions up through the managerial ranks,
instead of being an IT issue it is now a
boardroom issue.
• The reasons may lie with the maturation of
cloud, but more importantly, higher strategic
decisions by executives in cloud adoption.
• The 2013 edition highlighted developers and
IT departments rolling out their own self-
service Shadow IT projects, and the
bypassing of organizational security
requirements.
• In 2016, cloud adoption may be effectively
aligned with the executive strategies to
maximize shareholder value.
• A threat analysis was also conducted with the
STRIDE Threat Model and the working group
recommends the NIST Risk Management
Framework on guidance for how to manage
information technology risk.
• This threat research document should be
utilized in conjunction with the best practices
guides, “Security Guidance for Critical Areas
in Cloud Computing V.3” and “Security as a
Service Implementation Guidance”.

Top
Threats
Detour:
Cloud
Controls
Matrix

Back to
Top
Threats

1. Security Concern: Data Breaches
Description
• An incident in which sensitive, protected or confidential
information is released, viewed, stolen or used by an
individual who is not authorized to do so.
• May be the primary objective of a targeted attack or may
simply be the result of human error, application
vulnerabilities or poor security practices.
• May involve any kind of information that was not intended
for public release including, but not limited to, personal
health information, financial information, personally
identifiable information (PII), trade secrets and
intellectual property.
• An organization’s cloud-based data may have value to
different parties for different reasons.
• The risk of data breach is not unique to cloud computing,
but it consistently ranks as a top concern for cloud
customers.
• A cloud environment is subject to the same threats as a
traditional corporate network as well as new avenues of
attack by way of shared resources, cloud provider
personnel and their devices and third party partners of
the cloud provider. Cloud providers are highly accessible
and the vast amount of data they host makes them an
attractive target.

Security Concern: Data Breaches
Business Impacts
• Although nearly any data breach can
be problematic, the sensitivity of the
data usually determines the extent of
the damage.
• In many parts of the world, laws and
regulations oblige organizations to
exercise certain standards of care to
ensure that sensitive information is
protected against unauthorized use.
• When a data breach occurs,
companies may incur large fines and
may also be subject to civil lawsuits
and, in some cases, criminal charges.
• A company also accrues costs related
to investigating a breach and notifying
customers who were impacted.
• Some companies engage
professional consulting and legal
services to assist with managing the
breach response.
• It is also customary for a company
suffering a data breach to purchase
credit monitoring services for
consumers whose information was
stolen to alert them in case of
fraudulent use.
• Indirect impacts such as damage to a
brand’s reputation and resulting loss
of business are much harder to
calculate.
• Measures such as the rate at which
customers leave, and any change to
the cost of user acquisition can be
used to estimate this.
• Cloud providers often have good
security for aspects they take
responsibility for but, ultimately
customers are responsible for
protecting their data in the cloud.
• Two important security measures that
can help companies stay secure in
the cloud are multifactor
authentication and encryption.
Anecdotes and Examples
• In mid-2015, BitDefender, an antivirus
firm, had an undisclosed number of
customer usernames and passwords
stolen due to a security vulnerability in
its public cloud application hosted on
AWS. The hacker responsible
demanded a ransom of $15,000.
• The 2015 Anthem breach of more
than 80 million customer records
began with stolen credentials on the
corporate network. A third-party cloud
service was used to transfer the huge
data store from the company’s
network to the public cloud where it
could be downloaded by the hackers.
• British telecom provider TalkTalk
reported multiple security incidents in
2014 and 2015, which resulted in the
theft of four million customers’
personal information. The breaches
were followed by a rash of scam calls
attempting to extract banking
information from TalkTalk customers.
TalkTalk was widely criticized for its
failure to encrypt customer data.

Security Concern: Data Breaches
CCM v3.0.1 Control IDs
• AIS-04: Application & Interface Security – Data
Security/Integrity
• CCC-02: Change Control & Configuration Management –
Outsourced Development
• DSI-02: Data Security & Information Lifecycle
Management – Data Inventory/Flows
Management – Information Leakage
Management – Non-Production Data
Management – Secure Disposal
• EKM-02: Encryption & Key Management – Key
Generation
• EKM-03: Encryption & Key Management – Sensitive
Data Protection
• EKM-04: Encryption & Key Management – Storage and
Access
• GRM-02: Governance and Risk Management – Data
Focus Risk Assessments
• GRM-10: Governance and Risk Management – Risk
Assessments
• HRS-02: Human Resources – Background Screening
• HRS-06: Human Resources – Mobile Device
Management
• IAM-02: Identity & Access Management – Credential
Lifecycle/Provision Management
• IAM-04: Identity & Access Management – Policies and
Procedures
• IAM-05: Identity & Access Management – Segregation
of Duties
• IAM-07: Identity & Access Management – Third Party
Access
• IAM-09: Identity & Access Management – User
Access Authorization
• IAM-12: Identity & Access Management – User ID
Credentials
• IVS-08: Infrastructure & Virtualization Security –
Production/Non-Production Environments
Segmentation
Hypervisor Hardening
• SEF-03: Security Incident Management, E-Discovery
& Cloud Forensics – Incident Reporting
• STA-06: Supply Chain Management, Transparency
and Accountability – Third Party Assessment

2. Security Concern: Insufficient Identity,
Credential and Access Management
Description
• Data breaches and enabling of attacks
can occur because of a lack of scalable
identity access management systems,
failure to use multifactor authentication,
weak password use, and a lack of
ongoing automated rotation of
cryptographic keys, passwords and
certificates.
• Credentials and cryptographic keys must
not be embedded in source code or
distributed in public facing repositories
such as GitHub, because there is a
significant chance of discovery and
misuse. Keys need to be appropriately
secured and a well-secured public key
infrastructure (PKI) is needed to ensure
key-management activities are carried
out.
• Identity management systems must
support immediate de-provisioning of
access to resources when personnel
changes, such as job termination or role
change, occur.
• Organizations planning to federate
identity with a cloud provider need to
understand the security around the cloud
provider’s identity solution, including
processes, infrastructure, segmentation
between customers (in the case of a
shared identity solution), and
implemented by the cloud provider.
• Multifactor authentication systems are
required for users and operators of a
cloud service.
• In cases where legacy systems require
use of passwords alone, the
authentication system must support
policy enforcement such as verification of
strong password use as well as
organization-defined rotation period
policies.
• Cryptographic keys, including TLS
certificates, keys used to protect access
to data and keys used to encrypt data at
rest must be rotated periodically. Doing
so helps address attacks where keys are
accessed without authorization.
• Any centralized storage mechanism
containing data secrets is an extremely
high-value target for attackers. An
organization must weigh the trade-off of
convenience of centralized key
management against the threat
presented by centralizing keys. As with
any high-value asset, monitoring and
protection of identity and key
management systems should be a high
priority.

Security Concern: Insufficient Identity,
Business Impacts
• Malicious actors masquerading as
legitimate users, operators or
developers can
• Read/exfiltrate, modify and
delete data;
• Issue control plane and
management functions;
• Snoop on data in transit or
release malicious software that
appears to originate from a
legitimate source.
• As a result, insufficient identity,
credential or key management can
enable unauthorized access to data
and potentially catastrophic damage
to organizations or end users.
• Attackers Scrape GitHub for Cloud Service
Credentials, Hijack Account to Mine Virtual Currency
– “Cloud service provider credentials included in a
GitHub project were discovered and misused within
36 hours of the project going live.”

Security Concern: Insufficient Identity,
• IAM-01: Identity & Access Management – Audit Tools
Access
Lifecycle / Provision Management
• IAM-03: Identity & Access Management – Diagnostic /
Configuration Ports Access
• IAM-04: Identity & Access Management – Policies and
Procedures
• IAM-05: Identity & Access Management – Segregation of
Duties
• IAM-06: Identity & Access Management – Source Code
Access Restriction
• IAM-07: Identity & Access Management – Third Party
Access
• IAM-08: Identity & Access Management – Trusted
Sources
• IAM-09: Identity & Access Management – User Access
Authorization
Reviews
Revocation
Credentials
• IAM-13: Identity & Access Management – Utility
Programs Access
• HRS-01: Human Resources – Asset Returns
• HRS-03: Human Resources – Employment
Agreements
• HRS-04: Human Resources – Employment
Termination
• HRS-08: Human Resources – Technology Acceptable
Use
• HRS-09: Human Resources – Training / Awareness
• HRS-10: Human Resources – User Responsibility

3. Security Concern: Insecure Interfaces and APIs
Description
• Cloud computing providers expose a set
of software user interfaces (UIs) or
application programming interfaces
(APIs) that customers use to manage
and interact with cloud services.
• Provisioning, management,
orchestration and monitoring are all
performed with these interfaces.
• The security and availability of
general cloud services is dependent
on the security of these basic APIs.
• From authentication and access
control to encryption and activity
monitoring,
• These interfaces must be designed to
protect against both accidental and
malicious attempts to circumvent policy.
• Organizations and third parties may build
on these interfaces to offer value-added
services to their customers. This
introduces the complexity of the new
layered API; it also increases risk,
because organizations may be required
to relinquish their credentials to third
parties in order to enable their agency.
• APIs and UIs are generally the most
exposed part of a system, perhaps the
only asset with an IP address available
outside the trusted organizational
boundary.
• These assets will be the target of heavy
attack, and adequate controls protecting
them from the Internet are the first line of
defense and detection.

Security Concern: Insecure Interfaces and APIs
Business Impacts
• While most providers strive to ensure
that security is well integrated into
their service models, it is critical for
consumers of those services to
understand the security implications
associated with the use,
management, orchestration and
monitoring of cloud services.
• Reliance on a weak set of interfaces
and APIs exposes organizations to a
variety of security issues related to
confidentiality, integrity, availability
and accountability.
• Threat modeling applications and
systems, including data flows and
architecture/design, become
important regular parts of the
development lifecycle.
• In addition to security-specific code
reviews, rigorous penetration testing
becomes a requirement.
• The IRS Breach and the Importance
of Adaptive API Security – “In mid-
2015, the US Internal Revenue
Service (IRS) exposed over 300,000
records via a vulnerable API (“Get
Transcript”).”
• Why Exposed API Keys and Sensitive
Data are Growing Cause for Concern
– API security involves more than just
securing the API itself: it involves
protecting API keys, cloud credentials
and other sensitive data from public
exposure—security measures that are
sometimes overlooked by developers.
http://www.programmableweb.com/
news/why-exposed-api-keys-and-
sensitive-data-are-growing-
causeconcern/analysis/2015/01/05
• AIS-01: Application & Interface
Security – Application Security
Security – Data Security/Integrity
• IAM-08: Identity & Access
Management – Trusted Sources
Management – User Access
Authorization

4. Security Concern: System Vulnerabilities
Description
• System vulnerabilities are exploitable
bugs in programs that attackers can use
to infiltrate a computer system for the
purpose of stealing data, taking control of
the system or disrupting service
operations.
• Vulnerabilities within the components of
the operating system – kernel, system
libraries and application tools – put the
security of all services and data at
significant risk.
• This type of threat is nothing new; bugs
have been a problem ever since the
invention of computers; they became
exploitable remotely when networks were
created.
• With the advent of multitenancy in cloud
computing, systems from various
organizations are placed in close
proximity to each other, and given access
to shared memory and resources,
creating a new attack surface.
• While the damage resulting from attacks
on system vulnerabilities can be
considerable, such attacks can be
mitigated with basic IT processes.
• Regular vulnerability scanning, following
up on reported system threats and
installation of security patches or
upgrades go a long way toward closing
the security gaps left open by system
vulnerabilities.
• Secure design and architecture can
lessen the chances of an attacker taking
full control of every part of an information
system by limiting who has access to
specific systems.

Security Concern: System Vulnerabilities
Business Impacts
• The impact from unpatched system
vulnerabilities on information system
security is profound and costly. However,
the costs for protection are relatively
small compared to other IT expenditures,
which can include cleaning up after
successful system attacks.
• The cost of putting IT processes in place
to discover and repair vulnerabilities is
small in comparison to the potential
damage they can cause.
• Organizations that are highly regulated
(e.g. government and financial
institutions) need to be capable of
handling patching quickly and, when
possible, in an automatic recurring
fashion.
• Security management must put in place a
threat intelligence function, to fill the gap
between the time a vulnerability is
announced (known as ‘0-day’), and the
time a patch is provided by the vendor.
• Change control processes that address
emergency patching of critical resources,
and various vulnerability scenarios must
be created to ensure vulnerability
remediation activities are properly
documented and reviewed by technical
teams prior to being mitigated, validated, and
closed. Any other method of handling the
threat, such as elimination, transference, or
acceptance, must also be documented and
tracked.
• Magnified Losses, Amplified Need for
Cyber-Attack Preparedness –
“Heartbleed and Shellshock proved
that even open source applications,
which were believed more secure
than their commercial counterparts,
were vulnerable to threats. They
particularly affected systems running
Linux, which is concerning given that
67.7% of websites use UNIX, on
which the former (Linux) is based.”
• Verizon 2015 Data Breach
Investigations Report – “The
Shellshock bug in Bash was 2014’s
second tumultuous OSS vulnerability
event, quickly eclipsing Heartbleed
due to many more successful
attacks.”
• 2014 Cyberthreat Defense Report –
“75% of attacks use publicly known
vulnerabilities in commercial software
that could be prevented by regular
patching.”
Security – Application Security
Security – Customer Access
Requirement
Security – Data Integrity
Security – Data Security/Integrity
• BCR-04: Business Continuity
Management & Operational
Resilience - Documentation
• CCC-03: Change Control &
Configuration Management - Quality
Testing
• IVS-05: Infrastructure & Virtualization
Security Management – Vulnerability
Management
Security Management – OS
Hardening and Base Controls
• TVM-02: Threat and Vulnerability
Management – Patch Management

5. Security Concern: Account Hijacking
Description
• Account or service hijacking is not new.
Attack methods such as phishing, fraud
and exploitation of software
vulnerabilities still achieve results.
Credentials and passwords are often
reused, which amplifies the impact of
such attacks.
• Cloud solutions add a new threat to the
landscape. If an attacker gains access to
your credentials, they can eavesdrop on
your activities and transactions,
manipulate data, return falsified
information and redirect your clients to
illegitimate sites. Your account or service
instances may become a new base for
attackers. From here, they may leverage
the power of your reputation to launch
subsequent attacks.
• Organizations should be aware of these
types of attacks as well as common
defense-in-depth protection strategies to
contain the damage – and possible
litigation – resulting from a breach.
Organizations should look to prohibit the
sharing of account credentials among
users and services and leverage strong
two-factor authentication techniques
where possible. All accounts and account
activities should be monitored and
traceable to a human owner, even
service accounts. © Cloud Security Alliance, 2016.
• Account and service hijacking, usually
with stolen credentials, remains a top
threat. With stolen credentials, attackers
can often access critical areas of cloud
computing services, allowing them to
compromise the confidentiality, integrity
and availability of those services.
• Attackers can leverage account access
to steal data, impact cloud services and
systems, damage the reputation of
tenants and more.
Business Impacts

Security Concern: Account Hijacking
• In April 2010, Amazon experienced a
cross-site scripting (XSS) bug that
allowed attackers to hijack credentials
from the site.
• In 2009,numerous Amazon systems
were hijacked to run Zeus botnet
nodes.
• In June 2014, Code Spaces’ Amazon
AWS account was compromised
when it failed to protect the
administrative console with multifactor
authentication. All the company’s
assets were destroyed, putting it out
of business.
• IAM-08: Identity & Access Management – Trusted Sources
Authorization
Reviews
Revocation
Credentials
• IVS-01: Infrastructure & Virtualization Security – Audit
Logging/Intrusion Detection
• SEF-02: Security Incident Management, E-Discovery &
Cloud Forensics – Incident Management

6. Security Concern: Malicious Insiders
Description
• The risk caused by malicious
insiders has been debated in the
security industry. While the level
of threat is left to debate, the fact
that insider threat is a real
adversary is not. CERN defines
an insider threat as follows:
• “A malicious insider threat to an
organization is a current or
former employee, contractor, or
other business partner who has
or had authorized access to an
organization’s network, system,
or data and intentionally
exceeded or misused that
access in a manner that
negatively affected the
confidentiality, integrity, or
availability of the organization’s
information or information
systems.”
• A malicious insider, such as a system
administrator, can access potentially sensitive
information.
• From IaaS to PaaS and SaaS, a malicious insider
can have increasing levels of access to more
critical systems and eventually to data. Systems
that depend solely on the cloud service provider
(CSP) for security are at greater risk here.
• Implementations that use encryption provided by
the CSP are still vulnerable to malicious insider
attack, even though the service provider’s key
management duties are separated from data
storage administration in mature organizations.
• The key finding here surrounds the CSP’s
auditable processes and any observations of ad
hoc or less than-measured procedures. The
controls available to limit risk from malicious
insiders include controlling the encryption process
and keys yourself, ensuring that the CSP has
proper policies; segregating duties; minimizing
access by role; and effective logging, monitoring
and auditing of administrators’ activities.
• It should be noted that the “Insider Threat” does
not always involve malicious actors. Insiders
might not necessarily be malicious but are “just
trying to get their job done”. For example, they
might accidentally upload a customer database to
a public repository or copy sensitive data between
jurisdictions or countries.
Business Impacts

Security Concern: Malicious Insiders
• Insider Threats to Cloud
Computing – “Overall, the ‘inside job’
is responsible for most cloud
computing security woes. Enterprises
have to become proactive in finding
solutions to their security threats to
protect their sensitive information.”
• Cloud’s Privileged Identity Gap
Intensifies Insider Threats –
“Organizations need to rein in shared
accounts and do a better job tracking
user activity across cloud
architectures.”
• DCS-04: Datacenter Security – Off-
Site Authorization
• DCS-08: Datacenter Security –
Unauthorized Persons Entry
• DCS-09: Datacenter Security – User
Access
• DSI-04: Data Security & Information
Lifecycle Management –
Handling/Labeling/Security Policy
• DSI-06: Data Security & Information
Lifecycle Management –
Ownership/Stewardship
• EKM-02: Encryption & Key
Management – Key Generation
• EKM-03: Encryption & Key
Management – Sensitive Data
Protection
• GRM-07: Governance and Risk
Management – Policy Enforcement
• GRM-10: Governance and Risk
Management – Risk Assessments
• HRS-02: Human Resources –
Background Screening
• HRS-07: Human Resources –
Roles/Responsibilities
Management – Segregation of Duties
Management – Audit Tools Access
Management – Trusted Sources
Management – User Access
Authorization
Management – User Access Reviews
Security – Segmentation
• STA-09: Supply Chain Management,
Transparency and Accountability –
Third Party Audits

7. Security Concern: Advanced Persistent Threats
Description
• Advanced Persistent Threats (APTs) are a
parasitical form of cyberattack that infiltrates
systems to establish a foothold in the computing
infrastructure of target companies from which they
smuggle data and intellectual property. APTs pursue
their goals stealthily over extended periods of time,
often adapting to the security measures intended to
defend against them.
• Spearphishing, direct hacking systems, delivering
attack code through USB devices, penetration
through partner networks and use of unsecured or
third-party networks are common points of entry for
APTs. Once in place, APTs can move laterally
through data center networks and blend in with
normal network traffic to achieve their objectives.
• It pays for IT departments to be informed about the
latest advanced cybersecurity attacks that target
companies and government organizations. Although
APTs can be difficult to detect and eliminate, some
can be stopped with proactive security measures.
For example, it is critical that users be educated to
recognize and handle social engineering techniques
such as spearphishing that are commonly used to
introduce APTs.
• Awareness programs that are regularly reinforced
are one of the best defenses against these types of
attacks, because many of these vulnerabilities
require user intervention or action. Staff should be
ingrained with thinking twice before opening an
attachment or clicking a link. © Cloud Security Alliance, 2016.
• Combating complex APTs may
require more advanced security
controls, process management,
incident response plans and IT staff
training, all of which can lead to
increased security budgets. This
cost should be weighed against the
economic damage inflicted by
successful APT attacks.
Business Impacts

Security Concern: Advanced Persistent Threats
• Carbanak: How Would You Have Stopped
a $1 Billion APT Attack? – “… Carbanak, an
APT attack against financial institutions
around the world, may well be considered the
largest cyberheist to date. … Unlike the usual
cybercriminal method of stealing consumer
credentials or compromising individual online
banking sessions with malware, the brazen
Carbanak gang targeted banks’ internal
systems and operations, resulting in a
multichannel robbery that averaged $8 million
per bank.”
• Current Trends in the APT World – “The
alleged Chinese Cyber-Espionage with its
APTs caused the theft of “ ‘hundreds of
terabytes of data from at least 141
organizations across a diverse set of
industries beginning as early as 2006.’ ”
• Current Trends in the APT World – “The
Department of Homeland Security reports
that APTs ‘directed toward businesses have
created a surging worldwide demand for
solutions to combat these dangerous
emerging threats.’ ”
• AIS-01: Application & Interface Security – Application Security
• AIS-02: Application & Interface Security – Customer Access
Requirement
• AIS-03: Application & Interface Security – Data Integrity
• AIS-04: Application & Interface Security – Data Security/Integrity
• BCR-04: Business Continuity Management & Operational
Resilience – Documentation
• IVS-01: Infrastructure & Virtualization Security – Audit
• IVS-02: Infrastructure & Virtualization Security – Change
Detection
• IVS-05: Infrastructure & Virtualization Security Management –
Vulnerability Management
OS Hardening and Base Controls
Network Architecture
• TVM-01: Threat and Vulnerability Management – Anti-
Virus/Malicious Software
• TVM-02: Threat and Vulnerability Management –
Vulnerability/Patch Management

8. Security Concern: Data Loss
Description
• For both consumers and businesses, the
prospect of permanently losing one’s data is
terrifying.
• Data stored in the cloud can be lost for reasons
other than malicious attacks. An accidental
deletion by the cloud service provider, or worse,
a physical catastrophe such as a fire or
earthquake, can lead to the permanent loss of
customer data unless the provider or cloud
consumer takes adequate measures to back up
data, following best practices in business
continuity and disaster recovery – as well as daily
data backup and possibly off-site storage.
Furthermore, the burden of avoiding data loss
does not fall solely on the provider’s shoulders. If
a customer encrypts his or her data before
uploading it to the cloud but loses the encryption
key, the data will be lost as well.
• Cloud consumers should review the contracted
data loss provisions, ask about the redundancy
of a provider’s solution, and understand which
entity is responsible for data loss and under what
conditions.
• Some providers offer solutions for geographic
redundancy, data backup within the cloud, and
premise-to-cloud backups. The risk of relying on
the provider to store, backup and protect the data
must be considered against handling that
function in-house, and the choice to do both may
be made if data is highly critical. © Cloud Security Alliance, 2016.
• Information may not be seen as a
critical asset, but it is the lifeblood of
virtually all modern organizations. It is
the single most valuable asset most
companies possess. Even small
companies that sell physical products
and related services rely on access to
data for daily operations: inventory,
supplier and customer lists, orders,
scheduling, billing, payroll, financials
and more. Data loss can be
catastrophic; more than one company
has been forced out of business
because management failed to take
steps to ensure that it could recover
critical information stored in the cloud.
• Under the new EU data protection
rules, data destruction and corruption
of personal data are considered forms
of data breaches and require
appropriate notifications.
• Additionally, many compliance policies
require organizations to retain audit
records or other documentation. If an
organization stores this data in the
cloud, loss of that data can jeopardize
its compliance status.
Business Impacts

Security Concern: Data Loss
• In April 2011, Amazon EC2 suffered a crash
that led to significant data loss for many
customers.
• In November 2014, attackers broke into Sony
and leaked confidential information such as
PII and email exchanges among Sony
employees. In the first quarter 2015, Sony set
aside USD $15 million to address ongoing
damages from the hack.
• In June 2014, Code Spaces, an online
hosting and code publishing provider, was
hacked, leading to the compromise and
complete destruction of most customer data.
The company was ultimately unable to
recover from this attack and went out of
business.
Resilience – Retention Policy
Resilience – Environmental Risks
Resilience – Equipment Location
• GRM-02: Governance and Risk Management – Data Focus Risk
Assessments

9. Security Concern: Insufficient Due Diligence
Description
• When executives create business
strategies, cloud technologies and CSPs
must be considered. Developing a good
roadmap and checklist for due diligence
when evaluating technologies and CSPs
is essential for the greatest chance of
success.
• An organization that rushes to adopt
cloud technologies and choose CSPs
without performing due diligence exposes
itself to a myriad of commercial, financial,
technical, legal and compliance risks that
jeopardize its success.
• This applies whether the company is
considering moving to the cloud or
merging with or acquiring a company that
has moved to the cloud or is considering
doing so.
• Commercial: Anticipated or newly designed
customer services that rely on the CSP to
develop new systems and processes may not
be a priority for or an expertise of the CSP.
• Technical: Unknown operational and
architectural issues can arise when designers
and architects unfamiliar with cloud
technologies are designing applications being
pushed to the cloud.
• Legal: Data in use, motion or at rest in
foreign locations during normal operations or
even during recovery may subject the
company to regulatory redress.
• Compliance: Moving applications that
depend on “internal” network level data
privacy and security controls to the cloud is
dangerous when those controls disappear.
• The bottom line for enterprises and
organizations moving to a cloud technology
model is that they must perform extensive
due diligence to understand the risks they
assume by adopting this technology model
and engaging the suppliers who provide it.
Business Impacts

Security Concern: Insufficient Due Diligence
• Capable Resources/Controls/Policies – In 2012, the Amazon
Web Service (AWS) public cloud—which Netflix relies on to
stream content to customers – , experienced an outage in its
U.S.-East region (spanning multiple zones in AWS), due to the
accidental deletion of information that controls load balancing.
• Contract and Financial Viability – In 2013, Nirvanix, a cloud
storage specialist that hosted data for IBM, Dell and its own
customers, filed for Chapter 11 bankruptcy and shuttered its
operations. Customers were given less than two weeks to move
their data to another service, which highlighted the
• following issues:
• • Data loss: What would happen to Nirvanix customer data, if
they could not reclaim it within two weeks?
• • Operational disruptions: Film and TV production studio
Relativity Media was using Nirvanix’ cloud as a hub through
which employees in its global locations could collaborate and
share massive digital files to accelerate production.
• • Security breaches: A cash-strapped service provider may
scrimp on security technology and personnel, and a frenetic
wind-down may mean that normal security procedures fall
through the cracks.
• • Non-Compliance: Healthcare and financial services must
retain data to meet government compliance regulations. If the data is
lost, these services become non-compliant.
• M&A – In 2011, Facebook settled FTC charges that it deceived
consumers by failing to keep its privacy promises.
• Under the terms of the FTC’s order, Facebook
must get consumer’s’ affirmative consent before
making changes that override their privacy
settings, among other requirements.
• Jason Weinstein, former deputy assistant
attorney general, U.S. Department of Justice,
summarized the issue of cybersecurity due
diligence succinctly when he said: “When you
buy a company, you’re buying their data, and you
could be buying their data-security problems.” In
other words, “cyber risk should be considered
right along with financial and legal due diligence
considerations.”

Security Concern: Insufficient Due Diligence
• AIS-01: Application & Interface Security – Application Security
• AIS-04: Application & Interface Security – Data Security /
Integrity
• AAC-01: Audit Assurance & Compliance – Audit Planning
• AAC-02: Audit Assurance & Compliance – Independent Audits
• AAC-03: Audit Assurance & Compliance – Info. System
Regulatory Mapping
Resilience – Business Continuity Planning
Resilience – Business Continuity Testing
Resilience – Datacenter Utilities / Environ. Conditions
Resilience – Documentation
Resilience – Environmental Risks
Resilience – Equipment Location
Resilience – Equipment Maintenance
Resilience – Equipment Power Failures
• BSR-09: Business Continuity Management & Operational
Resilience – Impact Analysis
Resilience – Policy
Resilience – Retention Policy
• GRM-01: Governance & Risk Management – Baseline
Requirements
• GRM-02: Governance & Risk Management – Data Focus
Risk Assessments
• GRM-03: Governance & Risk Management –
Management Oversight
Management Program
Management Support/Involvement
• GRM-06: Governance & Risk Management – Policy
Enforcement
Impact on Risk Assessments
Reviews
• GRM-10: Governance & Risk Management – Risk
Management Assessments
• GRM-11: Governance & Risk Management – Risk
Management Framework
• IVS-06: Infrastructure & Virtualization Security – Network
Security
Segmentation

10. Security Concern: Abuse and Nefarious Use of
Cloud Services
Description
• Poorly secured cloud service deployments,
free cloud service trials and fraudulent
account sign-ups via payment instrument
fraud expose cloud computing models such
as IaaS, PaaS, and SaaS to malicious
attacks.
• Malicious actors may leverage cloud
computing resources to target users,
organizations or other cloud providers.
Examples of misuse of cloud service-based
resources include launching DDoS attacks,
email spam and phishing campaigns;
“mining” for digital currency; large-scale
automated click fraud; brute-force compute
attacks of stolen credential databases; and
hosting of malicious or pirated content.
• Mitigations for misuse of cloud services
includes CSP detection of payment
instrument fraud and of misuse of cloud
offerings, including examples of inbound
and outbound network DoS attacks. A cloud
provider must have an incident response
framework to address misuse of resources,
as well as a means for customers to report
abuse originating from a cloud provider. A
cloud provider should include relevant
controls that allow a customer to monitor
the health of their cloud workload.
• Malicious use of cloud service resources
can reduce available capacity for legitimate
customers hosted by cloud service
providers. Responding to malicious use
can also reduce the availability of response
resources for addressing other customer
support issues.
• Fraudulent payment instrument use can
result in passing increased costs along to
innocent parties such as financial
institutions or cloud providers and
ultimately to customers and others.
• DDoS attacks originating from or directed
at a cloud provider can lead to lack of
availability, business disruption and loss of
revenue for other sites that are hosted on
the same cloud platform.
• Even though the organization itself may not
be performing any of these actions,
because of the shared nature of some
cloud services, this type of threat presents
data and service availability concerns to an
organization.
Business Impacts

Security Concern: Abuse and Nefarious Use of
Cloud Services
• The DDoS That Almost Broke the Internet
– “The attackers were able to generate more
than 300 Gbps of traffic likely with a network
of their own that only had access to 1/100th
of that amount of traffic themselves.”
• Hackers Sneak Back Into AWS for DDoS
Launch Hub – “Amazon’s Elastic Cloud
Computing division was suffering from a
highly sophisticated attack by a group of
unknown hackers, who had found a way to
reverse engineer proof-of-concept code and
create an easily-accessible backdoor for
themselves into Amazon’s massive bank of
available processing power.”
• HRS-01: Human Resources - Asset Returns
• HRS-02: Human Resources - Background Screening
• HRS-03: Human Resources - Employment Agreements
• HRS-04: Human Resources - Employment Termination
• HRS-07: Human Resources - Roles / Responsibilities
• HRS-08: Human Resources - Technology Acceptable Use
• HRS-10: Human Resources - User Responsibility
• SEF-01: Security Incident Management, E-Discovery & Cloud
Forensics - Contact / Authority Maintenance
Forensics - Incident Management
Forensics - Incident Reporting
Forensics - Legal Preparation

11. Security Concern: Denial of Service
Description
• Denial-of-service (DoS) attacks are attacks
meant to prevent users of a service from
being able to access their data or their
applications. As is the case in distributed
denial-of-service (DDoS) attacks—causes
an intolerable system slowdown and leaves
all legitimate service users confused and
angry as to why the service is not
responding.
• While DDoS attacks tend to generate fear
and media attention—especially when the
perpetrators are acting out of a sense of
political “hacktivism”—they are by no
means the only form of DoS attack.
• Asymmetric application-level DoS attacks
take advantage of vulnerabilities in web
servers, databases or other cloud
resources, allowing a malicious individual to
take out an application with a single
extremely small attack payload—in some
cases less than 100 bytes long. Other
attacks may target equally confined
resources: an economic DoS jeopardizes a
company’s cash flow, using cloud’s dynamic
nature to overwhelm a startup’s ability to
pay. Likewise, the human capital of an
organization may be tied up quickly in legal
work for a bureaucratic DoS and leave a
company equally unable to provide a
service.
• Experiencing a denial-of-service attack is
like being caught in rush-hour traffic
gridlock: there is no way to get to your
destination, and there is nothing you can
do about it except sit and wait.
• As a consumer, service outages not only
frustrate you, but also force you to consider
whether moving your critical data to the
cloud to reduce infrastructure costs was
really worthwhile.
• In some cases, DDoS attacks have served
as a smokescreen for attacks taking place
elsewhere in the environment while
defenders are occupied with the DDoS.
From a risk standpoint, DoS attacks may
be more likely in the cloud because other
tenants are coming under fire. Cloud
providers, however, may be better
equipped to mitigate DoS attacks in
general.
• DDoS attacks must first be visible, so
detection is needed. Noticing the website is
slow is not an adequate form of detection
for an enterprise. Once detected, the key
to mitigating a DDoS attack is being
prepared for one before it occurs; system
administrators must be able to immediately
access resources that can be used as
mitigation
Business Impacts

Security Concern: Denial of Service
• As Cloud Use Grows, So Will Rate of DDoS
Attacks – “Cloud providers face increasing
number of DDoS attacks, [similar to those that]
private data centers already deal with today”
• Feedly Knocked Offline by DDoS Attack
Following Evernote and Deezer Attacks – “In
what looks like a series of co-ordinated cyber-
attacks by a criminal gang, three major cloud-
based services have all been knocked offline in
recent days. News aggregator Feedly, note-
taking app Evernote and music streaming service
Deezer have all come under attack from
criminals in the last few days leading to all three
suffering service outages.
• AIS-01: Application & Interface Security - Application
Security
• BCR-08: Business Continuity Management &
Operational Resilience - Equipment Power Failures
• GRM-01: Governance and Risk Management -
Baseline Requirements
• IVS-04: Infrastructure Virtualization Security -
Information System Documentation

12. Security Concern: Shared Technology Vulnerabilities
Description
• Cloud service providers deliver their services
scalably by sharing infrastructure, platforms or
applications. Cloud technology divides the “as a
Service” offering without substantially changing the
off-the-shelf hardware/software—sometimes at the
expense of security.
• Underlying components (e.g., CPU caches, GPUs,
etc.) that comprise the infrastructure supporting
cloud services deployment may not have been
designed to offer strong isolation properties for a
multitenant architecture (IaaS), re-deployable
platforms (PaaS) or multi-customer applications
(SaaS). This can lead to shared technology
vulnerabilities that can potentially be exploited in all
delivery models. A defense in-depth strategy is
recommended and should include compute, storage,
network, application and user security enforcement
and monitoring, whether the service model is IaaS,
PaaS, or SaaS. The key is that a single vulnerability
or misconfiguration can lead to a compromise across
an entire provider’s cloud.
• Mitigations to prevent a breach in shared resources
should be implemented, such as multi-factor
authentication on all hosts, Host-based Intrusion
Detection System (HIDS) and Network-based
Intrusion Detection Systems (NIDS on internal
networks, applying concepts of networking least
privilege and segmentation, and keeping shared
resources patched.
• A compromise of an integral piece
of shared technology such as the
hypervisor, a shared platform
component, or an application in a
SaaS environment exposes more
than just the compromised
customer; rather, it exposes the
entire environment to a potential of
compromise and breach. This
vulnerability is dangerous because
it potentially can affect an entire
cloud at once.
Business Impacts

Security Concern: Shared Technology Vulnerabilities
• Cross-VM Side Channels and Their Use to
Extract Private Keys – “…construction of an
access-driven side-channel attack by which a
malicious virtual machine (VM) extracts fine-
grained information from a victim VM running on
the same physical computer.”
• Understanding the VENOM Vulnerability –
“The unchecked buffer vulnerability (CVE-2015-
3456) occurs in the code for QEMU’s virtual
floppy disk controller. A successful buffer
overflow attack exploiting this vulnerability can
enable an attacker to execute his or her code in
the hypervisor’s security context and escape
from the guest operating system to gain control
over the entire host.”
Management ‒ Handling/Labeling/Security Policy
• EKM-03: Encryption & Key Management - Sensitive
Data Protection
• GRM-01: Governance and Risk Management -
Baseline Requirements
• IAM-02: Identity & Access Management - Credential
• IAM-05: Identity & Access Management - Segregation
of Duties
• IAM-12: Identity & Access Management - User ID
Credentials
• IVS-01: Infrastructure & Virtualization Security - Audit
• IVS-09: Infrastructure & Virtualization Security -
Segmentation
• TVM-02: Threat and Vulnerability Management -
Vulnerability/Patch Management

RESEARCH

Research Portfolio
• CSA has over 30+ Working
Groups Worldwide
• Hundreds of volunteer subject
matter experts contribute to
our research
• Groups Meet to identify
objectives and structure
research, spend months
performing analysis and peer
review to deliver the best in
cloud security best practices,
frameworks and research
• Volunteers are the backbone
that produces research
artifacts, which are updated
as the cloud landscape
changes
• Download Research:
www.cloudsecurityalliance.org/researc
h
• Contact:
research@cloudsecurityalliance.org

Q1 2016 RESEARCH RELEASES AT A GLANCE
© 2016, Cloud Security Alliance.
Cloud Trust Protocol Working Group
Cloud Trust Protocol Prototype Source Code
Cloud and Banking Whitepaper
Virtualization Working Group
Security Position Paper – Network Function Virtualization
Cloud Controls Matrix Working Group
CCM ISO 27017 Candidate Mapping
CCM ISO 27018 Candidate Mapping
CCM ISO 27002:2013 Candidate Mapping
CCM Minor Update Release (Updated 2/24/2016)
Consensus Assessments Initiative Questionnaire
CAIQ Minor Update Release (2/24/2016)
Collaboration Research
Survey Report - The Cloud Balancing Act for IT: Between
Promise and Peril
State of Cloud Security 2016
Security as a Service Working Group
SecaaS Working Group Charter
Defining Categories of Security as a Service: Continuous
Monitoring
Top Threats Working Group
“The Treacherous Twelve” Cloud Computing Top Threats in
2016

Announcements &
Opportunities
Research Fellowship Program
• Announced at CSA Summit at RSA
Conference US 2016
• CSA Fellow is an appointed title at the
Cloud Security Alliance
• Reserved for CSA Research Volunteers
that have made significant contribution
• For more info and to submit your
application visit:
• https://cloudsecurityalliance.org/research/fellow
ship

Announcements &
Opportunities
CSA Guidance v4.0 Activity is just about to get
started
• The new CSA Security Guidance for Critical
Areas of Cloud Computing v4.0 will serve as the
gateway to emerging standards being
developed in the world’s standards
organizations and is designed to serve as an
executive-level primer to any organization
seeking a secure, stable transition to hosting
their business operations in the cloud.
• Download v3.0 today:
https://cloudsecurityalliance.org/research/securit
y-guidance/#_downloads
• Contribute to v4.0:
https://github.com/cloudsecurityalliance/CSA-
Guidance/

Announcements &
Opportunities
CSA Surveys: Understanding Usage and
Adoption of Cloud Services
• Identity Security: Assessing the
awareness, priority and level of
maturity/readiness of the market with
respect to securing against the leading
cause of breaches – compromised
identities. This particular survey will look at
adoption of the cloud applications and the
associated access management and MFA
use for end and privileged users/accounts.
• The Survey takes a few minutes and you
can win some pretty cool prizes
• https://cloudsecurityalliance.org/surveys/

Announcements &
Opportunities
Attend our CloudBytes Webinar Series and
Learn from the experts
• CloudBytes are educational webinars
presented and conducted by fellow CSA
members and appointed industry SMEs.
The CloudBytes program brings the most
important topics to the forefront for
education and discussion. These topics
include Safe Harbor, containerization,
STAR Certification, CASBs, etc.
• https://cloudsecurityalliance.org/research/cl
oudbytes/

ROLE IN
INTERNATIONAL
STANDARDS

International Standardization
Council (ISC)
• Primary CSA Interface with
Standards Development
Organizations (SDO)
• Coordinate Standardization
efforts within CSA
• Voting Membership
• CSA corporate member
representatives
• Any affiliated CSA members who
are involved with SDOs
• Any at-large CSA members
proposed by Council voting
membership
• Advisory Membership Under
Consideration

CSA/SDO Relationship
Landscape

LEARN, KNOW &
CONNECT

•Download Research Lifecycle
• https://cloudsecurityalliance.org/download/research-
lifecycle/
•Download CSA Research Artifacts
• https://cloudsecurityalliance.org/download/
•Work Group Details
• https://cloudsecurityalliance.org/research/
•Contact Global Research
• research@cloudsecurityalliance.org
LEARN,
KNOW &
CONNECT
best practices for providing
security assurance within
Cloud Computing, and
provide education on the
uses of Cloud Computing
to help secure all other

•CSA Events
• https://cloudsecurityalliance.org/events/
•CSA Standards
• https://cloudsecurityalliance.org/isc/
•CSA Chapters
• https://cloudsecurityalliance.org/chapters/
•CSA LinkedIn
• https://www.linkedin.com/groups?home=&gid=18642
10&trk=anet_ug_hm
LEARN,
KNOW &
CONNECT

•Membership Information
• https://cloudsecurityalliance.org/membership/
•CSA STAR Registry Entries
• https://cloudsecurityalliance.org/star/?r=4583#_regist
ry
•CSA STAR Program Information
• https://cloudsecurityalliance.org/star/
•CSA CloudBytes via BrightTALK
• https://www.brighttalk.com/channel/10415
LEARN,
KNOW &
CONNECT

Vote
CSA Atlanta Chapter
Board Leaders

Jay Guidry
Scott C. Clark
Ed Pascua
Dan Schroeder
Elliott Abraham
Candidates

Phil Agcaoili
Distinguished Fellow and Fellows Chairman, Ponemon Institute
Board of Advisors, PCI Security Standards Council (SSC)
Financial Services – Information Sharing & Analysis Center (FS-ISAC)
Payments Processing Information Sharing Council (PPISC)
Contributor, NIST Cybersecurity Framework
Co-Founder & Board Member, Southern CISO Security Council
Founding Member, Cloud Security Alliance (CSA)
Inventor & Co-Author
CSA Cloud Controls Matrix (ISO 27017/27018)
Security, Trust and Assurance Registry (STAR), and
CSA Open Certification Framework (OCF) – AICPA SOC 2
@hacksec
https://www.linkedin.com/in/philA
Thanks for coming.

CSA Atlanta Q1'2016 Chapter Meeting

More Related Content

What's hot (15)

Similar to CSA Atlanta Q1'2016 Chapter Meeting (20)

More from Phil Agcaoili (20)

Recently uploaded (20)

CSA Atlanta Q1'2016 Chapter Meeting