Security Management in Cloud Computing by Shivani Gogia - Aravali College of Engineering & Managment
- 1. Department of Computer Science & Engineering 1 Security Management in Cloud Computing
- 2. Security Management 2 • With the adoption of public cloud services, a large part of your network, system, applications, and data will move under third-party provider control. For this : • What security controls must the customer provide over and above the controls inherent in the cloud platform, and • How must an enterprise’s security management tools and processes adapt to manage security in the cloud.
- 3. Security Management… Security Management and monitoring services:- • Monitoring- health, security event, threat. • Management- ACL, Vulnerability, Patch, Configuration. Information Security- data:- • Encryption • Data masking • Content protection. Information Security- infrastructure:- • Application Level • Network Level • Host Level. 3
- 4. Security Management Standards 4 • ISO/IEC 27001 formally defines the mandatory requirements for an Information Security Management System (ISMS). • ISO/IEC 27002 is merely a code of practice/guideline rather than a certification standard, organizations are free to select and implement controls as they see fit. It answers two questions • How does one ensure that the current security levels are appropriate for ones needs? • How does one apply a security baseline throughout his operation? ISO/IEC 27001/27002
- 5. Security Management in the Cloud 5
- 6. What is Privacy? 6 6/34 • The concept of privacy varies widely among (and sometimes within) countries, cultures, and jurisdictions. • It is shaped by public expectations and legal interpretations; as such, a concise definition is elusive if not impossible. • Privacy rights or obligations are related to the collection, use, disclosure, storage, and destruction of personal data (or Personally Identifiable Information—PII). • Any information relating to an identified or identifiable individual (data subject).At the end of the day, privacy is about the accountability of organizations to data subjects, as well as the transparency to an organization’s practice around personal information. • The rights and obligations of individuals and organizations with respect to the collection, use, retention, and disclosure of personal information.
- 8. What Are the Key Privacy Concerns? 8 Auditing, monitoring and risk management Privacy Breaches Retention Destruction Some considerations to be aware of:- Access Compliance Storage
- 9. What is data retention policy? It is asset of guidelines that help organizations to keep track of how long information must be kept and how to dispose of that information when its no longer needed. • How long is personal information (that is transferred to the cloud) retained? • How long can we keep personal data for archiving, research or statistical purpose? • Why is retention important? • Which retention policy governs the data? • Does the organization own the data, or the CSP?
- 10. Who is responsible for protecting privacy? • Data breaches have a cascading effect • Full reliance on a third party to protect personal data? • In-depth understanding of responsible data stewardship • Organizations can transfer liability, but not accountability • Risk assessment and mitigation throughout the data life cycle is critical. • Many new risks and unknowns • The overall complexity of privacy protection in the cloud represents a bigger challenge.
- 11. What is the data life cycle? • Personal information should be managed as part of the data used by the organization • Protection of personal information should consider the impact of the cloud on each phase
- 12. Generation of the information Data is typically created by an organization in one of the three ways-
- 13. Use 13 During this phase, Data is used to support activities in the organization. • Internal versus external: Is PII used only within the collecting organization, or is it used outside the organization (e.g., in a public cloud)? • Third party: Is the information shared with third parties (e.g., subcontractors or CSPs)? • Appropriateness: Is the use of the information consistent with the purpose for which it was collected? • Discovery/subpoena: Is the information managed in the cloud in a way that will enable the organization to comply with legal requirements in case of legal proceedings? Data usage can even be a product service that your enterprise offers. This is where governance & compliance challenges arise.
- 14. 14 • Public versus private networks: When information is transferred to a cloud is the organization using public networks, and is it protected appropriately? (PII should always be protected to address the risk level and legal requirements.) • Encryption requirements: Some laws require that PII will be encrypted when transmitted via a public network (and this will be the case when the organization is using a public cloud). • Access control: Are there appropriate access controls over PII when it is in the cloud?
- 15. Transformation Derivation: Are the original protection and use limitations maintained when data is transformed or further processed in the cloud? Aggregation: Is data in the cloud aggregated so that it is no longer related to an identifiable individual (and hence is no longer considered PII)? Integrity: Is the integrity of PII maintained when it is in the cloud?
- 16. Storage Access control: Are there appropriate controls over access to PII when stored in the cloud so that only individuals with a need to know will be able to access it? • Structured versus unstructured: How is the data stored to enable the organization to access and manage the data in the future? • Integrity/availability/confidentiality: How are data integrity, availability, and confidentiality maintained in the cloud? • Encryption: Several laws and regulations require that certain types of PII should be stored only when encrypted. Is this requirement supported by the CSP?
- 17. Archival Legal and compliance: PII may have specific requirements that dictate how long it should be stored and archived. Are these requirements supported by the CSP? Off-site considerations: Does the CSP provide the ability for long-term off-site storage that supports archival requirements? Media concerns: Is the information stored on media that will be accessible in the future? Is the information stored on portable media that may be more susceptible to loss? Who controls the media and what is the organization’s ability to recover such media from the CSP if needed? Retention: For how long will the data be retained by the CSP? Is the retention period consistent with the organization’s retention period?
- 18. Destruction Secure: Does the CSP destroy PII obtained by customers in a secure manner to avoid potential breach of the information? Complete: Is the information completely destroyed? Does the destruction completely erase the data, or can it be recovered?
- 20. Changes to the Privacy Risk Management & Compliance in relation to Cloud Computing
- 21. Aravali College of Engineering And Management Jasana, Tigoan Road, Neharpar, Faridabad, Delhi NCR Toll Free Number : 91- 8527538785 Website : www.acem.edu.in 21