Day: May 17, 2016

Today, consumers have an increasing interest in implementing cloud solutions to process and store their data. They are looking to take advantage of the benefits provided by cloud computing, including flexibility, cost savings, and availability. Fortunately, there are many cloud solutions available to consumers, touting cloud computing features such as multi-tenancy, virtualization, or increased collaboration. But is it really a cloud service?

With the rapid growth of these types of solutions, consumers and other interested organizations want to identify whether a service is actually a cloud service.

In actuality, there is such thing as a cloud service. It has a definition and we have seen federal agencies require cloud service providers to justify why their service is considered a cloud service.

The five essential cloud characteristics are based on the National Institute of Standards and Technology’s (NIST) definition of cloud computing in Special Publication (SP) 800-145. Here,NIST defines cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

According to NIST SP 800-145, a cloud service employs all of the following five characteristics:

1. On-demand self-service – A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.
2. Broad network access – Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).
3. Resource pooling – The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth.
4. Rapid elasticity – Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.
5. Measured service – Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

Whether you are a cloud service provider, consumer, or other interested party, it is important to identify how the cloud service offering meets each of the five essential characteristics. For example, cloud service providers in the FedRAMP authorization process usually document how their service meets each of the five essential cloud computing characteristics in their System Security Plan (SSP).

It goes without saying that regardless of whether or not a service meets the definition of a cloud service, the cloud service provider and consumer must always plan and prepare for the security risks associated with providing or using a the cloud service and the types of data the cloud service will consume. The cloud service provider is responsible for selecting a security program framework to implement security controls specific for cloud environments and the data protection requirements of their customers. Equally, the consumer must be fully aware of the data they plan to process and/or store with the cloud service and their responsibilities to protect that data.

Christina McGhee, Manager/FedRAMP Technical Lead, Schellman

[Cloud Security Alliance Blog]

SINGAPORE – May 11, 2016 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, announced today that it hosted its 5th annual CSA APAC Summit in Singapore, beginning May 3rd. The weeklong event was attended by thought leaders, policy and decision makers representing key industry organizations, cloud customers, and the R&D community. Attendees represented both end-user and industry viewpoints and provided networking and business opportunities. The event was a curtain raiser for IDA’s CloudAsia 2016, which occurred May 3-5 also in Singapore.

The keynote presentations this year featured:

• Khoong Hock Yun, Assistant Chief Executive Officer (Development) and Chief Data Officer of Infocomm Development Authority of Singapore (IDA)
• Daniele Cattedde, Chief Technology Officer of Cloud Security Alliance
• David Shearer, CEO of (ISC)2
• Dr. Meng-Chow Kang, Chief Information Security Officer, APJC Region of Cisco Systems, Inc.
• Evan Dumas, Head, Emerging Technologies APAC, Middle East, & Africa of Check Point
• Martin Leo, Executive Director, Morgan Stanley Investment Management
• Todd Partridge, Director of Product Marketing of Intralinks Holdings, Inc
• Wally Lee, Cybersecurity Architect, Cybersecurity Global Practice of Microsoft

A complete agenda for CSA’s APAC Summit can be found here.

This year’s event also included a number of key panel presentations focused on emerging trends and issues in cloud computing:

• “Overcoming the Top Threats to Cloud Computing” by Eric T. Ashdown of Cyber Security Managing Partner of Ridge Partners LLC, Kawin Boonyapredee of Qualys, Mandar Bale of FireEye & Benildus Nadar of Deep Identity chaired by Luciano “J.R.” Santos, Executive Vice President of Research of Cloud Security Alliance
• “Cloud and the Enterprise 2016” chaired by Jimmy Sng, Partner, of PricewaterhouseCoopers with panelists across Information Security Manager of Waikato District Health Board, Audit Director for Technology of Australia and New Zealand Banking Group, Technical Advisor of Asia Pacific of (ISC)2 & Security Consultant at Hewlett-Packard Enterprise

The theme of this year’s summit centered on how the future of information security lies in the cloud. An earlier CSA survey conducted identified mobile security as an area of concern. CSA’s Mobile Application Security Testing (MAST) working group, which strives to create a more secured cloud ecosystem to protect mobile applications, will be releasing the Mobile Application Security Testing (MAST) whitepaper after going through 4 months of public review process. Co-chair Keng Lee discussed this whitepaper during the summit. The whitepaper will also be used in the development of a new certification scheme, CSA STAR Mobile that will test and certify mobile applications. There may be additional scope of work that will address application store security issues among others.

CSA also hosted its 4th annual APAC Chapter Leadership Workshop on May 4, an annual event that provides a platform to report Chapter activities and progress and work plan for the year. 25 Chapters out of 31 across Asia Pacific participated in this workshop to discuss the Chapter strategies moving forward for this year.

On May 5, CSA hosted its 1st in-person CSA STAR Certification Summit. This Summit brought Certification Bodies and representatives from Governments from Asia Pacific, Europe and Americas together to discuss the future of cloud computing certification and assurance, while also addressing current challenges on cloud computing security and privacy assurance and compliance. This invitation only event focused on building strategies on CSA National Certification approach and roadmap.

The CSA CXO luncheon also occurred on May 5. Senior government officials and corporate decision makers participated in the quarterly lunch, which is theme based and facilitated by a research analyst. The takeaways received from the luncheon create continuous touch points until the next luncheon.

For more information on the CSA APAC Summit and other line of events, please contact csa-apac-info@cloudsecurityalliance.org.

About Cloud Security Alliance

The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, certification, events and products. CSA’s activities, knowledge and extensive network benefit the entire community impacted by cloud — from providers and customers, to governments, entrepreneurs and the assurance industry — and provide a forum through which diverse parties can work together to create and maintain a trusted cloud ecosystem.

Contact

Kari Walker for the CSA
ZAG Communications
703.928.9996
kari@zagcommunications.com

[Cloud Security Alliance Research News]

The ISO 31000:2009, Basel III recommendations, the EU Capital Requirement Directives and the Own Risk and Solvency Assessment (ORSA)/Forward Looking Assessment of Own Risk (FLAOR) processes of Solvency II Directives profoundly affect the financing and the insurance of companies in all business sectors and local authorities.

US companies use US National Association of Insurance Commissioners (NAIC) recommendations based on the fundamental principles of ORSA; EU firms refer to FLAOR recommendations; and companies in other countries (e.g., Canada, Japan, China) refer to Solvency II as an international best practice.

This regulatory change began in June 2008 when the American International Group (AIG) faced a financial disaster. The risk maps and risk registers in place, usually under Basel II, were designed to capture incident data to calculate the relative value at risk (VaR) using a stochastic approach (statistics and probability). In this approach, VaR equals unexpected loss. Following the subprime mortgage crisis in 2008, clause 5 of ISO 31000:2009 recommended risk treatment from the point of view of the corporate manager and not from the point of view of the stochastic engineer. It is the cost accounting process of the absolute VaR (VaR = expected loss + unexpected loss) taking into account the risk appetite tolerance threshold.

In March 2012, as part of the NAIC Solvency Modernization Initiative (SMI), the NAIC voted to adopt a significant new addition to US insurance regulation:  ORSA. The manner of the calculations used in an ORSA report was left to the discretion of each insurer. This led to variations in the measurement techniques of ORSA among companies. The insurers were concerned because a hard and fast, one-size-fits-all solution does not exist. The output was specific to the company, and a set of documents should demonstrate the results of the self-assessment and understanding of own-risks.

The Information Technology-Investor Relationship Management (IT-IRM) proposes a standardized, logical process to the ORSA measurement. Our recent Journal article covers how this IT application makes ORSA a logical assessment based on real-time data, making risk controllable and assessable using the same base criteria for economic capital and the same indicators, factors or the causes as the determinants of operational risk.

Read Simon Grima, Robert W. Klein, Ronald Zhao, Frank Bezzina and Pascal Lélé’s recent Journal article:
“Strengthening Value and Risk Culture Using a Real-time Logical Tool,” ISACA Journal, volume 3, 2016.

[ISACA Journal Author Blog]