Cloud Integration Project Update

As I’ve blogged previously, we have a number of research projects currently underway under the auspices of the UK Chapter.    One of those projects relates to cloud integration.    The cloud integration project is being led by John Arnold and John has kindly produced the below text as an example of where that project is heading.

 Issues involved in cloud integration
  1.  Identity.  Users (both privileged and end users) need to access cloud services as easily as on-premises services.  Ideally, we need to achieve the following:
    • Single administration – users don’t need to be administered separately for each cloud service.  Privileges in cloud based services can be accessed by mapping to a common identity store.
    • Single credential – users don’t need to manage their credentials separately for each cloud service
    • Single session – users don’t need to log on separately for each cloud service.
  2. Security monitoring.  The enterprise SOC needs to receive feeds from cloud services just as it does from on-premises services.  The enterprise will need to be able to adjust and define the feeds it gets, where they are sent, and how any transfer is scheduled and protected.
  3. Infrastructure and application monitoring and control.  The enterprise needs to be able to manage its cloud-based applications and infrastructure in the same way as its on-premises resources.
  4. Provisioning.  Spinning up and down instances, allocating VM images, containers and filesystems, needs to work seamlessly across cloud-based and on-premises services.
  5. Inter-application communications.  On premises and cloud based services need to be able to communicate seamlessly and securely.
  6. Security policies.  Where security policies can be virtualised, for instance using the XACML standard, these should be uniform across cloud and on-premises services.
  7. If you have expertise in any of the above areas or have an opinion that you’d like to contribute to the project then please don’t hesitate to get in touch with me at lee.newcombe at my cloudsecurityalliance.org.uk email address and I’d be delighted to put you in touch with John and his workstream colleagues.     
Our aim for all of our research projects is to provide pragmatic, proven guidance tailored for UK cloud consumers: the more input we get from experienced cloud adopters, the more effective our guidance will be.  

Comments

Post a Comment

Popular posts from this blog

CSA UK Applying MITRE ATT&CK Cloud and Microsoft K8 Matrix

Image
The Cloud Security Alliance UK chapter is presenting a series of sessions to provide CISO's, Cloud Security Architects, DevSecOps and SOC teams a breadcrumb roadmap of how to apply the recently published (late 2019)  MITRE ATT&CK for the Cloud  and also take influence from Microsoft’s recent Threat matrix on Kubernetes (K8).   We are seeking feedback or additional items you would like us to cover.  The proposed series of sessions will cover:   Session 1: [ Author/Presenter: Stephen Owen] 90 mins planned online 24th June CSA session on "What is MITRE ATT&CK and Cloud" and what benefits it brings to each of the stakeholders  What is  MITRE ATT&CK Enterprise  and  Cloud Where to start How to take advantages of the current  MITRE ATT&CK Cloud  and combining with Microsoft’s K8 Matrix;  Suggested practices to follow targeted to each of the below roles: Cloud Security Architects DevSecOps SOC Team  Cloud/CISO Lea...
Read more

Understanding ISO 27001 certification

A guest blog by Steve Watkins, Director at IT Governance Ltd Even though ISO 27001 is the international standard for implementing an ISMS (information security management system) and is used by thousands of organisations around the globe, it occasionally faces criticism on a number of issues. Those with first-hand experience of ISO 27001 know that, when implemented correctly, it provides a comprehensive guide to managing the information security risks that organisations face. Further, the accredited certification scheme that enables organisations to demonstrate that they conform with the requirements in ISO 27001 offers real benefits to those who understand how to interpret claims of certification appropriately. So, what are the Standard’s critics potentially misunderstanding? This blog takes a look at some of the misconceptions, and explains why ISO 27001 is an appropriate framework for managing your information security. What are the criticisms of ISO 27001 certification? You don’t k...
Read more

What is hybrid cloud computing?

Image
    (Hybrid) cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardised or proprietary technology that enables data and application portability. National Institutes for Standards in Technology (NIST) While a Hybrid Cloud can take many forms; in essence it means managing two (or more) disparate cloud environments (say private & public) as one, or having management tools in place that let the two (or more) environments be managed and appear as one single environment. Hybrid cloud uses a mix of on-premises, private cloud together with third-party, public cloud services; with orchestration between multiple platforms thus allowing workloads to move between the various cloud environments as computing needs; thus giving businesses greater flexibility and more deployment options. A cloud is hybrid when; You extend an internal web server (that has “burst...
Read more