Cloud Security Alliance UK Chapter

Lewis Troke was elected into the position of Director of Research for the UK Chapter at our recent Annual General Meeting.   We are using this as a great opportunity to start afresh with our approach to research, now under the guidance of Lewis.   What security guidance are UK organisations adopting cloud computing looking for?   What can we, as your local chapter of the Cloud Security Alliance, do to meet those needs? Please take some time out of your busy day to complete the questionnaire over at SurveyMonkey and let us know your thoughts.  We're keen to provide the guidance that UK organisations need, so please don't be shy in letting us know where those needs lie.   We have our own views of course, but we would much rather have the members drive our priorities.   Many thanks in advance!

Here's the latest in our series of guest blog posts on the Chapter blog. This one comes from Leron Zinatullin (@le_rond) and describes the pros and cons of different governance approaches in relation to securing cloud implementations.  Don't forget, feel free to contact us if you feel that you have a burning issue that you'd like to get off your chest via a guest blog post. We can help. Governance Models - Cloud Your company has decided to adopt Cloud. Or maybe it was among the ones that relied on virtualised environments before it was even a thing? In either case, cloud security has to be managed. How do you go about that? Before checking out vendor marketing materials in search of the perfect technology solution, let’s step back and think of it from a governance perspective. In an enterprise like yours, there are a number of business functions and departments with various level of autonomy. Do you trust them to manage business process-specific risk or choose to relieve th...

Our Chapter Annual General Meeting (AGM) was held last week, kindly hosted by Trend Micro. With respect to Chapter business, the following outcomes were noted: Lee Newcombe - elected to Vice-Chair Lewis Troke - elected to Director of Research Paul Simmonds - elected as General Board Member. Each appointment lasts for two years. It was encouraging how many of the attendees expressed an interest in two of our other positions - Director of Events and Director of Communications - and so we hope to be able to fill those positions shortly.  The more observant amongst you will note that we currently have only a Vice-Chair as no-one was nominated for the role of Chair - Lee Newcombe (your author :)) will deputise whilst we await a candidate willing to put themselves up for election as Chair. It was a positive interactive session with some great content being presented by knowledgeable practitioners. Many thanks to Dave Walker of AWS for a fantastic technical session on using Lambda to auto...

One of the things we're keen to do here is to share lessons learned by those who are actively implementing cloud services.  As such, I'm pleased to offer the opportunity to contribute guest articles sharing cloud security war stories to this blog.   Our first guest author is Francesco Cippolone of NSC42 who has kindly taken the time to write up a number of thoughts relating to identity on the Office 365 platform.  His article can be found below - thanks Francesco! Let me start by saying that by no means am I a pure authentication expert nor a Microsoft expert. As many of you, I'm on the journey to the cloud and learning as I go. Please provide any feedback or any contribution to the article so as to make it as accurate as possible. Identity and Access management with O365/Azure A few weeks ago, I had a conversation with a colleague about identities in Office 365 and the discussion lead to the various nuances of where the identities are located. I have to admit, with...

Integration and portability – either working across multiple cloud providers or else shifting workloads from one provider to another – remain amongst the trickier areas of cloud strategy and security.  Different business strategies and priorities will drive different approaches.  For example, if you take the view that service resilience is your primary concern then the idea of placing all your eggs in one basket, even one as well made as AWS or Azure, may be anathema.  This can then drive architectures that must either split components across multiple cloud providers so as to reduce impact of compromise (including outages) or to use a secondary cloud provider to provide contingency in the event of a failure of your primary supplier.  If you’re going to support portability (the ability to shift workloads between cloud providers) then you need to avoid lock-in which can drive you towards containerisation such that you can take your encapsulated infrastructure from one ...