Audit And Security For Cloud-Based Services Agenda

Seminar: ID# 1005024

Agenda

• Application architectures
• The SPI Cloud Computing Model
• Key drivers for moving towards cloud-based services

• Key enterprise applications
• The SaaS transaction model(s)
• SaaS security and audit concerns

• Major development providers/platforms
• PaaS security and audit concerns

• Host security in the cloud
• Network security in the cloud
• Data storage/SAN in a cloud IaaS environment
• Cloud bursting
• Virtualization models for cloud-based services: Hypervisor VM and inter VM isolation
• Cloud-based security domains: virtualized security/firewalls
• LaaS security and audit concerns

• Private cloud architectures
• Hybrid architectures
• Public architectures
• De-perimiterization of networks: secure access from any device, anywhere

• Cloud aggregators
• Cloud brokers
• Cloud management service portals

• Identity management as a service
• Security event monitoring/IDS as a service
• Vulnerability management as a service
• Data leakage prevention as a service/web filtering, e-mail filtering

• Directories and identity management
• Federated identities
• Security standards: SPML, XACML, OAuth, OpenID, others

• Key performance indicators
• Audit trails for cloud-based services
• Service level agreements, licensing
• Legal complexities: data privacy, globalization, trans-border constraints
• Third-party assessments and certifications: SAS70, ISO 27001

• SPI HA architectures
• Virtualized environments and impact on disaster recovery
• Updating and testing disaster recovery plans

• Key risks and audit concerns
• Identifying key controls and mitigations
• Cloud-based risk analysis models: ENISA, NIST, CSA
• Security best-practices models for cloud-based services
• Audit techniques and tests in a cloud-based environment