Sign Florida Electrical Services Contract Secure

Document type sign electrical services contract florida secure

[Music] [Music] hello everyone so this is assistant professor from school of i.t i'm florida and now we are discussing about the security standards and applications in cloud computing so when we talk about security standards and cloud computing so the major issue in cloud computing is the security as it is not the on-premise system so we are not having that much of confidence on the uh cloud environment which is we have on on-premise systems so when we have on-premise system we have all over the control over our data environment the network the benefit everything we have in our control when we are to uh talk about cloud computing so cloud copic is all about you are using someone else services uh on the rental basis so when we talk about the rental basis so we don't have any control on it okay so let's start with the uh session okay so uh when we thought about the security we always uh knew that c i a are the major pillars c stands for confidentiality a stands for availability and i stands for integrity so when we talk about the confidentiality that means uh who is authorized to know uh this about the data then availability data never loss machine never fail okay so it is already always available whenever you want it then integrity data should not be tempered with data has not been temporary that means the integrity should remain same then uh we have uh what are the major concern in cloud security so uh basically security concerns arising uh because both uh customer data and program are residing at the provider's devices because we are using software as a service for platform as service and infrastructure as a service so everything on the provider provides so security is always a major concern in open system architecture so this is the customer data and this is the customer code and all are on the provider premises that is the third party management so uh why cloud computing bring uh new threats so basically uh because of loss of control loss the lack of trust uh multi-tenancy because i am using the same thing and some other person also using the same thing at the same time so there might be a conflict there might be a problem of a security these problems exist mainly in third party management models so uh self-managed cloud still have security issues but not related to the lack of control lack of trust and all so uh when we talk about the customers loss of control that means uh the data application resources everything is uh located on the provider's device user identity management is handled by the cloud user access control uh rules security policies and enforcement are management by a cloud provider because consumer relies on provider to ensure security privacy availability reliability monitoring repairing everything we are reliable on the provider so this is the major issue when we talk about multi-tenancy so multiple independent users share the same physical infrastructure so an attacker can legitimately uh but physically physical machine as the target okay so who is the attacker it can be an insider or can be outsider insider malicious employee at client malicious employee tech cloud provider cloud provider itself can be a problem or attacker for outsiders it can be intruder or network attackers uh for attackers capabilities uh say for example malicious insiders at client they can learn password authentication information gain control on on the vms v8 which are provided by the providers uh virtual machine instances and at the cloud provider log uh information they can uh take then uh at the cloud provider side uh they can encrypt our data uh read encrypted unencrypted data can possibly peek into our virtual machines or make copies of virtual machines can monitor network communication application partner patterns whatever we are using they can read it and understand it and they can harm us for our data then outside attackers can listen to network traffic insert many ship traffic into our system or they can probe into our cloud structure or they can launch the uh the os attack then challenges for the attackers how to find out where the target is located how to be co-located with the target in the same or physical machine how to gather information about the target so when we when someone asks you uh how we can control our data just don't share it on internet if it is on internet it can be accessed by anyone because it is in the open premises okay so uh we need to uh understand the stride pattern uh organizing the threads using strike first is spoofing identity second is tampering with data third is repudiation fourth is information disclosure then fifth is denial of service then elevation of privileges this stride is the threads these are the threads which are on our data when our data is on cloud or any uh where in the internet if we have this data in on premises we can lock it we can perform major security concern on it but then it is an uh shared environment or in the uh cloud environment in the shared web devices so it can be or it may be possible that we our data can be hacked or used by somebody what are the major concerns so uh as per our thinking or as per we understand two major concerns are there we have to understand about these two questions how much secure is the data and how much secure is the code because our data and code both are on the cloud provider's side so uh when we talk about cloud the thing is virtualization either full virtualization or para virtualization virtualization is providing the cloud services uh with the help of virtualization we are using the cloud services so what are the security issues from virtualization so instance uh isolation ensuring that different instances running on the same physical machine are isolated from each other control of administrator on host operating system and guest operating system current virtual machines do not offer perfect isolation many bugs have been found in all popular virtual machine monitors that allow to escape from virtual machine virtual machine uh virtual machine monitor should be root secure meaning that no level of privileges with in the virtualized guest environment permits interference with the host systems then how we can uh streamline security analysis process first is identify asset that means which asset are we trying to protect what properties of these assets must be maintained then identity threats what attack can be mounted what others attack what others threats are there natural disasters anything anything which is which is not in our control identify counter measures how can we counter those attacks if we are uh talking about the identity threats and if we are discussing about natural disasters so that's why we are using uh distributed environment that if somewhere or other there might be a natural disaster so somewhere else my data will be secure appropriate for organization independent analysis we have no organizational concept context or policies then identity assets and principles first is customer data then customer application then client computing devices so customer data should be cia proof then customer appliances cia proof and client computing devices also cia then identity threats failures in provider security attacks by other customers availability and reliability issue legal and regularity issues uh parameter security model broken uh integrating provider and customer security systems then what are the failures in provider security provider control server network database everything is in their control customer must trust providers security failures may violate cia principle counter measures verify and monitor provider security you have to first test that security outside verification may suffix or provider security may exceed customer security attacks by other customers may be threat uh so threads are provided resources shared with untrusted parties cpu storage network can be at risk customer data and application must be separated failures will be will violate cia principles counter measures hypervisors for compute separation mpls vpns vlans fireworks and networks operations cryptography should be strong application layer separation will be might be less strong then other legal regularity issues we have threats like laws and regulations may prevent cloud computing requirements to retain control certification requirements not met by provider uh geographical limitations new location may trigger new laws and regulations counter measures for these threads might be you can evaluate the legal issues require provider compliance with laws and regulations restrict geography as needed then the threads with the integrating providers and customer security disconnected providers and customer security system fired employees retain access to cloud there might be a possibility that you have fired those uh employees but their access on the cloud is still remain active so they might be a threat for you misbehavior in cloud not reported to customer what are the counter measures at least integrated integrate identity management consistent consistent access control better integrate monitoring and notifications so you can use saml ldap radio us xacml iaf m80 protocols first and foremost thing is we have to evaluate our assets how would we be uh harmed if any of my assets have in a problem they might be the asset became widely public and widely distributed an employer of our cloud provider accessed the asset the process of function were manipulated by an outsider the process of function failed to provide expected results the info or data was unexpectedly changed or altered the asset were unavailable for a period of time so these all are the problems they can harm us if this will happen so we have to make evaluate we have to make our assets to be evaluated every time then we have 13 domains that should be addressed uh in the service contract first is architectural framework then government or enterprise risk management legal or rediscovery compliance and edit information lifecycle management portability and interpol interoperability security business continuity disaster recovery data center operations incident response issues application security encryption and key management identity and access management and virtualization so first we'll discuss about the governance identity implement process controls to maintain effective governance risk management compliance provided provided security governance should be accessed for sufficiency maturity consistency with user i.t security process then in legal we have functional generational and contractuals is the things functional means which function and services in the uh cloud have legal implications for both the parties which government administer laws and impacting service stakeholders and data assets contractual what are the terms and conditions in your contract both parties must understand each other's role provider must have primary and secondary data where is the data stored laws for cross border law and data flow flows plan for unexpected contract termination and orderly return to secure disposal of assets you should ensure you retain ownership of your data in its original form then compliance and audit it's hard to maintain with your uh registration and security requirement harder to demonstrate to auditors write to audit clause analyze complies scope regularity impact on data security evidence requirements are met the provider have sas 70 type 2 iso 27001 slash 2 audit statements portability and interoperability when you have to switch cloud providers it should be easy because it's your choice contract price increase whenever it happen if there should be a system that they can't increase or decrease there should be a system provider bankruptcy if providers say i'm going to shut down my company and please look after your data it is not possible that should be in the contract provider service shutdown provider says that i am shutting down your services i am not having uh much space or whatever the reason is that should be in the uh contract so that the customer should not suffer this decrease in service quality because of any reason they decrease your service quality because of uh user increase increase or the data is on theft or anything business dispute these are the problem that should be in the contract that if these things have happen then the customer should not suffer and customer should get the benefit uh the services as per contract then security the centralization of data greater insider threat from within the provider require on-site inspection for of provider facilities like disaster recovery business continuity keep on checking keep on inspecting then instant response incident response if something happened uh in my identity management system or my uh application firewall or anywhere in my data integrity or security cloud apps are not always designed with the data integrity or security in mind provider keep app firewalls ids logs provider delivers laptops of your virtual environment sensitive data must be encrypted for data breach things then application security different trust boundaries for ias pas and sas because these are three different services provider web security services security specifically secure intel host communication channel then identity and access management there should be a provision and deprovision to provide and revoke your system process authenticate the authenticate system federation authorization user proofing auditing ad update revoke this this should be in the contract that but at any point of time i can remove anyone any point of time i can add anyone i can update anyone's soul now virtualization what type of functionalization is used by the provider it's para or full what third party security technology your virtual operating system which controls protect admin interfaces exposed to users so this is the virtual infrastructure you don't know anything and if it is shared with anyone how it is secure that should be in the contract then what are the possible solutions first is minimize the lack of trust that means there should be a certification uh with the customer uh with the service provider that certify that this uh provider providing the uh legal services and on-time services minimize loss of control monitoring utilizing different cloud access control management and identity management minimize the multi-tenancy you uh provide you can provide your data to anyone because it is a virtualized environment but please uh maintain a system that there should be a minimize level of multi-tenancy so what are the uh solutions like you can take back the controls like data apps may still need to be on the cloud but can they be managed in some way by the customer you can provide the system then lack of trust you can increase your trust that probably see regulations contracts uh or you can say you can certify your procedures uh policies regulations everything you can provide so that the trust can be increased on the provider then multi-tenancy you can uh take a take away is the reason to use the cloud in the first place that is the public a private club not the public then strong separation between all the tenants on your cloud that should be required you can engage in full risk management process for each case for small and medium organizations uh cloud security may be a big improvement cost saving may be large economical uh of scale for large organizations already have large secure uh data centers main sweep spots uh elasticity services internet facing uh services employee counter measures listed as we discussed then we have software and server securities identity management in the cloud is nature cross site uh request forgery cloud standards are weak then uh kraus site scripting because of laptop uh data validation insecure exposure to references like files directories and all incorrectly configured databases middleware and operating systems exposing sensitive data like user id password personal identification information checking for access inside the business logic on the server side using components and known vulnerabilities unvalidated redirects and powers secrecy uh not well informed access everywhere increase convenience but also risk then uh we have open cloud consortium occ uh the cc has a particular focus in large data clouds it has developed the milestone benchmark uh for large data clouds and it's working on a reference model for large data clubs occ supports the development of standards for cloud computing and frameworks for interoperating between clouds it develops benchmarks for cloud computing and supports reference implementations for cloud computing uh preferably open source references implementation then we have oss organization for advancement of structured information standards it drives the development convergence and adoption of open standards for the global information society the source of many of the foundational uh standards are used today oss sees uh cloud computing as a niche natural expansion extension of soa and network management models the os's technical agenda is set by members many of whom are deeply committed to building cloud models profiles and extension on existing standards including security access and identity policy standards for example oss sml xacml spml ws security policy ws trust ws federation k-map and orms content format control and data import export standards like oss odf dita cmis and sdd registry repository and directory standards for example oss av xml and uddi soa methods and models network management service quality and interoperability for example oss sca sdo soarm and bpel then we have dmtf distributed management task force um dtm dmtf standards enable effective management of it environments management standards bmw management standards are critical to enabling interoperability among multi-vendor systems tools multi-vendor its infrastructure and systems and network management including cloud virtualization desktop network servers storage and solution within the enterprises then we have uh the dmtf standards like cimi cim wbem smash dash redfish wswell vman of obf or netman these are the standards followed by dmtf to provide the security then there are some standards for application developers like the green grid brings together end user technology provider utility companies facility architects and policy makers to create a set of instructors that would allow for a more efficient utilization of resources cloud security alliance uh csa lays out the best practices for cloud computing security distributed management task force has suggested the use of the open virtualization format which provides a method for the security the institute of electrical and uh electronics engineering standards association works to develop nature nurture and advance worldwide technologies according to info word the ieee has set up two working groups for cloud computing standards and interoperability the p 2 3 0 1 and the p 2 3 0 2 2 3 0 1 is what group will be involved in standardizing cloud management and portability with the use of various inferences and file formats 2302 work group will focus on interoperability and federation the national institute of standard and technology is a non-regularity federal agency that pushes the for standards in science and technology the storage networking industry association has its cloud data then we we have the problems with the cloud computing standardization with the number of cloud service providers doing different tasks differently it is unlikely that they would just agree on one set of cloud computing standards this is especially true if they are working on a different set of principles than the proposed standards many organizations proposing different standards these standards that govern computer cloud computing are just coming into existence it is quite reasonable to think and predict that it will take years or decades even to get developed then we have some standards for messaging first is the simple session initiation protocol for instant messaging and presence leveraging extensive open source xml based xmpp extensible message and presence protocol both are currently being developed by the internet engineering task force ietf the standards for security it ensures effective governance risk and compliance processes exist auditing operational and business processes manage people and roles and identities ensure proper protection of data information enforce privacy policies access the security provisions for cloud applications ensure cloud network and connections are secure evaluate security controls on physical infrastructure and facilities manage security terms in the cloud slas understand the security requirements of the exit process then we have cloud security standards these are the standards that should be followed by the cloud service providers iso three eight five zero zero i t governance corbett itil iso twenty thousand s ssae16 fisma us federal law ldap saml 2.0 open authentication 2.0 ws federation open id connect and xaml cs so when we talk about all these things these all are the standards provided by the several organizations several task force which are continuously working for the betterment of the cloud security and services so thank you so much this is all about the uh cloud service provider standards and the providers the concerns applications security standards in the cloud computing thank you so much and this is privilege and if you like the video please share it with your friends and keep learning stay safe thank you