Security + Cloud: What studios and vendors need to consider when adopting cloud solutions.

1. ISE Proprietary
S ECU RITY + CLO U D
Ted Harrington, Executive Partner | ted.harrington@securityevaluators.com

2. ISE Proprietary
why is this important?

3. ISE Proprietary

4. ISE Confidential - not for distribution
THREATMODELING

5. ISE Proprietary

6. ISE Proprietary
“If you don’t know where you’re going,
any road will take you there”

7. ISE Proprietary

8. EXTERNAL ADVERSARIES
ISE Proprietary

9. ISE Proprietary

10. ISE Proprietary
CASUAL HACKER

11. ISE Proprietary
HACKTIVIST

12. ISE Proprietary
CORPORATE ESPIONAGE

13. ISE Proprietary
ORGANIZED CRIME

14. ISE Proprietary
NATION STATE

15. ISE Proprietary
INTERNAL ADVERSARIES

16. InternalAdversaries
ISE Confidential - not for distribution

17. InternalAdversaries
ISE Confidential - not for distribution
ACCIDENTAL

18. InternalAdversaries
ISE Confidential - not for distribution
OPPORTUNISTIC

19. InternalAdversaries
ISE Confidential - not for distribution
DETERMINED

20. ISE Confidential - not for distribution
SECURITY+ CLOUD

21. Security+ Cloud
ISE Confidential - not for distribution

22. Security+ Cloud
ISE Confidential - not for distribution
Platform must be hardened

23. Security+ Cloud
ISE Confidential - not for distribution
Configuration is CRITICAL!

24. Security+ Cloud
ISE Confidential - not for distribution
“But I don’t own the equipment!”

25. Security+ Cloud
ISE Confidential - not for distribution
“But I don’t own the equipment!”
Bad if: cloudplatform<on-prem
Good if: cloudplatform>on-prem

26. CautionaryTale
ISE Confidential - not for distribution

27. ISE Confidential - not for distribution
!

28. ISE Confidential - not for distribution
SECURE DESIGN PRINCIPLES

29. LeastPrivilege
ISE Confidential - not for distribution

30. PrivilegeSeparation
ISE Confidential - not for distribution

31. Defensein Depth
ISE Confidential - not for distribution

32. Trust Reluctance
ISE Confidential - not for distribution

33. Open Design
ISE Confidential - not for distribution

34. Economy ofMechanism
ISE Confidential - not for distribution

35. CompleteMediation
ISE Confidential - not for distribution

36. PsychologicalAcceptability
ISE Confidential - not for distribution

37. Fail Secure
ISE Confidential - not for distribution

38. Securethe WeakestLink
ISE Confidential - not for distribution

39. ReduceAsset Handling
ISE Confidential - not for distribution

40. Build SecurityIn
ISE Confidential - not for distribution

41. Ongoing Reassessment
ISE Confidential - not for distribution

42. ISE Confidential - not for distribution
ANTI-PRINCIPLES

43. Compliance
ISE Confidential - not for distribution

44. Complexity
ISE Confidential - not for distribution

45. Obscurity
ISE Confidential - not for distribution

46. SecurityThrough Legality
ISE Confidential - not for distribution

47. Deferralof Risk
ISE Confidential - not for distribution

48. ISE Confidential - not for distribution
SECURITY ASSESSMENT:
The Wrong Way

49. SecurityAssessmentFail
ISE Confidential - not for distribution

50. ISE Confidential - not for distribution
SECURITY ASSESSEMENT:
The Right Way

51. SecurityAssessmentWin
ISE Confidential - not for distribution

52. ISE Confidential - not for distribution
KEYTAKEAWAYS

53. Key Takeaways
• Configurationis critical!
• Cloud could be more secure, could be less secure
• Assessment methodology matters
ISE Confidential - not for distribution

54. How Can ISE Help?
• Security assessment
– Application
– Infrastructure
– Supply Chain
– Vendor
• Designguidance
• Training
• Embed
ISE Confidential - not for distribution

55. ISE Confidential - not for distribution
Questions?
Ted.Harrnington@securityevaluators.com