Truly Secure: The Steps a Security Practitioner Took to Build a Secure Public Cloud

•

0 gostou•383 visualizações

My CSA 2011 talk - gives an overview of what one needs to do to review the security if a commercial or open-source cloud stack and feel confident in providing secure cloud services.

Tecnologia

Truly Secure: The Steps a Security Practitioner Took to Build a Secure Public Cloud Session #8 Wednesday, November 16, 2011 10:45am John Kinsella Founder, Stratosec

Intro ,[object Object],[object Object],[object Object],[object Object]

Overview ,[object Object],[object Object],[object Object],[object Object]

Ground rules ,[object Object],[object Object]

Why this talk? ,[object Object],[object Object],[object Object],[object Object]

Why? From http://www.ece.cmu.edu/~koopman/des_s99/sw_reliability/

Architecture & Design ,[object Object],[object Object],[object Object],[object Object]

What is a Secure Public Cloud? ,[object Object],[object Object]

Worries ,[object Object],[object Object],[object Object],[object Object]

Benefits ,[object Object],[object Object],[object Object],[object Object]

Required functionality ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Encryption ,[object Object],[object Object],[object Object],[object Object]

IDS ,[object Object],[object Object],[object Object],[object Object]

Security Monitoring ,[object Object],[object Object],[object Object]

Building ,[object Object],[object Object],[object Object],[object Object],[object Object]

Building a secure cloud ,[object Object],[object Object],[object Object],[object Object]

Trust ,[object Object],[object Object],[object Object],[object Object],[object Object]

Setup Basics ,[object Object],[object Object]

Selecting a Cloud Platform ,[object Object],[object Object],[object Object],[object Object],[object Object]

Trial Period ,[object Object],[object Object],[object Object],[object Object]

Trial Period ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Review Software ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Me? Code review? ,[object Object],[object Object],[object Object],[object Object]

Review Software ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Review Software ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Code Review email sent to vendor after code review:

Monitored Installation ,[object Object],[object Object],[object Object],[object Object]

Review Gathered Intelligence ,[object Object],[object Object],[object Object],[object Object]

Test Security ,[object Object],[object Object],[object Object]

Test Security ,[object Object],[object Object],[object Object],[object Object]

Sound familiar? ,[object Object],[object Object],[object Object],[object Object]

Operations – Who Do You Trust? ,[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],Summary

Stay in Touch ,[object Object],[object Object]

Mais conteúdo relacionado

Mais procurados

Contain your risk: Deploy secure containers with trust and confidenceBlack Duck by Synopsys

Javantura - Securing the JVMNicolas Fränkel

App lockerConcentrated Technology

Disnix: A toolset for distributed deploymentSander van der Burg

CSW2017 Scott kelly secureboot-csw2017-v1CanSecWest

Denali Sql Server SecurityGabriel Villa

Developers are from Mars, Security guys are from VenusXavier Mertens

Code Europe PL - Securing the JVM: Neither for fun nor for profit, but do you...Nicolas Fränkel

Voxxed Days Athens - Securing the JVM - Neither for fun nor for profit, but d...Nicolas Fränkel

Secure Web CodingXavier Mertens

Integrating Black Duck into your Agile DevOps EnvironmentBlack Duck by Synopsys

Hacking IoT with EXPLIoT FrameworkPriyanka Aash

XML Interfaces to the popular Nessus ScannerNetwork Intelligence India

Introduction to DevOps and DevOpsSec with Secure Design by Prof.Krerk (Chulal...iotcloudserve_tein

Mais procurados (14)

Contain your risk: Deploy secure containers with trust and confidence

Javantura - Securing the JVM

App locker

Disnix: A toolset for distributed deployment

CSW2017 Scott kelly secureboot-csw2017-v1

Denali Sql Server Security

Developers are from Mars, Security guys are from Venus

Code Europe PL - Securing the JVM: Neither for fun nor for profit, but do you...

Voxxed Days Athens - Securing the JVM - Neither for fun nor for profit, but d...

Secure Web Coding

Integrating Black Duck into your Agile DevOps Environment

Hacking IoT with EXPLIoT Framework

XML Interfaces to the popular Nessus Scanner

Introduction to DevOps and DevOpsSec with Secure Design by Prof.Krerk (Chulal...

Semelhante a Truly Secure: The Steps a Security Practitioner Took to Build a Secure Public Cloud

Securing the CloudJohn Kinsella

Jason Kent - AppSec Without Additional Toolscentralohioissa

AppSec How-To: Achieving Security in DevOpsCheckmarx

SplunkLive! Munich 2018: Intro to Security Analytics MethodsSplunk

SplunkLive! Frankfurt 2018 - Intro to Security Analytics MethodsSplunk

Making Security Agile - Oleg GrybSeniorStoryteller

Cyber security webinar 6 - How to build systems that resist attacks?F-Secure Corporation

10 Steps To Secure Agile DevelopmentCheckmarx

(SEC312) Taking a DevOps Approach to Security | AWS re:Invent 2014Amazon Web Services

SCS DevSecOps Seminar - State of DevSecOpsStefan Streichsbier

Pragmatic Pipeline SecurityJames Wickett

Open Source Defense for Edge 2017Adrian Sanabria

Cyber security - It starts with the embedded systemRogue Wave Software

Many products-no-security (1)SecPod Technologies

Arved sandstrom - the rotwithin - atlseccon2011Atlantic Security Conference

What Good is this Tool? A Guide to Choosing the Right Application Security Te...Kevin Fealey

Product SecuritySteven Carlson

DevSecOps and the CI/CD PipelineJames Wickett

AMI Security 101 - Smart Grid Security East 2011dma1965

Making Security AgileOleg Gryb

Semelhante a Truly Secure: The Steps a Security Practitioner Took to Build a Secure Public Cloud (20)

Securing the Cloud

Jason Kent - AppSec Without Additional Tools

AppSec How-To: Achieving Security in DevOps

SplunkLive! Munich 2018: Intro to Security Analytics Methods

SplunkLive! Frankfurt 2018 - Intro to Security Analytics Methods

Making Security Agile - Oleg Gryb

Cyber security webinar 6 - How to build systems that resist attacks?

10 Steps To Secure Agile Development

(SEC312) Taking a DevOps Approach to Security | AWS re:Invent 2014

SCS DevSecOps Seminar - State of DevSecOps

Pragmatic Pipeline Security

Open Source Defense for Edge 2017

Cyber security - It starts with the embedded system

Many products-no-security (1)

Arved sandstrom - the rotwithin - atlseccon2011

What Good is this Tool? A Guide to Choosing the Right Application Security Te...

Product Security

DevSecOps and the CI/CD Pipeline

AMI Security 101 - Smart Grid Security East 2011

Making Security Agile

Mais de John Kinsella

Removing the Burden of Securing Microservices Through Automation and VisibilityJohn Kinsella

2019 Infosec World KeynoteJohn Kinsella

An In-depth look at application containersJohn Kinsella

Understanding container securityJohn Kinsella

Docker security configurationJohn Kinsella

A (fun!) Comparison of Docker Vulnerability ScannersJohn Kinsella

CloudStack and the HeartBleed vulnerabilityJohn Kinsella

Dont break the glassJohn Kinsella

CloudStack SecuredJohn Kinsella

What is Cloud Security, and Can I Have Some?John Kinsella

Mais de John Kinsella (10)

Removing the Burden of Securing Microservices Through Automation and Visibility

2019 Infosec World Keynote

An In-depth look at application containers

Understanding container security

Docker security configuration

A (fun!) Comparison of Docker Vulnerability Scanners

CloudStack and the HeartBleed vulnerability

Dont break the glass

CloudStack Secured

What is Cloud Security, and Can I Have Some?

Último

Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya

Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous

Corporate and higher education May webinar.pptxRustici Software

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingEdi Saputra

A Year of the Servo Reboot: Where Are We Now?Igalia

How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes

DBX First Quarter 2024 Investor PresentationDropbox

Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93

Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1

FWD Group - Insurer Innovation Award 2024The Digital Insurer

Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot ModelDeepika Singh

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Miguel Araújo

AXA XL - Insurer Innovation Award Americas 2024The Digital Insurer

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Jeffrey Haguewood

Powerful Google developer tools for immediate impact! (2023-24 C)wesley chun

Architecting Cloud Native ApplicationsWSO2

Strategies for Landing an Oracle DBA Job as a FresherRemote DBA Services