IBM SmartCloud Le regole per la Sicurezza nel Cloud Computing: la visione di IBM

Transcript

1 Raffaella D Alessandro IBM GTS Security and Compliance Consultant CISA, CRISC, LA ISO 27001, LA BS 25999, ISMS Senior Manager, ITIL v3 Roma, 16 maggio 2012 IBM SmartCloud Le regole per la Sicurezza nel Cloud Computing: la visione di IBM 1

2 Agenda Le esperienze di IBM sul Cloud Computing Le regole nella Fabbrica del Cloud : la IBM Cloud Computing Reference Architecture Servizi di Sicurezza e aspetti gestionali nella IBM Cloud Computing Reference Architecture Le regole per la costruzione dei servizi di Sicurezza nella Fabbrica del Cloud Le regole per la gestione dei servizi di Sicurezza nella Fabbrica del Cloud Use Case 2

3 Il Cloud Computing sta trasformando il panorama IT mondiale e sta guidando verso una nuova era di crescita e cambiamento sia IBM che i suoi clienti 3, M 1M successful private cloud projects daily secure client daily transactions cloud through transactions public cloud managed virtual SAP machines users Our market experiences have shaped our strategies for driving innovation and value for clients through cloud computing Foundation Private & Hybrid Cloud Enablement Technologies Services Managed Services Infrastructure & Platform as a Service Solutions Business Solutions Software and Business Process as a Service Commitment to open standards and a broad ecosystem 3

4 Le regole sono rappresentate dalla organizzazione della Fabbrica del Cloud per la produzione di Servizi, la IBM Cloud Computing Reference Architecture, e sono in continua evoluzione 4

5 IBM CCRA Servizi di Sicurezza e aspetti gestionali Cloud Service Consumer Cloud Service Provider Cloud Service Creator Cloud Services Common Cloud Platform Hybrid Cloud Integration Existing & 3 rd party services, Partner Ecosystem s Business-Processas-a-Service Software-as-a-Service Platform-as-a-Service Operational Support Services (OSS) Business Support Services (BSS) Service Creation Tools Consumer In-house IT Infrastructure-as-a-Service Infrastructure Identity & Access Security Discover, Categorize, Protect Data & Information Assets Information Systems Acquisition, Development, and Maintenance Data Resiliency Resiliency Resiliency Compliance Assessment Consumability Ease of Doing Security & Readily Risk Manager Adapts Business Security Infrastructure against Threats & Vulnerabilities Problem & Information Security Incident Physical and Personnel Security Configuration for Resiliency Resiliency Policy Positive First Compliance Manager Simplified Use Experience Operations Security Governance, Risk & Compliance Cloud Governance Resiliency Monitoring / Analysis Security, Resiliency, Performance & Consumability Governance Availability & Continuity Rapidly Continuity Manager Integrates 5

6 IBM Cloud Security Foundation Controls 6

7 Le regole per la costruzione dei servizi di Sicurezza nella Fabbrica del Cloud The objective of security for Cloud Computing is to set and maintain the level of assurance for systems (hardware and software), services and informations that falls within the business and technical risk boundaries set by the provider(s) and the consumers. Security within IBM Cloud Computing is based on an effective Governance, to include: Definition of risks Definition of security plans and security policies Establishment of organizational structures Security Principles of Design Security Policy for Development, Operation and Admin, Compliance Security Foundational Controls Security Component Catalog Security Subsystems Models s/redp4614.html 7

8 Le regole per la costruzione dei servizi di Sicurezza nella Fabbrica del Cloud : IBM Security Framework Architectural Principles IBM Security Framework: Business Security Reference Model Governance, Risk, Compliance (GRC) Application and Process People and Identity IT Infrastructure: Network, Server, End Point Data and Information Physical Infrastructure Architectural Principles Software, System and Service Assurance Security Info and Event Infrastructure Storage Security Command and Control Foundational Security Identity, Access and Entitlement Identity, Access and Entitlement Infrastructure Host and End-point Security Security Policy Data and Information Protection Security Services and Infrastructure Security Policy Infrastructure Application Security Risk and Compliance Assessment Threat and Vulnerability Crypto, Key and Certificate Infrastructure Network Security Physical Asset IT Service Service Infrastructure Physical Security Security Service Levels Code and Images Designs Policies Config Info and Registry Identities and Attributes Operational Context Events and Logs IT Security Knowledge Data Repositories and Classification 8

9 Le regole per la gestione dei servizi di Sicurezza nella Fabbrica del Cloud, devono consentire di rispondere ad una unica domanda Who will be liable if something goes wrong in the cloud and data is lost or compromised? 9

10 Coordinating privacy and information security is the responsibility of BOTH the provider and the consumer Who is responsible for privacy & security at the level? Datacenter Infrastructure Middleware Application Process Collaboration CRM/ERP/HR Financials Industry Applications Software as a Service Provider Consumer Middleware Web 2.0 Application Runtime Java Runtime Database Development Tooling Platform as a Service Provider Consumer Data Center Servers Networking Storage Fabric Shared virtualized, dynamic provisioning Infrastructure as a Service Provider Potential Gaps Consumer 10 La collaborazione tra consumer e provider è la chiave per indirizzare adeguatamente le responsabilità per la Privacy e la Sicurezza nel Cloud

11 Un caso esemplificativo di IBM SmartCloud for Social Business: La Sicurezza nei servizi di e Social Collaboration progettati per le organizzazioni pubbliche e private I servizi di Sicurezza nel trasferimento dei dati garantiscono i massimi livelli: Sofisticato sistema di cifratura per tutte le comunicazioni in rete Cifratura di tutte le caselle di posta e applicazioni Cifratura opzionale per i singoli documenti archiviati I servizi di Sicurezza per la gestione dei dati consentono di implementare le stesse Politiche interne adottate dal cliente: Classificazione, gestione, routing & sharing dei dati Security policy (es consistenza su regole password) Privacy (sia per clienti che per i dipendenti) Auditing e compliance Archiviazione e discovery People Activities Meetings Communities Files Events Chat Survey Forms 11

12 12