IBM SmartCloud Le regole per la Sicurezza nel Cloud Computing: la visione di IBM

Transcript

1 Raffaella D Alessandro IBM GTS Security and Compliance Consultant CISA, CRISC, LA ISO 27001, LA BS 25999, ISMS Senior Manager, ITIL v3 Roma, 16 maggio 2012 IBM SmartCloud Le regole per la Sicurezza nel Cloud Computing: la visione di IBM 1

2 Agenda Le esperienze di IBM sul Cloud Computing Le regole nella Fabbrica del Cloud : la IBM Cloud Computing Reference Architecture Servizi di Sicurezza e aspetti gestionali nella IBM Cloud Computing Reference Architecture Le regole per la costruzione dei servizi di Sicurezza nella Fabbrica del Cloud Le regole per la gestione dei servizi di Sicurezza nella Fabbrica del Cloud Use Case 2

3 Il Cloud Computing sta trasformando il panorama IT mondiale e sta guidando verso una nuova era di crescita e cambiamento sia IBM che i suoi clienti 3, M 1M successful private cloud projects daily secure client daily transactions cloud through transactions public cloud managed virtual SAP machines users Our market experiences have shaped our strategies for driving innovation and value for clients through cloud computing Foundation Services Solutions Private & Hybrid Managed Services Business Solutions Cloud Enablement Technologies Infrastructure & Platform as a Service Software and Business Process as a Service Commitment to open standards and a broad ecosystem 3

4 The IBM Cloud Computing Reference Architecture (CCRA): le regole della Fabbrica del Cloud per lo sviluppo e l erogazione di Servizi 4 Public Cloud RA whitepaper available on ibm.com: CCRA OpenGroup submission:

5 Le regole della Fabbrica del Cloud sono in continua evoluzione 5

6 IBM CCRA Servizi di Sicurezza e aspetti gestionali Security & Risk Manager Compliance Manager Continuity Manager 6

7 IBM Cloud Security Foundation Controls 7

8 Le best practices IBM per la Sicurezza nella Fabbrica del Cloud The objective of security for Cloud Computing is to set and maintain the level of assurance for systems (hardware and software), services and informations that falls within the business and technical risk boundaries set by the provider(s) and the consumers. Security within IBM Cloud Computing is based on an effective Governance, to include: Definition of risks Definition of security plans and security policies Establishment of organizational structures Security Principles of Design Security Policy for Development, Operation and Admin, Compliance Security Foundational Controls Security Component Catalog Security Subsystems Models s/redp4614.html 8

9 Le regole per la costruzione dei servizi di Sicurezza nella Fabbrica del Cloud : IBM Security Framework Architectural Principles IBM Security Framework: Business Security Reference Model Governance, Risk, Compliance (GRC) Application and Process People and Identity IT Infrastructure: Network, Server, End Point Data and Information Physical Infrastructure Architectural Principles Software, System and Service Assurance Security Info and Event Infrastructure Storage Security Command and Control Management Identity, Access and Entitlement Infrastructure Host and End-point Security Foundational Security Management Identity, Access and Entitlement Management Security Policy Management Data and Information Protection Management Security Services and Infrastructure Security Policy Infrastructure Application Security Risk and Compliance Assessment Threat and Vulnerability Management Crypto, Key and Certificate Infrastructure Network Security Physical Asset Management IT Service Management Service Management Infrastructure Physical Security Security Service Levels Code and Images Designs Policies Config Info and Registry Identities and Attributes Operational Context Events and Logs IT Security Knowledge Data Repositories and Classification 9

10 Le regole per la gestione dei servizi di Sicurezza nella Fabbrica del Cloud, devono consentire di rispondere ad una unica domanda Who will be liable if something goes wrong in the cloud and data is lost or compromised? 10

11 Coordinating privacy and information security is the responsibility of BOTH the provider and the consumer Who is responsible for privacy & security at the level? Datacenter Infrastructure Middleware Application Process Collaboration CRM/ERP/HR Financials Industry Applications Software as a Service Provider Consumer Middleware Web 2.0 Application Runtime Java Runtime Database Development Tooling Platform as a Service Provider Consumer Data Center Servers Networking Storage Fabric Shared virtualized, dynamic provisioning Infrastructure as a Service Provider Potential Gaps Consumer 11 La collaborazione tra consumer e provider è la chiave per indirizzare adeguatamente le responsabilità per la Privacy e la Sicurezza nel Cloud

12 Un caso esemplificativo di IBM SmartCloud for Social Business: La Sicurezza nei servizi di e Social Collaboration progettati per le organizzazioni pubbliche e private I servizi di Sicurezza nel trasferimento dei dati garantiscono i massimi livelli: Sofisticato sistema di cifratura per tutte le comunicazioni in rete Cifratura di tutte le caselle di posta e applicazioni Cifratura opzionale per i singoli documenti archiviati I servizi di Sicurezza per la gestione dei dati consentono di implementare le stesse Politiche interne adottate dal cliente: Classificazione, gestione, routing & sharing dei dati Security policy (es consistenza su regole password) Privacy (sia per clienti che per i dipendenti) Auditing e compliance Archiviazione e discovery People Activities Meetings Communities Files Events Chat Survey Forms 12

13 13