CSA Cloud Trust Protocol and A4Cloud: Enforcing cloud accountability through security continuous monitoring, Daniele Catteddu, CSA

CSA Cloud Trust Protocol and
A4Cloud:
Enforcing cloud accountability
through security continuous
monitoring
November 2013, Research Council of Norway

Daniele Catteddu, CSA Managing Director EMEA and OCF Project Director

Copyright © 2013 CloudSecurity Alliance

www.cloudsecurityalliance.org

About the Cloud Security Alliance
Global, not-for-profit organisation
Over 48,000 individual members, more than 180
corporate members, and 65 chapters
Building best practices and a trusted cloud ecosystem
Agile philosophy, rapid development of applied research
GRC: Balance compliance with risk management
Reference models: build using existing standards
Identity: a key foundation of a functioning cloud economy
Champion interoperability
Enable innovation
Advocacy of prudent public policy
“To promote the use of best practices for providing security
assurance within Cloud Computing, and provide education on the
uses of Cloud Computing to help secure all other forms of
computing.”
Copyright © 2011 Cloud Security Alliance
2013


Security
Benefits



Economy of Scale

Security
Benefits



RISKS



OPENNESS & TRANSPARENCY



NEW GOVERNANCE MODELS



ACCOUNTABILITY

2013


Cloud Accountability Project

The project focuses on accountability as the
most critical prerequisite for effective
governance and control of corporate and private
data processed by cloud-based IT services.
It aims to assist cloud service providers with:
• Techniques to make services more
trustworthy
• Ways to satisfy business policies and
demonstrate compliance
• Allowing differentiation

This project is partly funded from the European Commission’s Seventh Framework Programme (FP7/2007-2013) under grant agreement no: 317550 (A4CLOUD).

A4Cloud Members
Industry

Community
Research


Drivers for accountability
Globalisation and new technologies
•

Cloud computing presents a paradigm shift in how IT is deployed and consumed

Uncertainty and lack of visibility (for consumers, clients and
regulators)
•

Privacy and trust comes from sound stewardship of information by service providers
for which we need to hold them accountable

Regulatory complexity in global business environments,
especially for cloud
•

Accountability addresses global interoperability

•

Clear and consistent framework of data protection rules

•

Allows avoidance of complex matrix of national laws and reduces unnecessary layers
of complexity for cloud providers

•

New technologies like cloud are straining traditional privacy frameworks


Context
Principles,
Regulations and
Societal Norms

Trying to get
organisations to do the
right thing

What is the right
thing?

supports

Accountability

How to do the right
thing

Design
complements

Holding them to
account if they don’t

Facilitating redress


Context
Principles,
Regulations and
Societal Norms

Trying to get
organisations to do the
right thing

What is the right
thing?

supports

How to do the right
thing

Control over practical
aspects of compliance
Obligation to prove
that principles put
into effect

Accountability

Design
complements

Holding them to
account if they don’t

Facilitating redress


Cloud ecosystem


Model of Accountability


Conceptual model of
accountability
abstract
Accountability

conceptual
organisational
operational

Attributes
What?

Practices
How?

Mechanisms
With what?

concrete

Defining accountability
Accountability consists of defining
Accountability

governance

to

comply

in

a

responsible manner with internal
Attributes

and external criteria, ensuring
implementation

Practices

of

appropriate

actions, explaining and justifying
those actions and remedying any

Mechanisms

failure to act properly.


Accountability attributes
• Observabililty
Accountability

Attributes

• Verifiability
• Attributability
• Transparency

Practices

Mechanisms

• Responsibility
• Liability
• Remediation


Accountability practices

Accountability

Attributes

Practices

• Define governance
• Ensure implementation
• Explain & justify actions

Mechanisms

• Remedy failures


Accountability mechanisms

Accountability

Attributes

Practices

• Business processes
contain

Mechanisms

• Non-technical
instruments
• Technical tools


Accountability Mechanisms

Auditing,
Risk assessment, etc

Accountability

Attributes

Practices

contain

Mechanisms

• Non-technical
instruments
• Technical tools



Contracts,
Legal means, etc

Accountability

Attributes

Practices

contain

Mechanisms

• Non-technical
instruments
• Technical tools


Tracking and
transparency tools
Notification of policy
violation, etc

Accountability

Attributes

Practices

contain

Mechanisms

• Non-technical
instruments
• Technical tools


A4Cloud project
What is needed
Trustworthy
architecture

• User-centric
accountability tools

• Accountability policy
language
• Enforcement
mechanisms for
accountability

Transparent
security

• Reference architecture
for accountability
• Interoperable
mechanisms and tools

Privacy
assurance

Trust
assurance

Policies

• Risk and trust models for
accountability

• Policy compliance

Security
and trust
economics

Governance

• Accountability metrics
• Accountability evidence
• Auditing mechanisms
and tools

• Accountability framework


A4Cloud & CSA
A4Cloud results are relevant to a number of
number of CSA research, educational activities,
as well as in the context of the Open Certification
Framework


The Cloud Trust Protocol (CTP) is designed to be a
mechanism by which cloud service clients can ask for and
receive information related to the security of the services
they use in the cloud, promoting transparency and trust.

2013


An idea for a consumer/provider protocol
Confidentiality
level
Uptime
…

consumer

provider

CTP

= Reports

+ Commitments

2013

+ Alerts


Transparency and trust

Goal: Transparency and trust
OCF level 3: Cloud monitoring based certification

OCF level 2: Third-party cloud certification

OCF level 1: Cloud self-certification

2013


What we have today…
1. API & Data Model
What is…
A report, a commitment, an alert?
A security attribute?
A resource, a service?

3.

2.

Security attribute
catalogue

“Availability”, “timely incident reporting”,
“confidentiality level”…

A prototype
REST + XML



The API is the easy part...



Challenge 1:

Standardizing cloud security attributes

=
0.06 kWh

=
0.06 kWh

0.06 kWh

Electricity consumption
Cloud availability

=
99.95%

=
99.95%

99.95%

Challenge 2:

Finding good security attributes

1

Vulnerability found

?

<

5

Vulnerabilities found

100 vulnerabilities published in 2013 (NVD)
9 relevant to our platform
8 tested
1 found exploitable (severity=6.0)
Time between discovery and fix = 5 days.



Challenge 3:

Fitting CTP in OCF level 3

The CSA Open Certification Framework is an industry initiative to
allow global, accredited, trusted certification of cloud providers.


Challenge 4:

Integrating CTP in A4Cloud

2013


Lessons already learned
Good attributes need to be:
Well defined - consistently measured
Cheap to evaluate – automated
Correlated to consumer utility

Some interesting but tricky areas:
Vulnerability management, data location, staff data
access, incident response….

2013


Now it’s your turn!

2013


The CTP working group
CSA launches the CTP working group:
Objective 1: Define CTP Vision, goals, design principles.
Objective 2: Define CTP data model.
Objective 3: Specify the CTP API.
Objective 4: Specify CTP core security attributes.
Objective 5: Implement a CTP pilot.
Objective 6: Support OCF monitoring based certification

2013


Help Us Secure Cloud Computing
info@cloudsecurityalliance.org
dcatteddu@cloudsecurityalliance.org
www.linkedin.com/groups?gid=1864210

www.a4cloud.eu

2013


2013


CSA Cloud Trust Protocol and A4Cloud: Enforcing cloud accountability through security continuous monitoring, Daniele Catteddu, CSA

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (12)

Similar to CSA Cloud Trust Protocol and A4Cloud: Enforcing cloud accountability through security continuous monitoring, Daniele Catteddu, CSA

Similar to CSA Cloud Trust Protocol and A4Cloud: Enforcing cloud accountability through security continuous monitoring, Daniele Catteddu, CSA (20)

More from The Research Council of Norway, IKTPLUSS

More from The Research Council of Norway, IKTPLUSS (20)

Recently uploaded

Recently uploaded (20)

CSA Cloud Trust Protocol and A4Cloud: Enforcing cloud accountability through security continuous monitoring, Daniele Catteddu, CSA