Securing Sovereign andGlobal Clouds
Jim Reavis, Chief Executive Officer

ABOUT THE
CLOUD
SECURITY
ALLIANCE

Building security best practices
for next generation ITG l o b al , n o t - f o r- p ro f i torganization

Research and Educational
Programs“ To p r o m o t e t h e u s e o f b e s tpractices for providing security
assurance within Cloud Computing

Cloud Provider Certificationand provide education on the usesof Cloud Computing to help secure
all other forms of computing.”
User Certification

The globally authoritative sourcef o r Tr u s t i n t h e C l o u d165k+100+

2009

INDIVIDUAL MEMBERS

CHAPTERSCSA FOUNDED500+35+SEATTLE/BELLINGHAM// GLOBALHEADQUARTERS

CORPORATE MEMBERS

ACTIVE WORKING GROUPS

2,000+

12,000+STAR REGISTRYENTRIESCONTRIBUTING RESEARCHVOLUNTEERSBERLIN //EMEA HEADQUARTERS

CSA research is
FREE! 500+Publications
SHANGHAI // GREATERCHINA REGION

Strategic partnerships withgovernments, research
institutions, professional
associations and industry

Copyright © 2023 CLOUD SECURITY ALLIANCE

SINGAPORE // ASIA PACIFIC
HEADQUARTERS

tyAanceNTENRALUSEONLY

Key Trends• Zero Trust• Automation• Containers &serverless• ChatGPT & other
AI/ML• Cloud supply chain• Assurance• Multi-cloud• Cloud native security• Edge computing• Threat modeling• Resilience• Quantum• SaaS security• Vulnerability tracking• Confidentialcomputing• CSP Change Control
Notification• Passwordless• Data sovereignty

Copyright © 2023 CLOUD SECURITY ALLIANCE

4

Sovereign, Regional Cloud Examples• Google Cloud Platform Germany (partnership with DeutscheTelekom)• AWS GovCloud (US Federal Government)• Singapore: Microsoft and HTX (Home Team Science andTechnology Agency)• China Aliyun• Gaia-X: infrastructure for Europe• Balancing national interests vs broader technology innovation
Copyright © 2023 CLOUD SECURITY ALLIANCE

5

Optimizing Sovereign Clouds• Benefits• Compliance with national data protection interests• In-country data center infrastructure• Drawbacks• Less technological innovations• Weaker resilience• Aligning Sovereign with Global Clouds• Shared administrative models• Improved data management & security technologies
Copyright © 2023 CLOUD SECURITY ALLIANCE

6

Generalized Cloud Security concerns fromEnterprise CISOs• Global optimization & standardization VS regional & nation-statepriorities• Effective realization of the shared responsibility model• Compliance regimen• Data protection, resilience, managing complexities• Evolving threat vectors• Security at scale: automation, orchestration• Cloud security workforce readiness
Copyright © 2023 CLOUD SECURITY ALLIANCE

7

CISO Expectations of Major CSPs
• Looking for CSP leadership in addressing:• Cyber risk and board visibility• Threats to critical infrastructure and ransomware threat vectors• Threat intelligence sharing with competitors and tenants• Reasonable compatibility with competitors• Software sourcing and provenance, SBOM, API security• Cyber skills development and talent development• Harmonization of global compliance requirements• Confidential computing accessibility
Copyright © 2023 CLOUD SECURITY ALLIANCE

8

Key Survey Recap• Security & Technology Maturity• Crown Jewel Data
• Multi-Cloud• Automation• Top Threats to Cloud Computing• All Tenant-based in top 11• Zero Trust• Priority for 75% of CISOs• Measuring Risk & Risk Governance

Surveys Referenced

https://cloudsecurityalliance.org/artifacts/cloud-security-and-technologymaturity-survey/
https://cloudsecurityalliance.org/research/topics/top-threats/https://cloudsecurityalliance.org/artifacts/ciso-perspectives-and-progressin-deploying-zero-trust
https://cloudsecurityalliance.org/artifacts/measuring-risk-and-riskgovernance/• Manual estimation of cloud usage• Lack of post-procurement assurance• Infrequent adjustment of risk metrics• Data Loss Prevention & Security• Cloud is #1 Data sharing mechanism• Legacy DLP too complex, needs
modernization

https://cloudsecurityalliance.org/artifacts/data-loss-prevention-and-datasecurity-survey-report
Copyright © 2023 CLOUD SECURITY ALLIANCE

9• Center is positioning Zero Trust as “Philosophy informing Strategy”• Assume everything can be compromised• Protect assets with least privilege access• Identity as a foundation• Continuous verification•

Training, Research, Resource Hub•

www.cloudsecurityalliance.org/zt
Copyright © 2023 CLOUD SECURITY ALLIANCE

10• Use 5 Step Methodology• Extend 5 Pillars to “Cloud Native”• DevOps > DevSecOps• Container and Serverless deployment• Focus on Automation & Tooling• Align Microservices Architecture with Zero Trust Network Architecture• Layer 7 Access Control• Infrastructure as Code• Policy as CodeCopyright © 2023 CLOUD SECURITY ALLIANCE

11

OpenAI / ChatGPT• AI as a Service: biggest game changer since the cloud• OpenAI has significant lead over other Large
Language Models (LLM)• First CSA guidance paper released at RSA: Security
Implications of ChatGPT• Four Dimensions
1. How malicious actors can use it to create
new and improved cyberattacks
2. How defenders can use it to improvecybersecurity programs
3. How it can be directly attacked to produce
incorrect or otherwise bad results4. How to enable the business to use it
securely and responsibly
Copyright © 2023 CLOUD SECURITY ALLIANCE

12

Free Research to improve
Top Downloads• CCM & CAIQ
• Security Guidance• Top Threats• DevSecOps• Enterprise Architecture V2• Cloud Threat Modeling• Cloud Incident ResponseFramework• SaaS Governance• Serverless / Containers• IoT Controls Framework

Copyright © 2023 CLOUD SECURITY ALLIANCE

13

Keys to a Secure & Sovereign Futureü Shared Responsibility & Fateü Transparency
ü Innovation
ü Policyü PeopleCopyright © 2023 CLOUD SECURITY ALLIANCE14

Thank You!

jreavis@cloudsecurityalliance.org
www.cloudsecurityalliance.org
Copyright © 2023 CLOUD SECURITY ALLIANCE

15