Crawford & Company Cloud Computing – Changing Nature of Risk in the 21 st Century Clive Nicholls...
-
date post
22-Dec-2015 -
Category
Documents
-
view
216 -
download
0
Transcript of Crawford & Company Cloud Computing – Changing Nature of Risk in the 21 st Century Clive Nicholls...
Crawford & Company
Cloud Computing – Changing Nature of Risk in the 21st Century
Clive NichollsSenior Vice President,
Global MarketsCrawford & Company
Cloud Computing:Changing Nature of Risk
in the 21st Century
Crawford & Company
• Challenges for our profession
• Challenges for insurers
• Changing technology landscape
• Cloud computing
• Understanding the changing risk
• New Insurance Cover?
• Discussion?
Crawford & Company
Challenges for our profession
• The whole world has changed beyond recognition since the forerunners to the CILA met in 1940 to form the Fire Loss Adjusters Association
• Average age of loss adjuster is 40+??
• We are well versed in traditional risks and their effect
• But much has changed over the past 10 years?
• Not all about fire, flood and storm!
Crawford & Company
Challenges for insurers
•General insurance market static
•Growth of alternative risk transfer
•Corporate world & increasingly personal worldnature of risk is fundamentally changing
An Osborne Executive portable computer, from 1982, and an iPhone, released 2007. The Executive weighs 100 times as much, is nearly 500 times as large by volume, costs 10 times as much, and has 1/100th the clock frequency of the iPhone
•Can we insure what really matters?
Crawford & Company
Changing technology landscape
Crawford & Company
Crawford & Company
Cloud Computing
Crawford & Company
Cloud Computing Road Trip
Cloud Computing
Crawford & Company
The Cloud is Fantastic, but…• How can I maintain control of my data in the cloud?
• What if I want to change cloud vendors? How can I verify my data is
“destroyed” when terminating a service provider?
• What happens if my service provider goes out of business?
• How can I comply with security best practices, internal governance and
compliance rules in the cloud?
• How can I guarantee only I have access to my data?
Crawford & Company
Public Cloud Service Models
Software as a Service (SaaS)• Use provider’s application over the Internet• Proprietary infrastructure
Platform as a Service (PaaS)• Deploy enterprise-created applications to a cloud • Proprietary infrastructure
Infrastructure as a Service (IaaS)• Rent processing, storage, network capacity, and
other fundamental computing resources• Full access to infrastructure stack with basic security
services (Firewall, Load Balancers etc.)
Crawford & Company
Cloud Services Market Evolution: 25% CAGR Growth
Source: “Cloud Computing 2010: An Update”, IDC 29 September 2009
IaaS represents the largest piece of the cloud services market
Crawford & Company
Servers Virtualisation & Private Cloud
Public CloudPaaS
Public CloudIaaS
End-User (Enterprise) Service Provider
Public CloudSaaS
Who has control?
Crawford & Company
7.2. Security. We strive to keep Your Content secure, but cannot guarantee that we will be successful at doing so, given the nature of the Internet. Accordingly,
without limitation to Section 4.3 above and Section 11.5 below, you acknowledge that you bear sole responsibility for adequate security, protection and backup of Your Content and Applications. We strongly encourage you, where available and
appropriate, to (a) use encryption technology to protect Your Content from unauthorised access, (b) routinely archive Your Content, and (c) keep your
Applications or any software that you use or run with our Services current with the latest security patches or updates. We will have no liability to you for any unauthorised access or use, corruption, deletion, destruction or loss of any of
Your Content or Applications.
http://aws.amazon.com/agreement/#7 (3 March 2010)
Amazon Web Services™Customer Agreement
The cloud customer has responsibility for security and needs to plan for protection.
Crawford & Company
Challenges for Public Cloud
Shared StorageShared
Firewall
Virtual Servers
Shared network inside the firewall
Shared firewall – Lowest common
denominator – less fine grained control
Multiple customers on one physical server –
potential for attacks via the hypervisor
Shared storage – is customer segmentation secure against attack?
Easily copied machine images – who else has
your server?
Internet
Crawford & Company
Data Security Challenges in the CloudEncryption rarely used: - Who can see your information?
Storage volumes and servers are mobile: - Where is your data? Has it moved?
Rogue servers might access data: - Who is attaching to your storage?
Audit and alerting modules lacking: - What happened when you weren’t looking?
Encryption keys tied to vendor:- Are you locked into a single security solution? Who has access to your keys?
Storage volumes contain residual data: - Are your storage devices recycled securely?
Name: John DoeSSN: 425-79-0053Visa #: 4456-8732…
Name: John DoeSSN: 425-79-0053Visa #: 4456-8732…
Crawford & Company
Perimeter
Public CloudDatacenter
Strong perimeter securityNo shared CPU
No shared networkNo shared storage
Weak perimeter securityShared CPU
Shared networkShared storage
Traditional “outside-in” approach is inadequate in an “inside-out” cloud world full of strangers
Hypervisor
Company 1
App 2
App 1
App 3
App 1
App 2
App 3
App 4
App 5
App n
Company 2
Company 3
Company 4
Company 5
Company n
Hypervisor
…
Crawford & Company
Shared StorageShared
Firewall
Virtual Servers
Shared network inside the firewall
Shared firewall – Lowest common
denominator – less fine grained control
Multiple customers on one physical server – potential for
attacks via the hypervisor
Shared storage – is customer segmentation secure against attack?
Easily copied machine images – who else has your server?
Doesn’t matter – the edge of my virtual machine is protected
Doesn’t matter – treat the LAN as public
Doesn’t matter – treat the LAN as public
Doesn’t matter – They can start my server but only I can unlock
my data
Doesn’t matter – My data is encrypted
Internet
The Private Security Answer
Crawford & Company
Users access app
Image ensures data is always encrypted and
managed
Host defends itself from attack
Encrypted Data
Encrypted Data
Encryption keys controlled by you
DC1, LAN 1
Cloud 2, LAN 1
DataData
Cloud 1, LAN 2
DC2, LAN 2
DataData
Public CloudDatacenter
Benefits•Facilitates movement between datacenter & cloud•Delivers security compliance through encryption•Avoids service provider lock-in•Enables data “destruction”
DataData
Crawford & Company
Security Breach
• Every breached security system was once thought infallible
• SaaS (software as a service) and PaaS (platform as a service) providers all trumpet the robustness of their systems, often claiming that security in the cloud is tighter than in most enterprises. But the simple fact is that every security system that has ever been breached was once thought infallible.
• Google was forced to make an embarrassing apology in February when its Gmail service collapsed in Europe, while Salesforce.com is still smarting from a phishing attack in 2007 which duped a staff member into revealing passwords.
• While cloud service providers face similar security issues as other sorts of organisations, analysts warn that the cloud is becoming particularly attractive to cyber crooks.
• "The richer the pot of data, the more cloud service providers need to do to protect it," says IDC research analyst David Bradshaw.
Crawford & Company
• Zurich Insurance must pay an enormous £2.3m fine for losing thousands of British people's personal data.
• The fine was imposed not by the Information Commissioner's Office but by the Financial Services Authority.
• Zurich Insurance lost 46,000 customer records including some bank details when a tape back-up went missing between two sites in South Africa.
• Even worse, it took a year for Zurich UK to hear about the loss.
Security Breach
Crawford & Company
• However, according to Datamonitor's Trifković, the cloud is still very much a new frontier with very little in the way of specific standards for security or data privacy. In many ways he says that cloud computing is in a similar position to where the recording industry found itself when it was trying to combat peer-to-peer file sharing with copyright laws created in the age of analogue.
• "In terms of legislation, at the moment there's nothing that grabs my attention that is specifically built for cloud computing," he says. "As is frequently the case with disruptive technologies, the law lags behind the technology development for cloud computing.“
• What's more, many are concerned that cloud computing remains at such an embryonic stage that the imposition of strict standards could do more harm than good.
Understanding changing risk
Crawford & Company
Why is this such a hot topic?
– Change in Regulatory Environment, especially within the EU.
– Several High Profile, Well-Publicised Incidents over last couple of years;
– Increased Dependency on Technology;
– More “Paperless” Work Environments;
– New Contractual Requirements. (Always check for specific obligations within contracts)
22
Increased Profile
Crawford & Company
Industry-specific legislation
– 1996 – Health Insurance Portability and Accountability Act (HIPAA)– 1999 – Gramm-Leach-Bliley Act (GLBA)
American Recovery and Reinvestment Act (ARRA)
– 2009: Health Information Technology for Economic and Clinical Health Act (HITECH)
State Legislation
– 2003 – California Senate Bill 1386 (CA SB 1386)– Subsequent state legislation (currently 46 states, with two pending)
23
US Legislation
Crawford & Company
• Only applicable to Telecommunications companies:
Passed Nov 2009, to be enacted by May 2011
BUT
• Recent ENISA report stated that almost all Data Protection Authorities were in favour of extending this to all sectors.
• Justice Minister (Viviane Reding) is highly supportive
AND…
24
EU Legislation
Crawford & Company
• Privacy legislation is undergoing a full review.
• E.U. Commission will finalise proposals in 2011
• These will include a “right to be forgotten”
• Data controllers remain fully liable and will need to prove they keep the data (shift of duty from data subjects)
• Rules will apply irrespective of the location of the data (esp. US & India)
• Total transparency for the data subject will be the guiding principle
25
Proposed US Legislation
Crawford & Company
• USPer Breach US$7,200,000Per Record US$21463.78% (Source: Ponemon Institute 2010)
• UK• Per Breach GB£1,681,000
Per Record GB£6445% (Source: Ponemon Institute 2009)
26
Typical Breach Costs
Crawford & Company
• Privacy Breach
– an unauthorised disclosure or loss of:• Personal Information in the care, custody or control of any
Insured or Service Provider; or
• Corporate information in the care, custody or control of any Insured or Service Provider that is specifically identified as confidential and protected under a nondisclosure agreement or similar contract; or
– a violation of any Privacy Regulation.
27
Typical Insurance Cover
Crawford & Company
Reasonable and Necessary Costs, Fees and Expenses incurredwithin twelve (12) months of a Privacy Event, including:
• Computer Forensic Analysis
• Determination of Indemnification/Notification Obligations
• Costs of Compliance with any Privacy Regulations
• Notification of Affected Individuals
• Implementation and Execution of a Public Relations Campaign
• Procure Credit Monitoring Services
• Ensure the trigger is loss of data, not a Claim & Definition of Claim not tied to breach of legislation!
28
Typical Insurance Cover
Crawford & Company
• Be able to demonstrate a robust Breach Response Policy (outsourcing is acceptable).
• Implement:Data leakage protectionEncryption for all mobile devices and portable mediaAccess managementTraining against social engineering
• Demonstrate an awareness of and willingness to work towards 27001/2
29
Basic Risk Management
Crawford & Company
• Insurance language is old, tried & tested (high degree of certainty)
• Cloud computing is new (is it really or an aggregation of what we are familiar with?)
• There is the potential for uncertainty from both a material damage point of view and liability point of view. Some might say we like that but is it good for our customers?
• Is data properly valued? Is it where you thought it was? If there is a loss are the economic circumstances sufficiently well known? Damage in one place loss in another? Are there jurisdictional issues? Do the service contracts provide adequate protection? Will they be found to be reasonable?
• All of the above can be dealt with or at least understood if recognised in advance. Problems can arise where covers “made to fit” the event
• We haven’t seen any volume of claims yet so outcomes not yet known
Claims Point of View
Crawford & Company
Questions