In this webinar Marc Wouters presents the NIS supervisory strategy for Digital Service Providers. The mission of the FPS Economy is to create the conditions for a competitive, sustainable and balanced operation of the goods and services market in Belgium.
Security Operations in the Cloud – the AXA experience – Webinar 24 June 2020
24 June 2020 – Cyber Security Coalition
How to make solid security a valued companion on a cloudification journey? In the fifth webinar of the Cloud Security focus group, Mathias Claes, Information Security Officer at AXA Belgium, chronicled the process of introducing cloud services, as Azure and Amazon AWS, in the transformation of AXA’s IT solutions. Including solid advice on ‘do’s’ and ‘don’ts’.
As the consumption of cloud services undeniably will explode, AXA instituted a cloud strategy, based on group wide input and a broad study of attackers’ opportunities (e.g. leaks of cloud credentials). It requires changes in security approach, security event management and a culture shift (with security brought close to devops). He described necessary organizational changes, based on the principle of “you build it, you run it, you secure it!” A cloudification team provides support in this to product teams. He presented a simplified evaluation flow for AWS as an illustration of how things work.
From a security point of view, he listed several key controls with need of extra consideration (IAM, auditing, networking, monitoring and back up), as well as the need to define a minimum technical security baseline (mapped on the 27K framework at AXA).
Obviously, there are still plenty of challenges ahead, with in particular the need to acquire additional overall cloud expertise (e.g. regarding incident handling). This includes the need for good management of multiple clouds. Also, companies must find a balance between speed and control, preventing projects to continue too far without considering security aspects. And important, one must strongly object to exceptions being made.
Finally, Mathias Claes listed several helpful resources by Enisa, the Cloud Security Alliance, Azure (e.g. Azure Security Compass) and AWS.
Other blog posts
In this webinar Professor Bart Preneel (COSIC-imec-KUL) presents how D3-PT as foundation of contact tracing apps instills trust in users and allows for cross-border interoperability.
Jeroen Vandeleur (NVISO) gives an overview on the Cloud logging capabilities and how they can be centralized. He also conveys some additional insights on security automation for Incident Response.
In this webinar, Esteban Hernández - Security Specialist at AWS - presents the Top 10 security focus points aimed at improving a customer’s overall security posture.
In this webinar Kati Verstrepen, President of the Ligue for Human Rights, assesses the current state of the human rights in general and the right to privacy in particular. Without the right to privacy, other human rights are being eroded.