Cloud Security
CategoryCloud Computing Standards
Cloud security services provide a broad set of capabilities to protect system data, customer information, managed application functions and the associated infrastructure services. They minimize the impact that security-related threats and vulnerabilities might have on an organization.
Standards Overview
Cloud Services One Can Trust
One of the primary concerns with the use of cloud services is the risk of customer information becoming subject to unauthorized access, improper distribution and use for malicious purposes. To address this concern, cloud service providers and consumers need to establish a discipline of secure capture, processing, storage and sharing of cloud-based information resources, with a framework of controls to enforce such discipline.
The security challenges that Cloud Computing presents are intimidating, specifically those related to public clouds, where platform solutions and infrastructure are owned and operated by a third-party that delivers services to the general public in a multi-tenant environment. However, with the proper Governance, Risk and Compliance (GRC) strategy and processes adapted for the Cloud Ecosystem, such challenges can be well addressed.
The following publications provide recommendations on cloud security controls and party responsibilities:
- ISO/IEC 27017 — Code of Practice for Information Security Controls for Cloud Computing Services
- ISO/IEC 27018 — Code of Practice for PII Protection in Public Cloud Acting as PII Processors
- Security Guidance for Critical Areas of Focus in Cloud Computing
- Security Guidance Information Sheet
- Cloud Incident Response Charter
- Enterprise Resource Planning and Cloud Adoption
- Guideline on Effectively Managing Security Service in the Cloud
- Top Threats to Cloud Computing: Deep Dive
- Top Threats to Cloud Computing Plus: Industry Insights
- A Repeatable Cloud-first Deployment Process Model
- Cloud Forensics Capability Maturity Model
- CloudTrust Protocol Data Model and API
- Security Considerations for Private vs. Public Clouds
- Privacy Level Agreement (PLA)
- Privacy Level Agreement (PLA) Outline Annex
- Cloud Adoption Practices and Priorities
- Cloud Usage: Risks and Opportunities
- Software Defined Perimeter Specification
- Software Defined Perimeter for IaaS
- Mapping the ISO/IEC 27037 Standard to Cloud Computing
- CSA Position on AICPA Service Organization Control (SOC) Reports
- CSA Position on Network Function Virtualization (NFV)
- CSA STAR Program Overview
- CSA STAR Certification Intake Form
- Publicizing Your CSA STAR Certification
- CSA STAR Program and Open Certification Framework (OCF)
- Guidelines for CPAs Providing CSA STAR Attestation
- Cloud Controls Matrix (CCM)
- CCM Mapping Methodology
- FedRAMP to CCM Candidate Mapping
- Consensus Assessments Initiative Questionnaire (CAIQ)
- Cloud Security Alliance Code of Conduct for GDPR Compliance
- Streamlining Vendor IT Security and Risk Assessments
- NIST SP800-144 — Guidelines on Security and Privacy in Public Cloud Computing
- NIST SP500-299 — Cloud Computing Security Reference Architecture
- FedRAMP: Security Assessment Framework
- FedRAMP: Security Controls Baseline
- FedRAMP: General Document Acceptance Criteria
- FedRAMP: A Case Study for Change Within Government
- FedRAMP: Policy Memorandum
- FedRAMP: Joint Authorization Board (JAB) Charter
- FedRAMP: Master Acronym and Glossary
- FedRAMP: Branding Guidance
- FedRAMP CSP: Authorization Playbook - Getting Started with FedRAMP
- FedRAMP CSP: Agency Authorization - Best Practices for CSPs
- FedRAMP CSP: JAB P-ATO Roles and Responsibilities
- FedRAMP CSP: Authorization Boundary Guidance
- FedRAMP CSP: JAB Prioritization Criteria and Guidance
- FedRAMP CSP: Digital Identity Requirements
- FedRAMP CSP: Transport Layer Security (TLS) Requirements
- FedRAMP CSP: Timeliness and Accuracy of Testing Requirements
- FedRAMP CSP: Automated Vulnerability Risk Adjustment Framework Guidance
- FedRAMP CSP: Requirements for the Use of Sampling for Vulnerability Scans
- FedRAMP CSP: Vulnerability Scanning Requirements
- FedRAMP CSP: Penetration Test Guidance
- FedRAMP CSP: Plan of Action and Milestones (POA&M)
- FedRAMP CSP: Continuous Monitoring Strategy Guide
- FedRAMP CSP: Continuous Monitoring Performance Management Guide
- FedRAMP CSP: Significant Change Policies and Procedures
- FedRAMP CSP: Incident Communications Procedures
- FedRAMP CSP: Annual Assessment Guidance
- FedRAMP CSP: Annual Assessment Controls Selection Worksheet
- FedRAMP FA: Package Request Form
- FedRAMP FA: Agency Authorization Playbook
- FedRAMP FA: Agency Authorization - Obtaining In-process Designation
- FedRAMP FA: Agency Authorization - Roles and Responsibilities
- FedRAMP FA: Agency Authorization - Best Practices for Agencies
- FedRAMP FA: Guide for Multi-Agency Continuous Monitoring
- FedRAMP FA: Agency Guide for Reuse of FedRAMP Authorizations
- FedRAMP FA: Acquisition Frequently Asked Questions
- FedRAMP FA: Control Specific Clauses
- FedRAMP FA: Cloud Procurement Best Practices
security
Cloud has extended enterprise security boundaries from a self-managed environment to an external and somewhat untrusted zone.
Security considerations for the cloud include strategies to protect capital assets, safe cloud deployment processes, and mechanisms to maintain regulatory requirements.
Cloud service providers need to enable policy-based service delivery to convince their clients they can effectively manage their confidential digital assets.
Client organizations should take a risk-based approach in analyzing security and privacy options, and deciding on placing critical business functions into a cloud.