From the course: Cybersecurity with Cloud Computing

Cloud security guidance

From the course: Cybersecurity with Cloud Computing

Start my 1-month free trial

Cloud security guidance

“

- [Instructor] Before we get into the details of cloud and its cyber security, let's visit some key reference sites. The Cloud Security Alliance, or CSA, has emerged as the leading organization for cloud guidance. It's a recognized source of practitioner certification, with its certificate of cloud security knowledge. And is a source of guidance on security as a service. The CCSK is an examination for a broad knowledge across a number of areas in cloud security which are considered to be critical to the successful adoption of cloud. Version four of the CSA guidance covers 14 domains, or areas of study. The first domain covers the architecture of clouds systems, providing a consistent terminology for cloud. The essential characteristics of the three primary cloud service offerings: Infrastructure, platform, and software. And the deployment options for private, public, and hybrid clouds. The next four domains cover governance and enterprise risk, legal and electronic discovery, and compliance and audits. Domains six, seven, nine, 10, 11, and 12 cover the traditional areas of security. Business continuity, infrastructure security, incident response, application security, data security, and identity and access management. Domain eight covers the fundamental technology for cloud: virtualization. And domain 14 covers related technologies. Domain 13 is dedicated to security as a service. And this is a special domain which discusses the particular challenge of delivery security as a cloud service. Together, these domains form the framework for this course. Let's now look at the website of the European Network and Information Security Agency, ENISA, which has been active in developing European Union perspectives on cloud security. Some key ENISA publications can be seen here. While a little dated now, the ENISA Cloud Computing Information Assurance Framework provides useful guidance on assessing cloud service providers. It covers 10 areas of assurance. Personnel security, supply chain assurance, operational security, identity and access management, asset management, data and services portability, business continuity management, physical security, environmental controls, and legal requirements. The assurance framework is presented as a series of questions to be answered by the service provider. To verify the existence of a baseline of common controls. Such as, are credentials provisioned and deprovisioned simultaneously throughout the cloud system or are there any risks in deprovisioning them across multiple geographically distributed locations? The final reference site I'll visit is the National Institute of Standards and Technology's cloud computing and virtualization zone. This site provides three main sets of links: NIST cloud computing news and updates, NIST projects and programs related to cloud, and cloud publications.

Contents