In the current times of the digital revolution, businesses are relying on cloud computing to store and access their valuable data. Although Cloud computing offers a myriad of benefits, including scalability, cost-efficiency, and enhanced collaboration, ensuring data security should be a paramount concern. Hence cloud provider security assessment is very important.
When entrusting your sensitive information to a cloud provider, conducting a thorough security assessment becomes crucial. This process involves assessing the measures and protocols that the cloud provider has in place to safeguard data against potential threats and breaches as well as implementing cloud access control to allow access to only authorised employees or the management.
The business (referred to as the “tenant”) and the Cloud Service Provider, including their subcontractors (referred to as the “CSP”), are both responsible for mitigating the risks related to adopting cloud services. Organisations, however, are ultimately in charge of safeguarding their data and guaranteeing its availability, confidentiality, and integrity.
We have discussed infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS), all of which are offered by a cloud service provider (CSP) as a component of a public cloud, community cloud, and, to a lesser extent, a hybrid cloud or outsourced private cloud.
In the context of Commonwealth entities and this publication, “sensitive data” is defined as “OFFICIAL”: Sensitive. PROTECTED data is described as data that is very sensitive.
This article explores the importance of cloud provider security assessment and highlights the essential factors to consider when evaluating a potential cloud partner.
Additionally, this blog can help to reduce risks to non-sensitive data availability and integrity, which is what Commonwealth organisations identify as unclassified publicly releasable data. The list of mitigations is however not prioritised in any specific order.
Importance of Cloud Assessment
Consumers can benefit from a variety of cyber security advantages provided by cloud computing, including cutting-edge technology, shared responsibilities, access management, monitoring, and geographically scattered cloud services.
However, it also comes with dangers including multi-tenancy structures, poor visibility, and outside influence.
To reduce management and supervision, cloud computing involves outsourcing information technology skills to a Cloud Service Provider (CSP).
To protect the cloud, users must fulfil their security obligations, and good management can reduce the risk of cyber events.
Identifying and comprehending the risks associated with adopting a CSP and its cloud services is one barrier to adoption.
This blog instructs CSPs, cloud users, and IRAP assessors on conducting a thorough evaluation of a CSP and its cloud services to make defensible conclusions regarding their appropriateness for data storage, processing, and transmission.
Importance of Risk Assessment
Before utilising cloud services, organisations need to do a risk assessment and put into place any necessary mitigations.
The various variables that affect risk are:
- The sensitivity and criticality of the data to be stored or processed.
- The implementation and management of the cloud service.
- The intended use of the cloud service by the organisation.
- The difficulties in performing prompt incident detection and response by the organisation.
Organisations should weigh these hazards against an unbiased risk assessment of employing internal computer systems, which might be inadequately available, poorly protected, or insufficient to satisfy contemporary business requirements.
Effective Risk Mitigations For Various Cloud Services
Below given are the mitigation strategies:
a) Failure to Maintain Confidentiality, Integrity and Availability of Tenant’s Data
1) Examine Cloud Service and Supporting Infrastructure
Examine the cloud service and supporting infrastructure against the ISM (Information Security Manual) at the appropriate categorisation level necessary to handle the tenant’s data (explicitly addressing mitigations in this publication).
2) Implement Security Governance
Implement security governance that includes technical people performing defined security responsibilities, strong change management, and senior management leading and coordinating security-related operations.
3) Cyber Incident Response Plan
Establish and assess a cyber incident response plan that gives tenants access to forensic evidence they would not typically have access to as well as contractual notice of issues.
b) Tenant’s Data hacked by Malicious third-party during Transit
1) Use Australian Signals Directorate (ASD) Approved Cryptographic Controls between Tenant and CSP
Support and use application layer TLS (Transport Layer Security) or IPsec (Internet Protocol Security) VPN with authorised methods, key length, and key management to safeguard data in transit between the tenant and the CSP (Cloud Service Provider).
2) Use ASD Approved Cryptographic Controls between CSP and Public Internet Infrastructure
Use cryptographic protections certified by ASD to safeguard data while it is being transferred between the CSP’s data centres through insecure communication channels, such as open internet infrastructure.
3) Utilise ASD-Approved Cryptographic Controls
When transferring data as part of on-boarding or off-boarding, support and utilise ASD-approved cryptographic procedures to safeguard data at rest on storage media while it is in transit between the tenant and the CSP through mail or courier.
c) Credentials of Tenant’s Cloud Service account compromised by Malicious Third-party
1) Give Identity and Access Management
Allow the tenant to utilise and manage the cloud service via the CSP’s online control panel and API by providing Identity and Access Management, such as multi-factor authentication and account roles with various rights.
2) Use ASD-approved Cryptographic Controls to Protect Credentials and Administrative activity in Transit
When the tenant accesses and manages the cloud service via the CSP’s website control panel and API, ASD-approved cryptographic measures should be used to safeguard passwords and administrative activities in transit.
3) Detailed time-synchronised Logs and Real-time Alerts
Ensure that the tenant’s cloud service accounts are used to access, and especially to administer, the cloud service may get real-time alerts and detailed time-synchronized logs that are created.
d) Tenant’s Data Hacked by Malicious CSP staff or Third-Party
1) Download Detailed Time-synchronised Logs and Real-time Alerts
Give the tenant the option to download comprehensive time-synchronized logs and get real-time warnings from the cloud service they are using, such as operating system, web server, and application logs.
2) Disclose Countries and Legal Jurisdictions
Identify the nations and legal jurisdictions where tenant data is stored, backed up, processed, and accessible by CSP employees for troubleshooting, remote administration, and customer support (or will be in the upcoming months).
3) Perform Background Checks of CSP staff
Undertake background checks on CSP employees based on how much access they have to systems and data. Keep security clearances current for employees who have access to extremely sensitive data.
4) Use Physically Secure Data Centres and Offices
Utilise physically secure data storage facilities and offices that have access to or can access tenant data. Verify and document each employee’s and visitor’s identification. Visitors should be escorted to prevent unauthorised access to information.
5) Restrict CSP Staff’s Privileged Access
Based on their assigned duties, limit CSP employees’ access to systems and data [9]. Require CSP employees who need privileged access to reapply every three months. Restrict access when a CSP staff member leaves their position.
6) Promptly Analyse Logs of CSP Staff Actions
Analyse the logs of CSP employee activities as soon as possible. These records are kept on a secure, separate log server. Implement separation of tasks by mandating that CSP employees with no other responsibilities or rights undertake log analysis.
7) Perform a Due Diligence Review of Suppliers
Before purchasing software, hardware, or services, conduct a due diligence investigation of the providers to see whether the CSP’s security risk profile may have increased.
8) Use ASD-approved Cryptographic Controls
Protect extremely sensitive data at rest by using cryptographic measures that have been certified by ASD. Prior to repair, disposal, and tenant eviction, sanitise storage media and secure remaining backup data with a non-disclosure agreement.
e) Tenant’s Data Compromised by Another Malicious/Compromised Tenant
Use multi-tenancy methods to stop other tenants from accessing the tenant’s data. Separate computer processing, memory, storage, and the network. Before reusing the storage medium, clean it.
f) Tenant’s Data Unavailable due to Corruption, Deletion, or CSP terminating Account/Service
Give the tenant the ability to do current backups in a manner that prevents CSP lock-in. Provide the tenant with at least a month’s notice before terminating an account or cloud service so they have time to retrieve their data.
g) Tenant’s Data Unavailable or Compromised due to CSP Bankruptcy or Legal action
Ensure legally that the renter will continue to own their data through a contract.
h) Cloud Service Unavailable due to CSP’s inadequate Network Connectivity
Support a sufficient amount of stated high bandwidth, low latency, and dependable network connectivity between the tenant and the cloud service to fulfil the tenant’s needs for availability.
i) Cloud Service Unavailable due to CSP Error, Planned Outage, Failed Hardware or Natural Calamity
1) Architect Should meet Tenant’s Requirements
The stated degree of availability must be met by the architect in order to satisfy the tenant’s requirements, such as minimising single points of failure, load balancing and clustering, data replication, automatic failover, and real-time availability monitoring.
2) Develop, Test Disaster Recovery and Business Continuity Plan
Create and test a disaster recovery and business continuity plan every year to fulfil the tenant’s demands for the claimed degree of availability, such as when it’s implemented for events that result in the permanent loss of CSP personnel or infrastructure.
j) Cloud Service Unavailable due to Spike in Demand or Bandwidth/CPU Denial of Service
1) Implement Denial of Service Mitigations
Use denial of service mitigations, such as redundant high bandwidth external and internal network connectivity with traffic limiting and filtering, to fulfil the tenant’s needed degree of availability.
2) Provide Infrastructure Capacity and Responsive Automated Scaling
As requested by the tenant, provide infrastructure capacity and responsive automatic scaling to fulfil the declared level of availability.
k) Financial Consequences of Spike in Demand or Bandwidth/CPU Denial of Service
Enable Tenant to Manage of Cost of Spike
Provide the tenant with contractual expenditure caps, real-time notifications, and programmable maximum limitations for their usage of the CSP’s infrastructure capacity so that they may control the expense of a legitimate demand spike or denial of service.
l) CSP’s Infrastructure Compromised by Malicious Tenants or Third-party
1) Use Corporately Approved, Secured Computers and Other Devices
To administrate cloud services and infrastructure and provide customer support, use corporately approved and secured PCs, jump servers, dedicated accounts, strong passphrases, and multi-factor authentication.
2) Use ASD-approved Cryptographic Controls to protect Credentials and Administrative activity in Transit
Protect credentials and administrative activities while they are being sent through insecure communication routes between the CSP administrator and customer support employees and the CSP data centre by using cryptographic measures recognised by ASD.
3) Implement Network Segmentation and Segregation
Use network segmentation and segregation to separate the internet, the CSP infrastructure used by tenants, the network the CSP uses to manage cloud services and infrastructure, and the CSP’s corporate LAN.
4) Utilise Secure Programming Practices
Apply secure programming techniques to CSP-created applications.
5) Perform Secure Configuration
Configure cloud services and underlying infrastructure securely, manage vulnerabilities continuously, patch quickly, do yearly third-party security assessments, and perform penetration testing.
6) Train CSP Staff
All CSP employees, especially administrators, should get yearly and initial training on how to safeguard tenant data, maintain cloud service availability, and proactively spot security problems, such as through rapid log analysis.
Most Effective Risk Mitigations For IaaS
Virtual Machine (VM) of the Tenant infiltrated by a malicious third party
1) Provide network access controls that will allow the tenant to partition and segregate the network, as well as network filtering capabilities to prevent remote administration of their VMs from any source other than their IP address.
2) Give the tenant VM template images that have been patched and securely configured. Do not provide freshly provisioned VMs with a weak administrator passphrase.
Most Effective Risk Mitigations For PaaS
Malicious Third-party has compromised Tenant’s data
Harden and secure the platform, web server, and operating system software. Ensure that only the necessary ports and protocols are used for incoming and outbound network communication. Conduct log analysis and patching right away.
Most Effective Risk Mitigations Particularly Relevant to SaaS
Tenant’s Data Compromised by Malicious Third-party
1) Implement controls unique to the cloud service, such as content screening and automatic dynamic analysis of emails and email attachments for email provided as a service.
2) Implement broad measures such as limiting inbound and outbound network access to just necessary ports and protocols, daily updating of antivirus software, intrusion prevention systems, and timely log analysis.
Anitech’s experienced consultants can help organisations understand and manage third-party risks in Cloud Provider’s security.
Do call us at– 1300 802 163 or e-mail – sales@anitechgroup.com for further information.
Recent Comments