There are a number of different ways we can evaluate cloud providers.
We can perform various types of audits,
either as an external group or as the consumer.
Many cloud service providers have audits done by external groups
that they can use to show the fact that they followed good
practice, for example. In many cases,
the purpose of an audit is to provide an independent
assessment of the cloud provider.
We don't necessarily trust if an organization has just done a self‑assessment.
Instead,
we have a reputable firm using a template or some type of standard
to measure against in order to ensure that the cloud provider is
adhering to good practice. We have, for example,
from the Cloud Security Alliance STAR, we have things like the SSAE 18 or
today, usually, the SSAE 20. We have the ISAE 3402,
which is the international equivalent of the SSAE series put out
by the AICPA. In the US Federal Government,
we have a criteria that is then listed under FISMA.
The STAR process put forward by the Cloud Security Alliance
stands for security, trust, assurance, and risk.
It allows us to take a look at what are good practice for a cloud
provider as listed in the Cloud Controls Matrix,
the CCM, and the General Data Protection Regulations would look at privacy.
So the CSA STAR process allows us to compare and to ensure
that a cloud provider is adhering to all of the practices
listed in these documents.
One way to ensure that something didn't get missed is to use
something like the Cloud Controls Matrix.
There are three different levels of STAR certification. Level one is
where the cloud service provider performs their own self‑assessment, and
we all know how valid that may or may not be.
When we take a look at level two,
we see third‑party audits conducted by a reputable independent and
hopefully objective organization that reviews the cloud service provider to
see whether or not they are following the good, trusted security principles
they should be following. A level three is where we're doing this type of
review on a continuous basis.
There is continuous auditing being done.
The idea of continuous audit is to ensure that an organization
is not just compliant at the day of a review,
but if we looked at them at any time, we would find
that they are following good practice.
This can be done through things like a Consensus
Assessment Initiative Questionnaire, CAIQ.
In the case of a self‑assessment,
this is done every 30 days for level one. The American Institute of Certified
Professional Accountants, the AICPA, put out a number of documents over the
years with standards and audit engagements, and these started with a SAS 70,
which then evolved in the SSAE 16,
18, and now the current one is SSAE 20. It gets updated every couple of
years, and so this was implemented in the end of 2021.
The idea is that with each implementation we improve from
what we learned from the earlier documents.
The SSAE stands for the Statement on Standards for Attestation Engagements.
So if I have an engagement to do an attestation or review of an organization,
what are the standards that we should measure against?
An audit should never be measured against a person's opinion.
Instead, it should be measured against a reputable and recognized standard.
It is put out, as we said, by the AICPA and updated on a regular basis.
The main part of this is SOC, the System and Organization Controls report that
is generated once the SSAE evaluation has been completed.
If we took a look at an SSAE 20 SOC 1, that is a review of the
financial reporting of the organization, very similar to what we
used to see with the SAS 70, for example.
So we know with some level of assurance whether or not the financial
records of that cloud service provider are accurate.
Are they in any way fictitious? Have they tried to hide something?
We want to make sure that before we go to a cloud provider that they're not
going to fall into bankruptcy a couple of days later. When we do a SOC 2,
we're doing an evaluation of that cloud service provider based on several
different principles, WebTrust and SysTrust. Here is where we look at the
areas of security and does the cloud service provider have a good security
program and are they implementing what are commonly recognized as acceptable
security practices?
We review their implementation of privacy and how they are then
compliant with things like privacy regulations.
We look at the integrity of their processes.
We look at how they protect confidentiality.
And of course,
because a cloud provider is a critical part of our supply
chain, we need to ensure that they have processes in place
to ensure availability as well.
We don't want to have all of our business reliant on a cloud
provider and have a cut network cable or equipment failure that
means none of my systems will actually work.
The problem with a SOC 2 is the SOC 2 is a very detailed
report primarily meant for internal use because it says
what all of the problems are.
So most organizations will instead give you a summary
report, which is known as a SOC 3. Really,
it's just the summary of the SOC 2, but without all of the embarrassing
details of the things that the organization has to work on.
Now there are a number of organizations out there that will
actually provide their SOC 2 for you.
They want to be transparent.
They want to earn your trust.
So therefore, they'll say,
look, here you go. You can see what we're working on and
has been brought to our attention.
The idea of the SOC 3 is that it allows us to do marketing and show
that we've paid attention to good security principles.
We've had a review of our financial and, of course,
WebTrust and SysTrust security.
We've ensured that we're following the good practices of the Cloud
Controls Matrix, and therefore, you can trust us with your data
and data processing. When we conduct an SSAE 20 assessment, there
are two ways we can do it.
We can do what's called a Type 1 assessment where we
conducted the assessment as of a date, as of a point in time.
But many organizations today will instead want to see a Type 2.
A Type 2 is a review that's done over a period of time, usually six months.
But many organizations today are actually then using this
in a type of continuous audit process.
The idea being that if I've reviewed an
organization over a six‑month time period,
then the things they are doing are probably being done out of habit,
not just in order to pass the day of the assessment.
So a Type 2 costs more, but also would provide a higher level of assurance.
Another way we can review whether or not the cloud service provider is
following good practice is to see whether or not they are compliant with
the international standard such as 27001.
We review whether or not they have managed to ensure they've addressed all
of the main security concerns that were listed in 27001.
27001 is really the flagship standard of the 27000 series.
27000 itself is a glossary of terms and a free document we can use to
make sure we're all speaking the same language.
But 27001 is a standard we can be measured against.
It defines the standards for an information security management system.
Another type of evaluation that's often done is according
to the Uptime Institute. The Uptime Institute looks at
things such as data center design, construction, and ongoing operations.
It is there to try to ensure high availability of my cloud
service provider if that's what I want.
So, it evaluates the data center's infrastructure,
things like backup power, for example,
so that I can ensure that I am getting the level of availability I
need, but, of course, I don't want either to be paying for services
that we maybe didn't require either.
A tier 4 data center, as evaluated by the Uptime Institute, is one
in which we can have a very high level of trust.
There are a number of other certification standards we can use as
well. In the US Federal Government, we have FISMA,
the Federal Information Security Management Act.
We have PCI‑DSS from the Payment Card Industry,
the Data Security Standard. And we have others such as the ISO
standard 15408, better known as the common criteria,
which is the basis for evaluation of the security properties of IT products.
So we have things like ISO 15408 that look at the security of a product.
We'll look at 27001, which will look at the security of an organization.
So the idea being that if I build my security with good
products, then of course, I can hopefully also have assurance
in the security of the organization.
Another product evaluation criteria that's often used is
the Federal Information Processing Standard 140‑2, the
evaluation of crypto devices.
If I'm going to use a device that handles, for example, chip and PIN with
a credit card transaction or I'm going to handle any type of encryption
service that's built into, say, hardware, we want to evaluate it to make
sure that that cryptography and the cryptographic functions were
implemented in a secure way.
So the FIPS140‑2 was the improvement on 140‑1, and it is used
by organizations all over the world today.
We also do see, of course, that many organizations are already moving
towards the implementation of an even higher standard, 140‑3.
In summary, this course provided an overview of cloud‑based services.
It highlighted some of the security concerns that we have to look at as
we move through the rest of this course and look at the adoption of the
cloud. As a cloud security professional, we must ensure that security
and business requirements are addressed in cloud migrations and
implementations.