Let's go through the details of specific attestation and
certification capabilities that are in the cloud.
One way that you could verify that the cloud service provider has the
capabilities that you need from a security perspective is to use what's
called the Cloud Security Alliance's Security,
Trust, Assurance, and Risk Registry.
This provides a way to evaluate cloud service providers where a given provider
will have assessments and certifications that provide differing levels of
assurance about the cloud controls that they maintain.
The first level is called CSA STAR Level 1.
This is where the cloud service provider has provided a CAIQ,
or a Consensus Assessment Initiative Questionnaire,
to achieve self‑assessment of a point in time.
They could also be focusing particularly on GDPR standard,
again, from a self‑assessment perspective.
What's contained in this?
Well, the self assessments are voluntary,
free,
and an open platform for any cloud provider to participate by
submitting their own compliance to industry standard security
practices based upon their IaaS, PaaS, or SaaS provisioning.
In doing so,
they address some of the most urgent and important security
questions that buyers of cloud services need to have.
Now,
the cake that we mentioned earlier provides industry accepted ways to
document what security controls exist in their IaaS,
PaaS, or SaaS offerings.
The questionnaire provides a set of 295 questions a cloud
consumer and cloud auditor may ask a cloud provider,
and providers may opt to submit a completed CAIQ inside of the STAR registry.
Now,
the Cloud Controls Matrix upon which the CAIQ is actually based
provides a control framework that details understanding of security
concepts and principles aligned with the CSA's guidance featuring 17
large‑scale domains and having 197 detailed controls that are child
objects of those domains.
When you look at the Cloud Controls Matrix version 4,
the left‑hand column of this best use of an Excel spreadsheet
I've seen would be the enumeration of controls.
As you go across the rows,
what you come in contact with are the actual frameworks
that are matrixed to the controls.
Here's an example of what a cloud service provider
could have based off of STAR Level 1.
You see that they have their Consensus Assessment Initiative Questionnaire,
which you could download.
If you do STAR Level 1 and you add the Trusted Cloud Provider trust mark,
this demonstrates a commitment to organizational security by that organization
volunteering regularly for Cloud Security Alliance and having at least one
staff member who has earned their CCSK certification.
STAR Level 2 would include a third‑party attestation, or certification, or both.
With the certification,
we're focusing on the third‑party assessment that's
tied to ISO 27001 as its standard.
This independent assessment by an accredited Cloud Security Alliance
certified body will assign a management capability score to each of the
Cloud Control Security domains that are there,
along with an optimal level of maturity.
This helps to evaluate the effectiveness of a cloud service
provider's information security management system.
With the CSA STAR certification foundation,
this is going to be based upon the conformity assessment requirements
of ISO for bodies providing auditive certification,
for requirements for bodies providing audit and certification
of information security management systems,
and for guidelines for auditing management systems.
These three types of certifications.
An attestation is going to be an independent third‑party
assessment of a cloud service provider's security.
This will be based upon what we previously described,
the SOC 2 type 1 or type 2, the type 1 being the design,
the type 2 being the operational effectiveness of that design,
which could include testing of the controls.
So this is what it would look like if you had a CSA
STAR Level 2 cloud service provider.
Not only would they have their CAIQ filled out,
but they would have an attestation or a certification,
or in the case of Dropbox, they actually have both.
Let's take a closer look at each of these.
So this is downloaded from Dropbox.
You see that the attestation,
even though it's carrying out a service organization control audit,
it's actually going to use the framing that's based upon the ISO standards.
The Cloud Controlertification that's given is
precisely related to the ISO standards.
This is also downloaded from Dropbox.
Both their attestation and the certification is what we're able to see publicly.