Cloud Security Alliance
docx
keyboard_arrow_up
School
Maryville University *
*We aren’t endorsed by this school
Course
481
Subject
Information Systems
Date
Jun 10, 2024
Type
docx
Pages
7
Uploaded by MissRedDevil
Cloud Security Alliance
1
Cloud Security Alliance - Risks
Miranda Loukota
Department of Business, Maryville University
ISYS 481: Virtualization & Cloud Security
Professor Eric Kruse
14 April 2024
Cloud Security Alliance
2
Cloud Security Alliance - Risks
Cloud computing has transformed how companies handle and store their data, being a very useful tool that offers several advantages including scalability, flexibility, and cost-
effectiveness. On the other hand, since the advent of cloud computing services, the demand for a reliable security system has become more important than ever before. The Cloud Security Alliance's (CSA) "Security Guidance for Critical Areas of Focus in Cloud Computing v4.0" offers comprehensive guidelines for overcoming the security challenges emerging with cloud computing. In this paper, the areas of emphasis outlined in the CSA guidance will be discussed and the questions presented under each area will be analyzed in detail.
Continuous Cloud Computing Auditing
As per the advisory provided by the Cloud Security Alliance (CSA) regarding auditing in cloud computing, it is imperative to engage in ongoing audits rather than a singular, one-time evaluation (CSA, 2022, p. 59). The dynamic characteristic of cloud environments stems from the
potential for continuous alterations in infrastructure, configurations, and permissions. Unlike the traditional audit method which occurs annually, continuous auditing empowers the entity to promptly detect and rectify security vulnerabilities, thus diminishing the likelihood of data breaches and other security incidents. Consider, for example, the scenario where a cloud-based application regularly receives enhancements. Opting for a one-time audit could overlook the modifications brought about by updates, leading to potential security issues.
In contrast, employing continuous auditing methodology enables the organization to consistently monitor the security status of the application, facilitating timely identification and mitigation of security weaknesses. Additionally, the ever-evolving nature of the cloud landscape renders the perimeter constantly susceptible. Threat actors exploit new vulnerabilities or attempt
Cloud Security Alliance
3
unauthorized access to cloud resources. Continuous auditing plays a pivotal role in enabling organizations to proactively address these threats by routinely evaluating security measures, detecting anomalies, and implementing suitable safeguards.
Management Plane Security Requirements
The recent focus of the guidance is on the distinctive aspects of management plane security in cloud computing, which diverges significantly from that of traditional on-premise systems (CSA, 2022, p. 72-73). The management plane is related to the administrative access and tools used to manage and configure cloud resources, including virtual machines, storage, and
networking. In a traditional on-premise system, IT resource management typically remains within the physical boundaries of the organization, establishing a clearly defined network perimeter and security controls. In contrast to the shared nature of the cloud computing model where responsibility is divided between the cloud service provider (CSP) and the customer, the CSP is accountable for securing the underlying infrastructure, while the customer oversees data and application security (Alsmadi & Prybutok, 2018).
This liability shift introduces additional risk considerations. For instance, in cloud systems, the management plane is often accessible via the internet, leading to a significant expansion of the attack surface and potential unauthorized access. Likewise, cloud management interfaces may be utilized by various users such as cloud administrators, application developers, and third-party service providers, each with different levels of security access and privileges.
To mitigate these risks, organizations must implement suitable access controls, multi-
factor authentication, and regular monitoring of management plane activities.
Four Challenges
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
Cloud Security Alliance
4
The CSA guidance outlines four key challenges in cloud computing: a breach of data privacy, wide-open access to applications and user interfaces (APIs), common cloud vulnerabilities, and the misuse of cloud-based services (CSA, 2022, p. 108-110). Information divulging can take place in a situation where the captivating data is mishandled or illegally accessed by unauthorized people. This can happen if explorers do not set up their systems correctly, the access control is weak or the data has not been encrypted. To overcome this problem, organizations should put in place granular data classification policies and privileged access management, encrypt data at the data centers as well as while in transmission, and constantly check for suspicious activities or data leakage.
Non-secure interfaces and APIs can gives attackers a simple procedure of breaking into cloud resources, which may then be followed by finding unauthorized access, data manipulation, or service disruption. Companies should see to it that all cloud-based interfaces and APIs are completely secured, beginning with strict authentication protocols, input validation controls, and rate-limiting mechanisms. To highlight a shared risk - vulnerabilities in technical environments may come from the multitenant nature of cloud systems, where a platform's customers use the same underlying infrastructure and resources. It may make the whole system more vulnerable which bad actors may use to steal other customers' data or hack the entire system, creating a state
of vulnerability far and wide.
To minimize the risk, organizations should pay close attention to the security group updates provided by the CSP, and ensure that they are not running any compromised applications
that could create more security issues on their own. The exploitation of cloud rest ought to be referred as to the use of cloud resources in the sense that they might be used for the wrong (not
Cloud Security Alliance
5
legal) purposes like hacking systems or they can be involved in some DDoS attacks, or even they
can be used to mine crypto currencies and distribute malware.
Substantial Risks
The transition to a cloud-based business model which encompasses numerous significant risks primarily needs to be carefully considered and addressed. These risks can be classified as people, processes, and technology.
People-related risks
The primary risk in the form of a people-related crisis that emerges from the cloud-based
business model is the substantial requirement for specific skills and knowledge. The IT department's staff must possess the expertise to comprehend the functioning of the cloud and grasp the intricacies of cloud security, architecture, and operations (Dawoud et al., 2010). Insufficient or absent training may lead to inadvertent errors, cyber-attacks, and operational failures. Moreover, the shared responsibility model of cloud computing mandates that both the Cloud Service Provider and the customer have clearly defined roles and duties. Inadequacies in the enterprise's security teams may result from the ambiguity or misalignment of responsibilities,
potentially creating security vulnerabilities and compliance breaches.
Process-related risks
The virtual business model introduces novel methods of conducting business, necessitating the implementation of new processes and workflows that must be managed effectively. Hence, organizations should establish enhanced change management procedures that encompass all alterations in cloud configurations or applications, ensuring they are thoroughly tested and approved before implementation (CSA, 2022, p96). Additionally, public sector entities should devise and regularly assess their cloud governance and compliance guidelines,
Cloud Security Alliance
6
taking into account industry regulations, data protection laws, and expertise in general security practices.
Technology-related risks
The cloud-based business model heavily relies on technology, thereby posing significant risks related to the technical infrastructure. These vulnerabilities encompass cloud infrastructures, software providers, third-party integrations, as well as threats such as data breaches, service disruptions, and vendor lock-ins. Organizations must scrutinize the security measures and capabilities of their cloud service provider, ensuring that the applications intended for cloud deployment are secure, along with maintaining secure cloud configurations. Moreover, continuous security monitoring and incident response plans should be implemented to identify and mitigate all technology-related risks (Choudhary & Singh, 2021)
Conclusion
The document offers a thorough set of recommendations for addressing security issues in cloud computing. This paper presents analysis of the key suggestions outlined in the CAS report and responds to the specific inquiries raised. The continuous process of auditing within cloud computing, the critical need for immediate security management, the challenging issue of data leakage, vulnerabilities in interfaces and APIs, exposed technological weaknesses, and the misuse of cloud services, alongside the significant risks associated with the cloud-based business
model, were thoroughly examined. A prudent strategy to mitigate security vulnerabilities in cloud-based systems is to adopt a holistic approach that encompasses individuals, procedures, and technology. Understanding and addressing these focal points empower enterprises to leverage cloud computing while maintaining a robust security stance and safeguarding their assets.
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
Cloud Security Alliance
7
References Alsmadi, D., & Prybutok, V. (2018). Sharing and storage behavior via cloud computing: Security
and privacy in research and practice. Computers in Human Behavior, 85, 218-226.
Choudhary, S., & Singh, N. (2021, November 5). Analysis of Security-Based Access Control
Models for Cloud Computing. International Journal of Cloud Applications and
Computing, 12(1), 1–19.
Cloud Security Alliance. (2022). Security Guidance for Critical Areas of Focus in Cloud
Computing V4.0. https://cloudsecurityalliance.org/research/guidance/
Dawoud, Wesam & Takouna, Ibrahim & Meinel, Christoph. (2010). Infrastructure as a service
security: Challenges and solutions. 1 - 8.