Defined Categories of Service 2011 - Cloud Security Alliance

CLOUD SECURITY ALLIANCE SecaaS | DEFINED CATEGORIES OF SERVICE 2011
Category #5: Security Assessment
Description: Security assessments are third-party audits of cloud services or assessments of onpremises
systems via cloud-provided solutions based on industry standards.
Traditional security assessments for infrastructure and applications and compliance audits are
well defined and supported by multiple standards such as NIST, ISO, and CIS. A relatively
mature toolset exists, and a number of tools have been implemented using the SaaS delivery
model. In the SaaS delivery model, subscribers get the typical benefits of this cloud computing
variant - elasticity, negligible setup time, low administration overhead, and pay-per-use with
low initial investments.
While not the focus of this effort, additional challenges arise when these tools are used to audit
cloud environments. Multiple organizations, including the CSA, have been working on the
guidelines to help organizations understand the additional challenges:
• Virtualization awareness of the tool, frequently necessary for IaaS platform auditing
• Support for common web frameworks in PaaS applications
• Compliance Controls for IaaS, PaaS, and SaaS platforms
• Standardized questionnaires for XaaS environments, that help address:
o What should be tested in a cloud environment?
o How does one assure data isolation in a multi-tenant environment?
o What should appear in a typical infrastructure vulnerability report? Is it
acceptable to use results provided by cloud provider?
Class: Detective
CORE FUNCTIONALITIES
Governance — process by which policies are set and decision
making is executed
Risk Management — process for ensuring that important
business processes and behaviors remain within the
tolerances associated with those policies and decisions
Compliance — process of adherence to policies and decisions.
Policies can be derived from internal directives, procedures
and requirements, or external laws, regulations, standards
and agreements.
Technical Compliance Audits - automated auditing of
configuration settings in devices, operating systems,
databases, and applications.
Application Security Assessments - automated auditing of
custom applications
Vulnerability Assessments - automated probing of network
devices, computers and applications for known
vulnerabilities and configuration issues
Penetration Testing - exploitation of vulnerabilities and
configuration issues to gain access to a an environment,
network or computer, typically requiring manual assistance
Security / risk rating - assessment of the overall security /
vulnerability of the systems being tested, e.g. based on the
OWASP Risk Rating Methodology
SERVICES
Includes: Internal and / or external
penetration test, Application
penetration test, Host and guest
assessments, Firewall / IPS (security
components of the infrastructure)
assessments, Virtual infrastructure
assessment
Related Services: Intrusion
Management
Related Technologies and Standards:
SCAP (FDCC), CVSS, CVE, CWE,
SCAP, CYBEX
Service Model: SaaS, PaaS, IaaS
CSA Domains (v2.1): 2, 4
Continued on the following page…
Copyright © 2011 Cloud Security Alliance 16