Download - Cloud Security Alliance

CLOUD SECURITY ALLIANCE SecaaS Implementation Guidance, Category 6: Intrusion Management3.0 Considerations and Concerns3.1 ConsiderationsAs a consumer of IM SecaaS, identify that interfaces or mechanisms are available to get events into and out ofthe service, as well as how reporting will be done. Providers will need to identify and document all the differentways that they support getting data into their service.If the IM SecaaS already has the consumer’s cloud providers as an integration point, this could significantlyincrease the speed of deployment and likelihood of success.3.1.1 Service Level Agreement LanguageFor the Service Level Agreement (SLA), the consumer needs to ensure that the terms in the SLA are consistentwith, and meet the requirements of, its information security policy (and likely its Incident Response Policy), aswell as any operational requirements that have been defined. Currently, the language in most SLA contracts isvery favorable to the provider, and consumers should require that IM providers have ways to meet theirbusiness requirements; they should not change their business requirements to meet what the IM provider candeliver. The consumer should ensure the following items are covered in the SLA, at a minimum:Performance requirementsBandwidth requirementsDetection and protection requirementsPacket management responsibilitiesIM SecaaS providers should have the ability to enter into custom SLAs that are achievable for them. They shouldnot expect all clients to fit a cookie cutter approach.3.1.2 Financial ConsiderationsCost of “bandwidth” for getting events into the IM SecaaS should not be overlooked and could be considerable,depending on the sources of information that are included.3.1.3 Technical ConsiderationsAre the events/alerts that are sent from IM SecaaS to consumer sent in a standard format? Is theformat proprietary? Consider if vendor lock-in could be a concern.What about short lived instances? Host Intrusion Detections System (HIDS) and Host IntrusionPrevention System (HIPS) logs can be lost.3.1.4 Architecture Considerations© Copyright 2012, Cloud Security Alliance. All rights reserved. 15