Editor’s note: this piece has been updated in August 2021 with fresh information. It was originally published in August, 2020.
For those who thought data security was hard when business was primarily on-site—welcome to a new age of complexity. Today’s business is mobile with data stored everywhere in the cloud. Most businesses are using services from one or more Infrastructure as a service (IAAS) providers: AWS, Azure Cloud, or Google Cloud Platforms. However, one thing hasn’t changed: customers are still demanding that organizations keep their data safe. Failure isn’t an option, and non-compliance with today’s strict regulations brings stiff penalties and, most importantly, the loss of customer trust, something no business can afford.
In this article we will examine the key components of cloud compliance frameworks, introduce examples, and explain why aligning your data security policies and procedures to these compliance frameworks is critical for organizations looking to protect data and maintain customer trust in a mobile world.
Challenges around securing data in the cloud
Cloud storage and SaaS solutions bring unprecedented speed, agility, and flexibility to a business. However, trusting third-party vendors with sensitive data comes with numerous inherent risks. Here are some challenges to consider when securing your data in the cloud:
- Insecure access points can increase the likelihood of breaches.
- Cloud services introduce multiple changes to traditional identity and access management (IAM) practices.
- Trusting a vendor with your sensitive data makes you reliant on their security practices.
- Your data becomes more vulnerable to natural disasters, DDoS attacks, and hijacking.
- There is a lack of visibility and control of your data (e.g., Are activities/changes in cloud-based systems logged?)
Cloud deployments deliver accessibility, but they also create open, decentralized networks with increased vulnerability. This is where cloud compliance frameworks come in. Modern enterprises need the holistic guidance and structure provided by these frameworks to keep data safe in today’s dispersed business landscape.
What is cloud compliance?
Cloud compliance is the principle that cloud-delivered systems need to be compliant with the standards their customers require. Your customers may have to comply with many regulations around data protection, such as HIPAA, PCI DSS, GDPR, ISO/IEC 27001, NIST, SOX, and more. Cloud compliance is about ensuring that cloud computing services meet compliance requirements.
Why is cloud compliance important?
Yes, data can be lost in the cloud.
You’ve likely already heard about a variety of cloud security incidents. For instance, the cloud “master keys” exposed at Accenture. Over one million voter records were exposed on an Amazon S3 bucket in the RoboCent incident. ISP Pocket iNet left 73 gigabytes of critical data exposed on a misconfigured Amazon S3 storage bucket. Many of these incidents arise out of a badly implemented cloud compliance policy.
Although IAAS like AWS and Azure maintain certain security measures and a compliant posture, when you use public cloud computing services through the likes of AWS, Azure or Google Cloud, the items you create and deploy are not automatically secure or compliant. That means that the data centers and hardware that run AWS are secure, but for example, when you create a virtual machine you must configure and enforce compliance controls yourself. This is referred to as the Shared Responsibility Model. The best example is that a car you buy is considered safe and compliant with manufacturing standards, but how you (or your teenage child) drive and operate the car is up to you and your responsibility.
As such, it is important for each organization to develop its own cloud compliance approach that takes a cloud security-first approach.
When an organization understands the inherent security risks they are exposed to through the use of cloud services, develops policies and processes to manage these risks, and, most importantly, follows through on these policies and processes, they can have higher confidence in their security posture.
Cloud security experts have identified key control categories to mitigate the inherent risk of using cloud services. These are formalized through frameworks such as the Cloud Security Alliance Cloud Controls Matrix (CCM).
Key components of a cloud compliance framework
Below are the components compliance frameworks utilize to drive a higher level of security in the cloud.
Governance
These preset controls protect your sensitive data from dangerous public exposure. The following are essential areas of cloud governance:
- Asset management involves organizations taking stock of all cloud services and data contained, then defining all configurations to prevent vulnerability.
- Cloud strategy and architecture includes characterizing cloud structure, ownership, and responsibilities in addition to integrating cloud security.
- Financial controls address a process for authorizing cloud service purchases and balancing cloud usage with cost-efficiency.
Change control
Two of the cloud’s biggest advantages, speed and flexibility, make controlling change more difficult. Inadequate change control often results in problematic misconfigurations in the cloud. Organizations should consider leveraging automation to continuously check configurations for issues and ensure successful change processes.
Identity and access management (IAM) controls often experience multiple changes in the cloud. Below are a few IAM best practices to keep in mind for your cloud environment:
- Continuously monitor root accounts, as they can allow dangerous unrestricted access. Disable them if possible or, at the very least, monitor them with filters and alarms and require multi-factor authentication (MFA) for access.
- Utilize role-based access and group level privileges, granting access based on business needs and the least privilege principle.
- Disable dormant accounts and institutionalize effective credential and key management policies.
Continuous monitoring
The complexity and dispersed nature of the cloud make monitoring and logging all activity extremely important. Capturing the who, what, when, where, and how of events keeps organizations audit-ready and is the backbone of compliance verification. When monitoring and logging data in your cloud environment, it’s essential to:
- Remember to enable logging all cloud resources
- Protect logs with encryption and don’t hold in public-facing storage
- Define your metrics and alarms, and then meticulously record all activity
Vulnerability management
Effectively managing vulnerability starts with a comprehensive knowledge of your environments and identifying potential risks. Smart organizations analyze all software for known weaknesses and watch for the introduction of third-party entities with potential vulnerabilities. Identifying and remediating vulnerabilities is central to any security platform and plays a major role in meeting regulatory requirements.
Reporting
Reporting provides current and historical proof of compliance. Think of these reports as your compliance footprint and very handy come audit time. A complete timeline of all events before and after an incident can provide critical evidence should your compliance ever be questioned. How long you’re required to keep these records depends on the individual regulation requirement—some want only a month or two, while others require much longer. Your team must keep all files in a secure, independent location in the event of an on-site system crash or natural disaster.
Related Article: Get Help with AWS Security & Compliance
Common cloud compliance frameworks
These frameworks speak specifically to cloud compliance requirements. Both cloud vendors and customers should be well versed on the specifics of these three frameworks.
Cloud Security Alliance Controls Matrix: This foundational grouping of security controls, created by the Cloud Security Alliance, provides a basic guideline for security vendors, boosting the strength of security control environments and simplifying audits. Additionally, this framework helps potential customers appraise the risk posture of prospective cloud vendors.
The Cloud Security Alliance has developed a certification program called STAR. The value-added CSA STAR certification verifies an above and beyond cloud security stance that carries weight with customers. This overachiever’s set of standards may be the best asset for customers looking to assess a vendor’s commitment to security, and a must for all organizations looking to cement customer trust. Further, The STAR registry documents the security and privacy controls provided by popular cloud computing offerings, so cloud customers can assess their security providers to make good purchasing decisions.
FedRAMP: Meeting this set of cloud-specific data security regulations is a must for organizations looking to do business with any Federal agency. FedRAMP’s purpose is to ensure all cloud deployments used by the Federal government have the minimum level of required protection for data and applications. Be prepared—becoming FedRAMP compliant can be a long, detailed, and exhaustive process even for well-staffed organizations. A System Security Plan documenting controls must be submitted to the Joint Authorization Board (JAB), followed by an assessment and authorization. Organizations must then demonstrate continuous compliance to retain FedRAMP status.
Sarbanes-Oxley (SOX): We can thank well-publicized financial scandals like Enron for this set of financial regulatory requirements. SOX is a set of guidelines governing how publicly-traded companies report financial data to protect customers from errors in reporting or fraud. SOX regulations aren’t security-specific, but a variety of IT security controls are included within the scope of SOX because they support data integrity. However, SOX audits cover just a small portion of cloud security and IT infrastructure. SOX shouldn’t be taken lightly, as violators can expect harsh penalties, including fines up to five million dollars or up to twenty years in jail.
Security-centric frameworks
Organizations handling sensitive data can benefit from adhering to the standards set by the following security-specific regulations. These frameworks provide the methodology and structure to help avoid damaging security incidents. Here are four frameworks that organizations should have on their radar.
ISO 27001: Developed by the International Organization for Standards, this international set of standards for information security management systems demonstrates that your organization operates within the best practices of information security and takes data protection seriously. Any company handling sensitive data should seriously consider adding ISO 27001 to their compliance resume. ISO 27002 supports this regulation by detailing the specific controls required for compliance under ISO 27001 standards.
NIST Cybersecurity Framework: This foundational policy and procedure standard for private sector organizations appraises their ability to manage and mitigate cyber-attacks. A best practice guide for security pros, this framework assists in understanding and managing risk and should be mandatory reading for those on the first line of defense. NIST Cybersecurity Framework is built around five core functions: identifying, protecting, detecting, responding, and recovering. Back in 2015, Gartner estimated that 50% of United States organizations will use the NIST Security Framework by 2020.
CIS Controls: The Center for Internet Security created this guideline of best practices for cyber defense. This framework delivers actionable defense practices based on a list of 20 Critical Security Controls which focus on tightening access controls, defense system hardening, and continuous monitoring of environments. The first six are described as basic controls, the middle ten as foundational controls, and the remaining four as organizational controls.
Cloud well-architected frameworks
These frameworks can be considered best practice guidelines for cloud architects, commonly addressing operational efficiency, security, and cost-value considerations. Here are three for cloud architects to keep front of mind.
AWS Well-Architected Framework: This best practice guideline helps Amazon Web Services architects design workloads and applications in the Amazon cloud. This framework operates around a set of questions for the critique of cloud environments and provides customers with a solid resource for architecture evaluation. Five key principles guide Amazon architects—operational excellence, security, reliability, performance efficiency, and cost optimization.
Google Cloud Architected Framework: This best practice guideline provides a foundation for constructing and enhancing Google cloud offerings. This framework guides architects by focusing on four key principles—operational excellence, security and compliance, reliability, and performance cost optimization.
Azure Architecture Framework: This set of best practice guidelines assists architects constructing cloud-based offerings in Microsoft Azure. This guide helps maximize architecture workloads and is based on similar principles as those found in the AWS and Google Cloud Frameworks, including cost optimization to drive increased value, operational excellence and performance efficiency to keep systems functional, reliability to recover from failures, and security for data protection.
Why implementing a cloud compliance framework is important
Customers want to know they can trust your organization to keep their data safe. If your organization wants to conduct business with the federal government, achieving certain cloud security certifications is the procurement gate. Cloud compliance frameworks provide the guidelines and structure necessary for maintaining the level of security your customers demand. Additionally, these frameworks will help you navigate a regulatory minefield and avoid the steep financial and reputational cost of non-compliance. Most importantly, implementing a compliance framework will allow your organization to verify your commitment to privacy and data protection. This will keep you out of trouble with regulators and boost credibility and trust with your customers.
Manage the overlap between cloud security and compliance
Security and compliance, though different, are interrelated and have significant overlap. These areas of overlap can create dangerous gaps in your defense. Innovative, continuous compliance solutions, such as those provided by Hyperproof, can help organizations identify and manage overlaps between security and compliance risk mitigation strategies to create safer environments.
Cloud compliance frameworks Hyperproof supports
Hyperproof makes the process of gaining cloud security certifications (e.g. ISO 27001, FedRAMP) and maintaining them faster and easier . Our compliance operations software allows you to see and understand all the requirements of a compliance framework. You can create controls to meet the requirements and assign controls to your team to operate or monitor. Ultimately, this will help your compliance team save time gathering evidence to verify the operating effectiveness of internal controls so compliance and security leaders can spend more time on controls testing. Hyperproof also has a Crosswalks feature that clearly identifies the overlapping requirement areas across multiple security frameworks. This allows you to leverage your existing compliance efforts to achieve certification in additional frameworks faster. Hyperproof’s compliance solution provides analytics and dashboards to run a continuous monitoring program to verify your compliance status and drive remediation efforts.
To see how Hyperproof helps you gain control of your compliance efforts, sign up for a personalized demo.
Monthly Newsletter
Get the Latest on Compliance Operations.
