New Cloud Security Guidance from CSA

In the last seven years, several revolutionary developments have occurred in the cloud computing industry. Considering the impact of these changes, CSA has released a new version of our Security Guidance for Critical Areas of Focus in Cloud Computing. We have completely revamped this updated 5th version to align with modern technologies and challenges.

As with previous versions, Security Guidance v5 helps you mitigate cloud risks, while simultaneously supporting business goals. You can view the Security Guidance as your actionable roadmap for adopting the cloud paradigm. We here at CSA see it as an essential resource for any IT security professional.

Key Differences from Version 4

Security Guidance v5 has undergone significant updates to align with the current state of the cloud industry. These updates include:

• Consolidated Domain Structure: The content has been more effectively grouped into 12 domains versus the 14 domains in v4.
• Refined Focus Areas: Version 5 features increased coverage on cloud workloads, application security, CI/CD, DevSecOps, and automation.
• Strengthened Core Areas: We have extended and improved the sections on GRC, auditing, IAM, and incident response.
• Added Crucial New Topics: AI and Zero Trust have replaced the content on IoT and mobile data. New domains dedicated to organizational security and security monitoring have been added. Additionally, we've added explicit references to critical topics such as resilience and data lakes.
• Reduced Coverage of Laws and Regulations: Version 5 moves away from detailed discussions about legal and regulatory specifics.
• Removed Security-as-a-Service: We now discuss cloud security tools across several domains.

Content Overview

Here are the key topics discussed in each domain of Security Guidance v5:

1. Cloud Computing Concepts and Architectures

• Definition of cloud computing
• Cloud computing models
• Reference and architecture models
• Cloud security scope, responsibilities, and models

2. Cloud Governance and Strategies

• Cloud governance
• Effective cloud governance
• The governance hierarchy
• Key strategies and concepts

3. Risk, Audit and Compliance

• Cloud risk management
• Compliance and audit
• GRC tools and technologies

4. Organization Management

• Organization hierarchy models
• Management of organization-level security
• Considerations for hybrid and multi-cloud deployments

5. Identity and Access Management

• IAM differences in the cloud
• Fundamental terms
• Federation
• Strong authentication and authorization
• IAM policy types for public cloud
• Least privilege and automation

6. Security Monitoring

• Cloud monitoring
• Cloud telemetry sources
• Collection architectures
• Detection and security analytics
• GenAI for security monitoring

7. Infrastructure and Networking

• Cloud infrastructure security
• Cloud network fundamentals
• Cloud connectivity
• Zero Trust and SASE

8. Cloud Workload Security

• Types of cloud workloads
• Virtual machines
• Containers
• PaaS security
• Serverless and FaaS
• AI workloads

9. Data Security

• Data classification and storage types
• Considerations for specific cloud workload types
• Considerations for specific storage types

10. Application Security

• Secure Development Lifecycle
• Secure cloud applications architecture
• IAM application security
• DevSecOps, CI/CD, and application testing
• Considerations for serverless and containerized applications

11. Incident Response and Resilience

• Incident response
• Preparation
• Detection and analysis
• Containment, eradication, and recovery
• Post-incident analysis
• Resilience

12. Related Technologies and Strategies

• Zero Trust
• AI
• Threat and vulnerability management

Quick Reference Guide

We strongly encourage all IT professionals to read the entire document, but we understand if your time is limited. If you just want to check out the particularly new content, we recommend focusing on these domains:

• Domain 6: Security Monitoring - This domain contains a ton of new content, including discussion of security monitoring, cloud telemetry, security analytics, and data lakes.
• Domain 9: Data Security - Again, make sure to read the sections about data lakes.
• Domain 10: Application Security - Pay special attention to the CI/CD pipeline.
• Domain 11: Incident Response and Resilience - Don’t skip the section on resilience at the end!
• Domain 12: Related Technologies and Strategies - We didn't even mention Zero Trust and AI in Security Guidance v4.

Expand on the Learnings from Security Guidance v5

Reading the Security Guidance is just the first step on your journey toward secure cloud computing. We recommend taking advantage of these other CSA resources next:

• Certificate of Cloud Security Knowledge (CCSK): The cloud security industry regards CCSK as the benchmark for cloud security expertise. Recently updated to align with Security Guidance v5, this certificate program will help you prepare for other cloud certifications.
• Cloud Infrastructure Security Training: Get a high-level introduction on some of the most critical cloud security topics. These succinct one-hour courses cover cloud key management, microservices and containers, DevSecOps, and cloud threats.
• CSA Virtual Events and Webinars: Learn about new technologies, emerging trends, and the latest tips for cloud security. A cheaper and less time-intensive alternative to in-person events.
• Cloud Security Glossary: This webpage combines all the glossaries created by CSA Working Groups into one place.
• Cloud Controls Matrix (CCM): The CCM is a framework composed of 197 cloud security control objectives. Assess all key aspects of a cloud implementation.
• CSA Enterprise Architecture Reference Guide: The CSA EA is a comprehensive approach for securing your cloud infrastructure. Use it to create adoption roadmaps and assess technology vendors against a common set of capabilities.
• Zero Trust Guiding Principles: This document provides a clear understanding of what Zero Trust security is. Leverage it when planning, implementing, and operating Zero Trust.
• Top Threats to Cloud Computing Pandemic Eleven: CSA surveyed 703 industry experts on security threats in the cloud industry. Respondents identified these 11 salient threats, risks, and vulnerabilities.