Security as a Service Working Group
Introduction to the Security as a Service Working Group
The mission statement of the Cloud Security Alliance is “. . . to promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.” In order to provide greater focus on the second part of our mission statement, the CSA is embarking on a new research project to provide greater clarity on the area of Security as a Service.
Numerous security vendors are now leveraging cloud based models to deliver security solutions. This shift has occurred for a variety of reasons including greater economies of scale and streamlined delivery mechanisms. Regardless of the motivations for offering such services, consumers are now faced with evaluating security solutions which do not run on premises. Consumers need to understand the unique nature of cloud delivered security offerings so that they are in a position to evaluate the offerings and to understand if they will meet their needs.
The purpose of this research will be to identify consensus definitions of what Security as a Service means, to categorize the different types of Security as a Service and to provide guidance to organizations on reasonable implementation practices. Other research purposes will be identified by the working group.
The Security as a Service Implementation Guidance is made possible by the following sponsors:
Security as a Service Working Group Leadership
Security as a Service Co-chairs
Cameron Smith
Pertino
Kevin Fielder
Kevin Fielder has over 15 years IT and security experience across multiple industries encompassing online trading, online supermarkets, banking/finance/insurance. His various roles have included pen testing and security assessments through technical and security architecture to security consulting and innovations.
Current focus includes security strategy, secure design and development, security innovations, software based mobile security, cloud policy and architecture, structured risk assessments, and of course his role as co-chair of the SecaaS working group.
He holds a Bachelors degree in Computing with Human Biology and a Masters in Distributed Systems and Networks, along with various industry certifications such as CISSP-ISSAP, CISSP-ISSMP, C|EH, ISEB enterprise and solutions architecture.
Security as a Service Working Group Initiatives
Open Peer Reviews
| Initiative Details | Date Opened | |
|---|---|---|
Defined Categories of Security as a Service – Continuous Monitoring as a Service |
February 03, 2016 | Contribute now |
Working Drafts
| Initiative Details | Date Opened | |
|---|---|---|
Next Generation SIEMThe capabilities of today’s modern SIEM infrastructures have already changed compared with traditional SIEMs that enterprises used to deploy 5 years ago (extended functions like compliance monitoring, broader input from additional event sources, different ways to store and access data, less complex to set-up and operate). But the evolution is ongoing and there is a broad discussion about what the next generation SIEM technology should be able to deliver and how. While Cloud environments might introduces more complexity (virtualization layer, distributed infrastructure, federated applications, …) and thus are more complex to monitor by a SIEM, at the same time the cloud “technology” and SecaaS based SIEM services create new opportunities for enterprises and the Cloud can help in storing and processing the increasing amount of data captured by SIEMs. |
July 03, 2013 | Contribute now |
Other ways to Connect
Security as a Service Working Group News
February 12, 2013
CSA Announces Working Group Sessions at RSA in San Francisco
CSA is hosting sessions during the week for some of our active working groups. These are free events that will be held outside of the regular conference on Thursday, February 28th.
October 29, 2012
CSA Releases Security Information and Event Management (SIEM) Guidance
New Security-as-a-Service Implementation Report provides guidance for deployment of cloud-based SIEM
October 09, 2012
Cloud Security Alliance Releases (SecaaS) Implementation Guidance
CSA today announced that its Security as a Service (SecaaS) Working Group has completed its peer review process and has published implementation guidance documents expanding upon their “Defined Categories of Service” document that was first made available in August of 2011.
September 26, 2012
CSA Security as a Service (SecaaS) Working Group Completes Implementation Guidance
New Identity and Access Management research provides business and technical considerations for implementation of SecaaS as part of the cloud.
July 18, 2012
CSA Research Sponsorship Opportunities Available
CSA announces the availability of several new opportunities to sponsor key research initiatives. Your support helps us maintain our aggressive research schedule and accelerate responsible adoption of cloud computing.
August 18, 2011
Open Review Period for the Draft of SecaaS Defined Categories of Service Whitepaper Starts Today
The Security as a Service (SecaaS) working group would like to invite you to review and comment on the Security as a Service “Defined Categories of Service” whitepaper. Your expertise will ensure that the white paper has accurate content.
June 30, 2011
Security as a Service Initial Group Call set for July 5th
The CSA Security as a Service (SecaaS) Working Group will have their first group call on July 5th. The purpose of their research will be to identify consensus definitions of what Security as a Service means, to categorize the different types of Security as a Service and to provide guidance to organizations on reasonable implementation practices.
June 21, 2011
SecaaS Seeks Additional Input on Working Group Proposal
Thank you to those who have contributed to the “Categories of Service” section of our working group proposal. We are still seeking input to all categories. For those who have recently expressed interest in getting involved, send me an email at [email protected] (Subject line: SecaaS Categories).
June 07, 2011
SecaaS Seeks Input on Working Group Proposal
The Cloud Security Alliance is now soliciting input for the Security as a Service (SecaaS) Working Group’s “Categories of Service” section of their working group proposal.
Security as a Service Working Group Downloads
Defining Categories of Security as a Service: Continuous Monitoring
In order to improve the understanding of Security as a Service and accelerate market acceptance, clear categorization and definitions of these services is necessary. This document provides a high overview of the business and technical elements needed to evaluate the risks associated with the category of Continuous Monitoring.
Release Date: February 29, 2016
Security as a Service Working Group Charter
Release Date: February 12, 2016
SecaaS Category 7 // Security Information and Event Management Implementation Guidance
This document provides guidance on how to evaluate, architect, and deploy cloud-based SIEM services to both enterprise and cloud-based networks, infrastructure and applications.
Release Date: October 29, 2012
SecaaS Category 9 // BCDR Implementation Guidance
When using the cloud for operational processes and/or production systems, an organization’s BC/DR requirements must be included in their procurement, planning, design, management, and monitoring of their cloud environments and cloud service providers.
Release Date: October 08, 2012
SecaaS Category 8 // Encryption Implementation Guidance
Encryption is a primary data (and application) protection technique. For encryption to be useful, encryption keys must be properly managed and protected. This document covers both the encryption and key management topics.
Release Date: October 08, 2012
SecaaS Category 6 // Intrusion Management Implementation Guidance
Because of the limited market maturity and lack of widely accepted best practices, this document provides implementation guidelines for cloud-based intrusion management service of multiple flavors—in the cloud, through the cloud, or from the cloud—focusing on the basic tenets of service and architecture rather than solutions.
Release Date: October 08, 2012
SecaaS Category 5 // Security Assessments Implementation Guidance
There are many choices for an assessment framework standard and there is no “one size fits all” solution for security assessments. One could reasonably expect that as cloud technology and governance evolves, a much smaller subset will emerge with a cloud focus.
Release Date: October 08, 2012
SecaaS Category 4 // Email Security Implementation Guidance
Due to its ubiquitous use, electronic mail is both the prime target of, and primary vehicle for, attacks, and must be protected on both ends: sending and receiving. Email service is a well defined utility in the enterprise, and securing email in the cloud is similar to securing email in the enterprise. Email Security as a Service (SecaaS) has a few unique aspects, but most responses entail differences of degree, rather than instituting new methods of security.
Release Date: October 08, 2012
SecaaS Category 3 // Web Security Implementation Guidance
The vendor and academic community have come together to form a set of solutions called Security as a Service. This document specifically addresses one element focused on Web Security as a Service (Web SecaaS).
Release Date: October 08, 2012
SecaaS Category 2 // Data Loss Prevention Implementation Guidance
DLP must be considered an essential element for achieving an effective information security strategy for protecting data as it moves to, resides in and departs from the cloud. DLP has two facets: one as viewed from the owner’s perspective and one as viewed from the custodian’s perspective.
Release Date: October 08, 2012
SecaaS Category 10 // Network Security Implementation Guidance
In a cloud environment, a major part of network security is likely to be provided by virtual security devices and services, alongside traditional physical network devices. Tight integration with the underlying cloud software layer to ensure full visibility of all traffic on the virtual network layer is important.
Release Date: October 08, 2012
SecaaS Category 1 // Identity and Access Management Implementation Guidance
This document addresses personnel involved in the identification and implementation of the IAM solution in the cloud. It will be of particular interest to those with the responsibility of designing, implementing and integrating the consumption of services of the IAM function within any cloud application of SecaaS.
Release Date: September 26, 2012
Defined Categories of Service 2011
Release Date: October 26, 2011
CSA V3 Guideline: Book Excerpts
Culture‐free, one‐size‐fits‐all English is usually the most efficient way to speak to a large, heterogeneous audience of E2s. In contrast, there are times when our English materials are intended for E2s in a small number of specific countries. In these cases, it might make good business sense to produce more than one English version, sensitive to the first language of the readers.
Release Date: July 02, 2011
Security Trust and Assurance Registry
STAR is a free, publicly accessible registry that documents the security controls provided by various cloud computing offerings.
Welcome New Members
The CSA is a member-driven organization, chartered with promoting the use of best practices for providing security assurance within Cloud Computing. We would like to welcome our newest members:
- TanoSecure
- GohighSec
- Sansec
- Astra
- Nordea
