Cloud 101CircleEventsBlog
Missed CSA's Cyber Monday sale? You can still get 50% off the CCSK + CCZT Exam & Training Bundle and Token Bundle with raincheck code 'rcdoubledip24'

Research Topic

Cloud Component Specifications

Cloud OS Security Specification v2.0
Cloud OS Security Specification v2.0

Download

Cloud Component Specifications
What are Cloud Components?
From a user perspective, the cloud is a service. However, for Cloud Service Providers (CSPs), integrators and channel partners who construct or build the cloud, the cloud architecture consists of many cloud computing components. Examples of these cloud components are: hypervisors, cloud operating systems components such as “Swift”, “Glance” for OpenStack, virtual desktop infrastructure platforms, cloud dedicated firewalls and so on. 

Current standards are insufficient to evaluate the security of cloud components.  
Currently, most of the security standards related to cloud computing focus on the information security management system. However, these standards are insufficient to evaluate cloud component security because they focus on management security rather than the technical security requirements of the components. 

The most basic cloud component is the cloud OS—a feature with functionality that closely resembles the relationship between Linux and a computer. Through the utilization of virtualization technology, cloud OS virtualizes hardware resources of physical servers and storage area network devices and supports software-defined networking. Along with virtualization, cloud OS also provides management and configuration capabilities on virtualized hardware resources. Furthermore, it affords many other capabilities and functions like disaster recovery, firewalls, load balancers, access control, and backup control to enhance the performance and security of cloud computing systems as well as the user experience of administrators and users. 

CSA started addressing this gap by creating security specifications for Cloud Os.
In order to start addressing the gap in security best practices for cloud components, this group started by creating technical security specifications for cloud OS.

Cloud Component SpecificationsCloud Security Services ManagementEnterprise ArchitectureHybrid Cloud Security

Discuss this topic in Circle

View discussion community

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

Cloud OS Security Specification v2.0

Cloud OS Security Specification v2.0

There is a lack of internationally recognized technical security specifications and certifications for cloud components such as the cloud operating system (OS). CSA believes the guidance provided in this paper will be useful to help regulate security requirements for the cloud OS to prevent security threats and improve security capabilities of cloud OS products. This document builds on the foundation provided by ISO/IEC 17788, ISO/IEC 19941, ISO/IEC 27000,NIST SP 500-299, and NIST SP 800-144 in the context of cloud computing security. New requirements were also added in v2 in view of cloud security technology developments, including micro segmentation, hardware-based encryption, VM High availability, backup & recovery capability, key management service, cloud bastion host.

CSA CCM v3.0.1 Addendum - Cloud OS Security Specifications

CSA CCM v3.0.1 Addendum - Cloud OS Security Specifications

This document is an addendum to the CCM V3.0.1 and contains a controls mapping and gap analysis between the CSA CCM and CSA's research artifact "Cloud OS Security Specifications". It aims to help organizations adhering to the Cloud OS Security Specifications to also meet CCM requirements.

Webinars

Impact of Digital Transformation on Security Strategy
Impact of Digital Transformation on Security Strategy

October 28 | Online

Learn more

Key Considerations to Get Buy-in for a SaaS Data Security Program
Key Considerations to Get Buy-in for a SaaS Data Security Pr...

November 3 | Online

Learn more

Standardize Identity Security: From On-Prem to Multi-Cloud
Standardize Identity Security: From On-Prem to Multi-Cloud

November 16 | Online

Learn more

Transforming Enterprise Cloud Security to Supercharge Developer Velocity
Transforming Enterprise Cloud Security to Supercharge Develo...

November 19 | Online

Learn more

Blog Posts

How to Address the Security Risks of Cloud OS