Guideline on Effectively Managing Security Service in the Cloud
No standard understanding of how to implement the shared responsibility model.While the shared security responsibility model is well recognized, the reality is that, given the same concept of shared responsibility, there are different interpretations and different implementations among different CSPs. There are many cloud security standards and/or specifications developed for CSPs in fulfilling their security responsibilities, but for the cloud customer it is still difficult to design, deploy, and operate a secure cloud service.
CSA created guidelines for using cloud services securely that are based on the shared responsibility model.These guidelines provide easy-to-understand guidance for cloud customers and cloud service providers. For cloud customers it explains how to design, deploy, and operate a secure cloud service with respect to different cloud service models. It explains the shared responsibility model and covers common security responsibilities of CSPs versus cloud customers. It then goes on to explain how to fulfill cloud controls (based on the Cloud Controls Matrix) by using third-party security products and services.
Other ways this group is working to help address these challenges. This working group aims to develop guidelines for CSPs to secure its cloud platform and provide cloud security services to cloud users. For cloud users they hope to help them better select security qualified CSPs. Lastly, for security vendors they hope to help them develop their cloud-based security products and services.
Cloud Security Services ManagementEnterprise ArchitectureCloud Component SpecificationsHybrid Cloud Security
This working group hopes to develop a platform for CSPs to publish their security requirements; for security vendors to share their security products and services, and to provide a platform for interoperability testing.
CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.
Guideline on Effectively Managing Security Service in the Cloud
This document provides guidance for organizations that intend to use cloud services before they plan to build their service systems on the cloud or to move existing systems to the cloud. This guidance can help these organizations ensure the secure running of service systems and help them clearly understand security responsibilities of their own and of CSPs, what security assurance features should be provided to bear these security responsibilities, existing gaps, and how to develop related capabilities to address these gaps. This document can also provide guidance for CSPs building cloud platform security assurance systems and can be used by cloud service security integrators or by cloud customers. This document applies to private cloud, public cloud, hybrid cloud, and community cloud.
Gap Analysis Report on Mapping CSA’s Cloud Controls Matrix to ‘Guideline on Effectively Managing Security Service in the Cloud’
Read an overview of the differences between the security recommendations listed in the “Guideline on Effectively Managing Security Services in the Cloud” and the CSA CCM controls. Each control (criteria) in the CCM is initially matched to a control(s) from the guidelines to make an equivalency determination. This approach considers which CCM criteria are associated with the criteria in other established frameworks—and to what degree they are equivalent to each other.
