Workshop on Certification Schemes for Cloud Computing

Transcription

1 WE CAN DO SO MUCH TOGETHER Workshop on Certification Schemes for Cloud Computing What should a EU-wide cloud security certification scheme cover? Conchi Cortés TECNALIA December 11 th, 2017 SMART 2016 / 0029

2 Agenda 01 Procedure 02 Gaps 03 Preliminary findings 05 Next steps 04 Work in progress

3 01 Process followed to develop the security framework Determine (cloud) security controls and categories Match existing standards / schemes with these controls Recommendations Gap Analysis (as-is vs. should)

4 01 Procedure to determine controls (1/5) 1. Selected main categories (19) (1/2) EC-CLOUD CATEGORIES 1. Information Security Policies 2. Personnel & Training 3. Asset Management 5. Cryptography & Key management 4. Identity & Access Management 6. Physical Infrastructure Security 7. Operation Security 8. Communications Security 9. Procurement Management 10. Incident Management

5 01 Procedure to determine controls (2/5) 1. Selected main categories (19) (2/2) EC-CLOUD CATEGORIES 11. Business Continuity 12. Disaster Recovery 13. Compliance 14. Security Assessment 15. Device Management 17. System Security & Integrity 19. Risk / Threat / Vulnerability Management 16. Interoperability & Portability 18. Change & Configuration Management

6 01 Procedure to determine controls (3/5) 2. Matched categories: EC-CLOUD with five schemes (1/2) ISO C5 GERMANY CSA-CCM NIST-SP CCSM-ENISA

7 01 Procedure to determine controls (4/5) 2. Matched categories: EC-CLOUD with five schemes (2/2) EC-CLOUD CATEGORY ISO C5 GERMANY CSA-CCM NIST-SP CCSM-ENISA ISO Information security policies (2) C5. Security policies and work instructions (3) CCS-CCM. Data Security & Information Lifecycle Management (7) CCSM-ENISA. Information security policy Information Security Policies NIST-SP Planning (15) NIST-SP Program Management (16) CCSM-ENISA. Security roles Personnel & Training ISO Organization of information security (5+2 =7) C5. Organisation of information security (7) ISO Human resource security (2+3+1=6) C5. Personnel (5) CCS-CCM. Human Resources (11) NIST-SP Personnel Security (16) CCSM-ENISA. Personnel changes NIST-SP Awareness & Training (11) CCSM-ENISA. Security knowledge and training CCSM-ENISA. Background checks Asset Management ISO Asset management (4+3+3=10) C5. Asset management (8) CCSM-ENISA. Asset management Identity & Access Management ISO Access control ( =14) C5. Identity and access management (13) CCS-CCM. Identity & Access Management (13) NIST-SP Access control (126) CCSM-ENISA. Access control to network and information systems NIST-SP Identification and Authentication (57) Criptographty & Key management ISO Cryptography (2) C5. Cryptography and key management (4) CCS-CCM. Encryption & Key Management (4) Physical Infrastructure Security ISO Physical and environmental security (6+9=15) C5. Physical security (5) CCS-CCM. Infrastructure & Virtualization Security (13) NIST-SP Physical and Environmental Protection (53) CCSM-ENISA. Physical and environmental security Operation Security ISO Operations security ( =14) C5. Safeguards for regular operations (23) CCSM-ENISA. Operating procedures Communications Security ISO Communications security (3+4=7) C5. Communication security (8) Procurement Management Incident Management Business Continuity Disaster Recovery Compliance Security Assessment ISO System acquisition, development and maintenance (3+9+1=13) C5. Procurement, development and maintenance of information systems (12) ISO Supplier relationships (3+2=5) C5. Control and monitoring of service providers and suppliers (2) CCS-CCM. Supply Chain Management, Transparency, and Accountability (9) NIST-SP System and Services Acquisition (98) CCSM-ENISA. Security in Supplier relationships CCSM-ENISA. Security of supporting utilities ISO Information security incident management (7) C5. Security incident management (7) CCS-CCM. Security Incident Management, E-Discovery, & Cloud Forensics (5) NIST-SP Incident Response (34) CCSM-ENISA. Security incident detection and response CCSM-ENISA. Security incident reporting ISO Information security aspects of business continuity management (3+1C5. Business continuity management (5) CCS-CCM. Business Continuity Management & Operational Resilience (11) NIST-SP Contingency Planning (54) CCSM-ENISA. Business continuity NIST-SP Maintenance (27) CCSM-ENISA. Disaster recovery capabilities ISO Compliance (5+3=8) C5. Compliance and data protection (3) CCS-CCM. Audit Assurance & Compliance (3) NIST-SP Audit & Accountability (63) CCSM-ENISA. Checking compliance NIST-SP Security Assessment & Authorization (24) CCSM-ENISA. Monitoring and logging policies CCSM-ENISA. Cloud monitoring and log access C5. Security check and verification (3) CCSM-ENISA. System tests CCSM-ENISA. Security assessments Device Management (Assets??) C5. Mobile device management (1) CCS-CCM. Mobile Security (20) Interoperability & Portability C5. Portability and interoperability (5) CCS-CCM. Interoperability & Portability (5) CCSM-ENISA. Cloud interoperability and portability CCS-CCM. Application & Interface Security (4) NIST-SP System and Communications Protection (136) CCS-CCM. Datacenter Security (9) NIST-SP System & Information Integrity (91) CCSM-ENISA. Integrity of network and information systems System Security & Integrity NIST-SP Media Protection (30) CCSM-ENISA. Cloud data security CCSM-ENISA. Cloud interface security CCSM-ENISA. Cloud software security Change & Configuration Management CCS-CCM. Change Control & Configuration Management (5) NIST-SP Configuration Management (55) CCSM-ENISA. Change management Risk / Threat / Vulnerability Managemen CCS-CCM. Governance and Risk Management (11) NIST-SP Risk Assessment (16) CCSM-ENISA. Risk management CCS-CCM. Threat and Vulnerability Management (3)

8 01 Procedure to determine controls (5/5) 3. Matched controls from the five selected schemes with the EC-CLOUD Categories

9 Agenda 01 Procedure 02 Gaps 03 Preliminary findings 05 Next steps 04 Work in progress

10 02 Gaps Certification schemes cover different aspects with different levels of granularity and requirements. They are also not specific for clouds. A harmonized certification scheme would increase trust in CSPs

11 Agenda 01 Procedure 02 Gaps 03 Preliminary findings 05 Next steps 04 Work in progress

12 03 Preliminary findings 1. Information Security Policies (1/4) ISO C5 GERMANY CSA-CCM CCSM-ENIS CSA DSI-02 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's geographically distributed (physical and virtual) applications and infrastructure network and systems components and/or shared with other third parties to ascertain any regulatory, statutory, or supply chain agreement (SLA) C5 OIS-01 Information security compliance impact, and to address any other business risks associated with the data. Upon request, provider shall inform customer (tenant) of compliance impact and risk, especially if management customer data is used as part of the services. system (ISMS) CSA GRM-06 Information security policies and procedures shall C5 SA-01 Documentati ISO 27002: A set of policies for on, be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the CCSM- ENISA SO information security should be communicati organization's business leadership (or other accountable 01 - defined, approved by on and business role or function) and supported by a strategic business Informati management, published and communicated to employees and relevant external parties. provision of policies and instructions plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership. on security policy

13 03 Preliminary findings 1. Information Security Policies (2/4) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: The policies for information security should be review at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness. C5 SA-02 Review and approval of policies and instructions C5 SA-03 Deviations from existing policies and instructions ISO 27002: All information security responsibilities should be defined and allocated. C5 OIS-03 Authorities and responsibilitie s in the framework of information security CSA DSI-06 All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated. CSA HRS-07 Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security. CSA SEF-02 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures. CSA GRM-04 An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:

14 03 Preliminary findings 1. Information Security Policies (3/4) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Conflicting duties and areas of responsibility should be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization's assets C5 OIS-04 Separation of functions CSA IAM-05 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest. ISO 27002: Appropiate contacts with relevant authorities should be maintained. ISO 27002: Appropiate contacts with special interest groups or other specialist security forums and professional associations should be maintained. ISO 27002: Information security should be addressed in project management, regardless of the type of the project. C5 OIS-05 Contact with relevant government agencies and interest groups CSA SEF-01 Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impacted-scope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

15 03 Preliminary findings 1. Information Security Policies (4/4) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: A policy and supporting security measures should be adopted to manage the risks introduced by using mobile devices. ISO 27002: A policy and supporting security measures should be implemented to protect information accessed, processed or stored at teleworking sites. C5 OIS-06 Policy for the organization of the risk management CSA HRS-05 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring). C5 OIS-02 Strategic targets regarding information security and responsibility of the top management C5 OIS-07 Identification, analysis, assessment and handling of risks CCSM-ENISA SO 03 - Security roles

16 03 Preliminary findings 2. Personnel & Training (1/2) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Background verification checks on all candidates for employment should be carried out in accordance with relevant laws, regulations and CCSM-ENISA SO 05 - Background checks CCSM-ENISA SO 06 - Security ethics and should be proportional to the business requirements, the C5 HR-01 Security CSA HRS-02 Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, knowledge and training classification of the information to check of the contractors, and third parties shall be subject to background CCSM-ENISA SO 07 be accessed and the perceived risks. background information verification proportional to the data classification to be accessed, the business requirements, and acceptable risk. - Personnel changes ISO 27002: The contractual agreements with employees and contractors should state their and the organization's responsibilities for information security. ISO 27002: Management should require all employees and contractors to apply information security in accordance with the established policies and procedures of the organization. C5 HR-02 Employment agreements CSA HRS-03 Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets. CSA BCR-10 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery, and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training. CSA GRM-03 Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.

17 03 Preliminary findings 2. Personnel & Training (2/2) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: All employees of the organization and, where CSA HRS-09 A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization. relevant, contractors should receive appropiate awareness education and training and regular updates in organizational policies and procedures, as relevant for their job function. C5 HR-03 Security training and awarenessraising programme CSA HRS-10 All personnel shall be made aware of their roles and responsibilities for: Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations. Maintaining a safe and secure working environment ISO 27002: There should be a formal and communicated disciplinary process in place to take action against employees who have commited and information security breach. ISO 27002: Information security responsibilities and duties that remain valid after termination or change of employment should be defined, communicated to the employee or contractor and enforced. C5 HR-04 Disciplinary measures C5 HR-05 Termination of the employment relationship or changes to the responsibiliti es CSA GRM-07 A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures. CSA HRS-04 Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

18 03 Preliminary findings 3. Asset Management (1/3) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Information, other assets associated with information and information processing facilities should be identified and an inventory of CSA IVS-12 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following: CSA DSC-05 Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premises. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full overwrite of the CCSM- ENISA SO these assets should be drawn up and maintained. C5 AM-01 Asset inventory drive to ensure that the erased drive is released to inventory for reuse and deployment, or securely stored until it can be destroyed Asset manage ment ISO 27002: Assets maintained in the inventory should be owned. ISO 27002: Rules for the acceptable use of information and of assets associated with information and information processing facilities should be identified, documented and implemented. C5 AM-02 Assignment of persons responsible for assets C5 AM-03 Instruction manuals for assets CSA DCS-01 Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership by defined roles and responsibilities. CSA DSI-05 Production data shall not be replicated or used in nonproduction environments. Any use of customer data in nonproduction environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements. CSA HRS-08 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user endpoint devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.

19 03 Preliminary findings 3. Asset Management (2/3) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: All employees and external party users should return all C5 AM-04 of the organizational assets in their Handing in CSA HRS-01 Upon termination of workforce personnel and/or possession upon termination of their and returning expiration of external business relationships, all organizationallyowned employment, contract or agreement. assets assets shall be returned within an established period. ISO 27002: Information should be classified in terms of legal requirements, value, criticality and sensitivity to unauthorised disclosure or modification. C5 AM-05 Classification of information CSA DSI-01 Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization. ISO 27002: An appropiate set of procedures for information labelling should be developed and implemented in accordance with the information classification scheme adopted by the organization. ISO 27002: Procedures for handling assets should be developed and implemented in accordance with the information classification scheme adopted by the organization. C5 AM-06 Labelling of information and handling of assets CSA DSI-04 Policies and procedures shall be established for the labeling, handling, and security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data. CSA GRM-02 Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following: CSA BCR-11 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.

20 03 Preliminary findings 3. Asset Management (3/3) ISO ISO 27002: Procedures should be implemented for the management of removable media in accordance with the classification scheme adopted by the organization. ISO 27002: Media should be disposed of securely when no longer required, using formal procedures. ISO 27002: Media containing information should be protected against unauthorized access, misuse or corruption during transportation. C5 GERMANY CSA-CCM CCSM-ENIS C5 AM-07 Management of data media C5 AM-08 Transfer and removal of assets

21 03 Preliminary findings 4. Identity & Access Management (1/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: An access control policy CSA IAM-02 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following: CSA IAM-04 Policies and procedures shall be established to store and manage identity information about every person who accesses CCSM- ENISA SO should be established, IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based 10 - Access documented and reviewed based on business and information security requirements. C5 IDM-01 Policy for system and data access authorisations on user identity. CSA IAM-12 Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures: CSA AIS-02 Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be addressed. control to network and informatio n systems ISO 27002: Users should only be provided with access to the network and network services that they have been specifically authorized C5 IDM-02 User to use. registration CSA IAM-02 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following: CSA IAM-04 Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity. CSA IAM-12 Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:

22 03 Preliminary findings 4. Identity & Access Management (2/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: A formal registration and C5 IDM-03 CSA IAM-07 The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access. Compensating controls derived from the risk analysis shall be implemented prior to provisioning access. CSA IAM-02 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, de-registration process Granting and and access management for all internal corporate and customer (tenant) users with access to data should be change and organizationally-owned or managed (physical and virtual) application interfaces and implemented to enable (provisioning) infrastructure network and systems components. These policies, procedures, processes, and assignment of access rights. of data access authorisations measures must incorporate the following: CSA IAM-04 Policies and procedures shall be established to store and manage identity ISO 27002: A formal user access provisioning process should be implemented to assign or revoke access rights for all user types to all sysems and services. C5 IDM-09 Handling of emergency users CSA IAM-02 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following: CSA IAM-04 Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity. CSA IAM-11 Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change, or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

23 03 Preliminary findings 4. Identity & Access Management (3/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: The allocation and use of privileged access rights should be restricted and controlled. ISO 27002: The allocation of secret authentication information should be controlled through a formal ISO 27002: Asset owners should review users' access rights at regular intervals. ISO 27002: The access rights of all employees and external party users to information and information processing faciliting should be removed upon termiation of their employment, contract or agreement, or adjusted upon change. C5 IDM-07 Nondisclosure of authentication information C5 IDM-06 Administrator authorisations C5 IDM-05 Regular review of data access authorisations C5 IDM-04 Withdrawal of authorisations (deprovisioning) in case of changes to the employment relationship CSA IAM-04 Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity. CSA IAM-08 Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business CSA IAM-10 User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures. CSA IAM-04 Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity. CSA IAM-08 Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

24 03 Preliminary findings 4. Identity & Access Management (4/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Users should be required to follow the organization's practices in the use of secret authentication information. C5 IDM-08 Secure login methods CSA IAM-08 Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary. ISO 27002: Access to information and application system functions should be restricted in accordance with the access control policy. CSA IAM-08 Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary. C5 IDM-09 Provisioning user access (e.g., employees, contractors, customers (tenants), business partners, and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control. ISO 27002: Where required by the access control policy, access to systems and applications should be C5 IDM-10 controlled by a secure log-on System-side procedure. access control CSA IAM-08 Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

25 03 Preliminary findings 4. Identity & Access Management (5/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Password management systems should be interactive and should ensure quality passwords. C5 IDM-11 Password requirements and validation parameters CSA IAM-08 Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary. ISO 27002: The use of utility programs that might be capable of overriding system and application controls should be restricted and tightly controlled. ISO 27002: Access to program source code should be restricted. C5 IDM-12 Restriction and control of administrative software C5 IDM-13 Control of access to source code CSA IAM-03 User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications. CSA IAM-08 Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary. CSA IAM-13 Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted. CSA IAM-06 Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures. CSA IAM-08 Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

26 03 Preliminary findings 4. Identity & Access Management (6/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA CSA IAM-01 Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segregated and access restricted to prevent inappropriate disclosure and tampering of log data.

27 03 Preliminary findings 5. Cryptography & Key management (1/2) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: A policy on the use of cryptographic controls for protection of information should be developed and implemented. C5 KRY-01 Policy for the use of encryption procedures and key management CSA EKM-01 Keys must have identifiable owners (binding keys to identities) and there shall be key management policies. CSA EKM-03 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations. CSA EKM-04 Platform and data-appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e., at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.

28 03 Preliminary findings 5. Cryptography & Key management (2/2) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: A policy on the use, protection and lifetime of cryptographic keys should be developed and implemented through their whole lifecycle. CSA EKM-02 Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over implementation of the control. C5 KRY-02 Encryption of data for transmission (transport encryption) C5 KRY-03 Encryption of sensitive data for storage C5 KRY-04 Secure key management

29 03 Preliminary findings 6. Physical Infrastructure Security (1/5) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Security perimeters should be defined and used to protect areas that contain either sensitive or critical information and information processing facilities. C5 PS-01 Perimeter protection CSA DCS-02 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems. CSA DCS-06 Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information. CSA DCS-09 Physical access to information assets and functions by users and support personnel shall be restricted. CCSM- ENISA SO 08 - Physical and environ mental security ISO 27002: Secure areas should be protected by appropiate entry controls to ensure that only authorized personnel are allowed access. C5 PS-02 Physical site access control CSA DCS-02 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems. CSA DCS-06 Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.

30 03 Preliminary findings 6. Physical Infrastructure Security (2/5) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Physical security for officers, rooms and facilities should be designed and applied. ISO 27002: Phycal protection against disasters, malicious attack or accidents should be designed and applied. ISO 27002: Procedures for working in secure areas should be designed and applied. ISO 27002: Access points such as delivery and loading areas and other points where unauthorized persons could enter the premises should be controlled and, if possible, isolated from information processing facilities to avoid unauthorized access. CSA DCS-07 Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

31 03 Preliminary findings 6. Physical Infrastructure Security (3/5) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Equipment should be sited and protected to reduce the risks from environmental threats and hazards, and opportunities for unauthorized access. ISO 27002: Equipment should be protected from power failures and other disruptions caused by failures in supporting utilities. ISO 27002: Power and telecommunications cabling carrying data or supporting information services should be protected from interception, interference or damage. C5 PS-03 Protection against threats from outside and from the environment C5 PS-04 Protection against interruptions caused by power CSA BCR-05 Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied. CSA BCR-06 To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance. CSA BCR-03 Data center utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications, and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-

32 03 Preliminary findings 6. Physical Infrastructure Security (4/5) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Equipment should be correctly maintained to ensure its continued availability and integrity. C5 PS-05 Maintenance of infrastructure and devices CSA BCR-07 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel. ISO 27002: Equipment, information or software should not be taken off-site without prior authorization. ISO 27002: Security should be applied to off-site assets taking into account the different risks of working outside the organization's premises. ISO 27002: All items of equipment containing storage media should be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use. CSA DSI-07 Policies and procedures shall be established with supporting business processes and technical measures implemented for the secure disposal and complete removal of data from all storage media, ensuring data is not recoverable by any computer forensic means. CSA DCS-04 Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

33 03 Preliminary findings 6. Physical Infrastructure Security (5/5) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Users should ensure that unattended equipment has appropiate protection. ISO 27002: A clear desk policy for papers and removable storage media and a clear screen policy for information processing facilities should be adopted. CSA HRS-11 Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions are disabled after an established period of inactivity.

34 03 Preliminary findings 7. Operation Security (1/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Operating procedures should be documented and made available to all users who need them. CSA BCR-04 Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following: Configuring, installing, and operating the information system Effectively using the system s security features CCSM-ENISA SO 12 - Operating procedures ISO 27002: Changes to the organization, business processes, information processing facilities and systems that affect information security should be controlled. ISO 27002: The use of resources should be monitored, turned and projections made of future capacity requirements to ensure the required system performance. ISO 27002: Development, testing, and operational enviroments should be separated to reduce the risks of unauthorized access or changes to the operational environment. C5 RB-02 Capacity management monitoring C5 RB-04 Capacity management control of resources CSA DCS-08 Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss. CSA IVS-04 The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal, statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload. CSA IVS-08 Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets. Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

35 ISO 27002: Logging facilities and log information should be protected against tampering and unauthorized access. C5 RB-13 Logging and monitoring - storage of the logs CSA IVS-02 The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g., dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g., portals or alerts). 03 Preliminary findings 7. Operation Security (2/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA CSA IVS-07 Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template. CSA TVM-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. ISO 27002: Detection, prevention and recovery controls to protect against malware should be implemented, combined with appropiate user awareness. C5 RB-05 Protection against malware CSA TVM-03 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. ISO 27002: Backup copies fo information, software and system C5 RB-08 Data images should be taken and backup and tested regularly in accordance restoration - regular with an agreed backup policy. tests ISO 27002: Event logs recording user activities, exceptions, faults and information security events should be producted, kept and regularly reviewed.

36 03 Preliminary findings 7. Operation Security (3/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: System administrator and system operator activities should be C5 RB-15 Logging logged and the logs protected and and monitoring - regularly reviewed. configuration ISO 27002: The clocks of all relevant information processing systems within and organization or security domain should be synchronised to a single reference ISO 27002: Procedures should be implemented to control the installation of software on operational systems. CSA IVS-03 A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines. CSA CCC-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network, and systems components, or any corporate, operations and/or data center facilities have been pre-authorized by the organization's business leadership or other accountable business role or function. CSA CCC-03 Organizations shall follow a defined quality change control and testing process (e.g., ITIL Service Management) with established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services.

37 03 Preliminary findings 7. Operation Security (4/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Information about technical vulnerabilities of information systems being used should be obtained in a timely fashion, the organization's exposure to such vulnerabilities evaluated and appropiate measures taken to address the associated risk. C5 RB-21 Handling of vulnerabilities, malfunctions and errors - check of open vulnerabilities CSA IVS-10 Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations. CSA IVS-11 Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles). CSA MOS-01 Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training. CSA MOS-03 The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store. CSA MOS-04 The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage. CSA A MOS-10 centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data. CSA MOS-11 The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices, and shall be enforced through technology controls. CSA MOS-13 The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds. The BYOD policy shall clearly state the expectations regarding the loss of non-company data in the case that a wipe of the device is required. CSA TVM-02 Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g., network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identified weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control. CSA GRM-10 Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

38 03 Preliminary findings 7. Operation Security (5/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Rules governing the installation of software by users should be established and implemented. ISO 27002: Audit requirements and activities involving verification of operational systems should be carefully planned and agreed to minimize disruptions to business processes. CSA AAC-01 Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

39 03 Preliminary findings 7. Operation Security (6/6) ISO C5 GERMANY CSA-CCM CCSM-ENISA C5 RB-01 Capacity management planning C5 RB-03 Capacity management data location C5 RB-06 Data backup and restoration - concept C5 RB-07 Data backup and restoration - monitoring C5 RB-09 Data backup and restoration - storage C5 RB-10 Logging and monitoring - concept C5 RB-11 Logging and monitoring - meta data C5 RB-12 Logging and monitoring - critical assets C5 RB-14 Logging and monitoring - accountability C5 RB-16 Logging and monitoring - availability of the monitoring software C5 RB-17 Handling of vulnerabilities, malfunctions and errors - concept C5 RB-18 Handling of vulnerabilities, malfunctions and errors - penetration tests C5 RB-19 Handling of vulnerabilities, malfunctions and errors - integration with change and incident management C5 RB-20 Handling of vulnerabilities, malfunctions and errors - involvement of the cloud customer C5 RB-22 Handling of vulnerabilities, malfunctions and errors - system hardening C5 RB-23 Segregation of stored and processed data of the cloud customers in jointly used resources

40 03 Preliminary findings 8. Communications Security (1/2) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Networks should be managed and controlled to protect information in systems and applications. C5 KOS-03 Cross-network access ISO 27002: Security mechanisms, service levels and management requirements of all network services should be identified and included in network services agreements, whether these services are provided in-house or outsourced. C5 KOS-02 Monitoring of connections ISO 27002: Groups of information services, users and information systems should be segregated on networks. C5 KOS-04 Networks for administration CSA DSI-03 Data related to electronic commerce (ecommerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data. CSA IVS-06 Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls. CSA IVS-09 Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed, and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations: Established policies and procedures Isolation of business critical assets and/or sensitive user data, and sessions that mandate stronger internal controls and high levels of assurance Compliance with legal, statutory, and regulatory compliance obligations

41 03 Preliminary findings 8. Communications Security (2/2) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Formal transfer policies, procedures and controls should be in place to protect the transfer of information through the use of all types of communication facilities. C5 KOS-05 Segregation of data traffic in jointly used network environments CSA AIS-03 Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse. ISO 27002: Agreements should address the secure transfer of business information between the organization and external parties. C5 KOS-08 Confidentiality agreement ISO 27002: Information involved in electronic messaging should be appropriately protected. ISO 27002: Requirements for confidentiality or non-disclosure agreements reflecting the organization's needs for the protection of information should be identified, regularly reviewed and documented. C5 KOS-07 Policies for data transmission C5 KOS-01 Technical safeguards C5 KOS-06 Documentation of the network topology CSA HRS-06 Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.

42 03 Preliminary findings 9. Procurement Management (1/5) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: The information security related requirements should be included in the requirements for new information systems or enhancements to existing information systems. ISO 27002: Information involved in application services passing over public networks should be protected from fraudulent activity, contract dispute and unauthorized disclosure and modification. ISO 27002: Information involved in application service transactions should be protected to prevent incomplete transmission, mis-routing, unauthorized message alteration, unauthorized disclosure, unauthorized message duplication or replay. ISO 27002: Rules for the development of software and systems should be established and applied to developments within the organization. ISO 27002: Changes to systems within the development lifecycle should be controlled by the use of formal change control procedures. C5 BEI-01 Policies for the development / procurement of information systems C5 BEI-03 Policies for changes to information systems CSA AIS-01 Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations. CCSM-ENISA SO 04 - Security in Supplier relationships CCSM-ENISA SO 09 - Security of supporting utilities

43 03 Preliminary findings 9. Procurement Management (2/5) ISO C5 GERMANY CSA-CCM CCSM-ENISA CSA MOS-12 The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g., jailbreaking or rooting) and shall enforce the prohibition through detective and preventative controls on the device or through a centralized device management system (e.g., mobile device management). ISO 27002: When operating platforms are changed, business critical applications should be reviewed and tested to ensure there is no adverse impact on organizational operations or security. ISO 27002: Modifications to software packages should be discouraged, limited to necessary changes and all changes should be strictly controlled. ISO 27002: Principles for engineering secure systems should be established, documented, maintained and applied to any information system implementation efforts. ISO 27002: Organizations should establish and appropriately protect secure developments enviroments for system development and integration efforts that cover the entire system development lifecycle. ISO 27002: The organization should supervise and monitor the activity of outsourced system development. C5 BEI-09 Review of proper testing and approval C5 BEI-11 System landscape C5 BEI-02 Outsourcing of the development CSA CCC-02 External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g., ITIL service management processes). CSA CCC-04 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and

44 03 Preliminary findings 9. Procurement Management (3/5) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Thesting of security functionality should be carried out during development. ISO 27002: Acceptance testing programs and related criteria should be established for new information systems, upgrades and new versions. ISO 27002: Test data should be selected carefully, protected and controlled. C5 BEI-07 Testing changes CSA STA-06 Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain. CSA GRM-11 Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and documented in accordance with reasonable resolution time frames and stakeholder approval. ISO 27002: Information security requirements for mitigating the risks associated with supplier's access to the organization's assets should be agreed with the supplier and documented. CSA CCC-05 Policies and procedures shall be established for managing the risks associated with applying changes to: Business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations. Infrastructure network and systems components. Technical measures shall be implemented to provide assurance that all changes directly correspond to a

45 03 Preliminary findings 9. Procurement Management (4/5) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: All relevant information security requirements should be established and agreed with each supplier that may access, process, store, C5 DLL-01 Policies for communicate, or provide the handling of and IT infrastructure components for, the organization's information. security requirements for service providers and suppliers of the cloud provider CSA STA-03 Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems components, shall be designed, developed, and deployed CSA IVS-05 in Implementers accordance with shall mutually ensure that agreed-upon the security service vulnerability and capacity-level assessment expectations, tools or services as well accommodate as IT governance the virtualization and service management technologies policies used (e.g., and virtualization procedures. aware). CSA IVS-13 Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks. CSA STA-01 Providers shall inspect, account for, and work with their cloud supply-chain partners to correct data quality errors and associated risks. Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privilege access for all personnel within their supply chain. CSA STA-02 The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals). CSA STA-04 The provider shall perform annual internal assessments of conformance to, and effectiveness of, its policies, procedures, and supporting measures and metrics. ISO 27002: Agreements with suppliers should include requirements to address the information security risks associated with information and communications technology services and product supply chain. CSA STA-05 Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms: Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations) Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures implemented to enable effectively governance, risk management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted (i.e., up- and down-stream impacted supply chain) Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed Expiration of the business relationship and treatment of customer (tenant) data impacted Customer (tenant) service-to-service application (API) and data interoperability and portability requirements for application development and information exchange, usage, and integrity persistence CSA STA-07 Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream). Reviews shall be performed at least annually and identify any non-conformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier relationships.

46 03 Preliminary findings 9. Procurement Management (5/5) ISO C5 GERMANY CSA-CCM CCSM-ENIS ISO 27002: Organizations should regularly monitor, review and audit supplier service delivery. C5 DLL-02 Monitoring of the rendering of services and security requirements for service providers and suppliers of the cloud provider ISO 27002: Changes to the provision of services by suppliers, includings maintaining and improving existing information security policies, procedures and controls, should be managed, taking account of the criticality of business information, systems and processes C5 BEI-04 Risk assessment of changes C5 BEI-05 Categorisation of changes C5 BEI-06 Prioritisation of changes C5 BEI-08 Rollback of changes C5 BEI-10 Emergency changes C5 BEI-12 Separation of functions CSA STA-08 Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party-providers upon which their information supply chain depends on.

47 03 Preliminary findings 10. Incident Management ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Management responsibilities and procedures should be established to ensure a quick, effective and orderly response to information security incidents. ISO 27002: Information security events should be reported through appropriate management channels as quickly as possible. ISO 27002: Employees and contractors using the organization's information systems and services should be required to note and report any observed or suspected information security weaknesses in systems or services. ISO 27002: Information security events should be assessed and it should be decided if they are to be classified as information security incidents. ISO 27002: Information security incidents should be responded to in accordance with the documented procedures. C5 SIM-01 Responsibilities and procedural model C5 SIM-03 Processing of security incidents C5 SIM-04 Documentation and reporting of security incidents C5 SIM-05 Security incident event management CSA SEF-03 Workforce personnel and external business relationships shall be informed of their responsibilities and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations. CCSM-ENISA SO 15 Security incident detection and response CCSM-ENISA SO 16 Security incident reporting ISO 27002: Knowledge gained from analysing and resolving information security incidents should be used to reduce the likelihood or impact of future incidents. ISO 27002: The organization should define and apply procedures for the identification, collection, acquisition and preservation of information, which can serve as evidence. C5 SIM-07 Evaluation and learning process C5 SIM-02 Classification of customer systems C5 SIM-06 Duty of the users to report security incident to a central body CSA SEF-05 Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents. CSA SEF-04 Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

48 03 Preliminary findings 11. Business Continuity (1/2) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: The organization should determine its requirements for information security and the continuity of information security management in adverse situations, e.g. during a crisis or disaster. C5 BCM-01 Top management responsibility CCSM-ENISA SO 17 Business continuity CSA BCR-01 A consistent unified framework for business continuity planning and plan development shall be established, documented, and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following: Defined purpose and scope, aligned with relevant dependencies Accessible to and understood by those who will use them Owned by a named person(s) who is responsible for their review, update, and approval Defined lines of communication, roles, and responsibilities Detailed recovery procedures, manual work-around, and reference information Method for plan invocation ISO 27002: The organization should establish, document, implement and maintain processes, procedures and controls to ensure the required level of continuity for information security during and adverse situation. C5 BCM-02 Business impact analysis policies and procedures CSA BCR-09 There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following: Identify critical products and services Identify all dependencies, including processes, applications, business partners, and third party service providers Understand threats to critical products and services Determine impacts resulting from planned or unplanned disruptions and how these vary over time Establish the maximum tolerable period for disruption Establish priorities for recovery Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption Estimate the resources required for resumption

49 03 Preliminary findings 11. Business Continuity (2/2) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: The organization should verify the established information security continuity controls at regular intervals in order to ensure that they are valid and effective during adverse situations. C5 BCM-04 Verification, updating and testing of the business continuity ISO 27002: Information processing facilities should be implemented with redundancy sufficient to meet availability requirements. C5 BCM-03 Planning business continuity C5 BCM-05 Supply of the computing centres CSA BCR-02 Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

50 03 Preliminary findings 12. Disaster Recovery ISO C5 GERMANY CSA-CCM CCSM-ENISA CCSM-ENISA SO 18 - Disaster recovery capabilities

51 03 Preliminary findings 13. Compliance (1/4) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: All relevant legislative statutory, regulatory, contractual requirements and the organization's approach to meet these requirements should be explicity identified, documented and kept up to date for each information system and the organization. ISO 27002: Appropiate procedures should be implemented to ensure compliance with legislative, regularoy and contractual requirements related to intellectual property rights and use of propietary software products. C5 COM-01 Identification of applicable legal, contractual and data protection requirements CSA AAC-03 Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected. CSA MOS-02 A documented list of approved application stores has been defined as acceptable for mobile devices accessing or storing provider managed data. CSA MOS-5 The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program. CSA MOS-08 The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage. CSA MOS-09 An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD)) will be included for each device in the inventory. CSA IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity CCSM-ENISA SO 22 persistence. Checking compliance CSA GRM-01 Baseline security requirements shall be established for developed or acquired, organizationallyowned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory, and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and authorized based on business needs. CSA GRM-09 The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

52 03 Preliminary findings 13. Compliance (2/4) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Records should be protected from loss, destruction, falsification, unauthorized access and unauthorized release, in accordance with legislatory, regulatory, contractual and business requirements. CCSM-ENISA SO 27 - Cloud monitoring and log access ISO 27002: Privacy and protection of personally identifiable information should be ensured as required in relevant legislation and regulation where applicable. ISO 27002: Cryptographic controls should be used in compliance with all relevant agreements, legislation and regulations. ISO 27002: The organization's approach to managing information security and its implementation (i.e. control objectives, controls, policies, processes and procedures for information security) should be reviewed independently at planned intervals or when significant changes occur. CCSM-ENISA SO 19 - Monitoring and logging policies

53 03 Preliminary findings 13. Compliance (3/4) ISO C5 GERMANY CSA-CCM CCSM-ENISA CSA MOS-07 The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues. CSA MOS-16 Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/pin lengths and authentication requirements. CSA MOS-17 The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported). CSA MOS-18 All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT. CSA MOS-19 Mobile devices connecting to corporate networks, or storing and accessing company information, shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely. CSA IPY-02 All structured and unstructured data shall be available to the customer and provided to them upon request in an industry-standard format (e.g.,.doc,.xls,.pdf, logs, and flat files). ISO 27002: Managers should regularly review the compliance of information processing and procedures within their area of responsability with the appropiate security policies, standars and any other security requirements. CAS IPY-04 The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved. CSA IPY-05 The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use and all solution-specific virtualization hooks available for customer review.

54 03 Preliminary findings 13. Compliance (4/4) ISO C5 GERMANY CSA-CCM CCSM-ENISA ISO 27002: Information systems should be regularly reviewed for compliance with the organization's information security policies and standards. CSA MOS-06 All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data. CSA MOS-14 BYOD and/or company-owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls. CSA MOS-15 Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes. CAS MOS-20 The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device. CAS IPY-01 The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications. C5 COM-02 Planning independent, external audits C5 COM-03 Carrying out independent, external audits CSA AAC-02 Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.

55 03 Preliminary findings 14. Security Assessment C5 SPN-01 Notification of the top management C5 SPN-02 Internal audits of the compliance of IT processes with internal security policies and standards C5 SPN-03 Internal audits of the compliance of IT systems with internal security policies and standards CCSM-ENISA SO 21 - Security assessments CCSM-ENISA SO 20 - System tests

56 03 Preliminary findings 15. Device Management ISO C5 GERMANY CSA-CCM CCSM-ENISA C5 MDM-01 Policies and procedures for the risk minimisation of access via the cloud provider's mobile terminal devices

57 03 Preliminary findings 16. Interoperability & Portability ISO C5 GERMANY C5 PI-01 Use of public APIs and industry standards C5 PI-02 Export of data C5 PI-03 Policy for the portability and interoperability C5 PI-04 Secure data import and export C5 PI-05 Secure deletion of data CSA-CCM CCSM-ENISA CCSM-ENISA SO 26 - Cloud interoperability and portability

58 03 Preliminary findings 17. System Security & Integrity ISO C5 GERMANY CSA-CCM CSA DCS-03 Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location. CCSM-ENISA CCSM-ENISA SO 11 - Integrity of network and information systems CCSM-ENISA SO 23 - Cloud data security CCSM-ENISA SO 24 - Cloud interface security CCSM-ENISA SO 25 - Cloud software security

59 03 Preliminary findings 18. Change & Configuration Management ment ISO C5 GERMANY CSA-CCM CCSM-ENISA CCSM-ENISA SO 13 - Change management

60 03 Preliminary findings 19. Risk / Threat / Vulnerability Management bility ISO C5 GERMANY CSA-CCM CSA GRM-05 Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned. CCSM-ENISA CCSM-ENISA SO 02 - Risk management

61 Agenda 01 Procedure 02 Gaps 03 Preliminary findings 05 Next steps 04 Work in progress

62 04 Work in progress Currently matching EC-CLOUD controls with NIST-SP (it has 1,683 controls) Performing the gap analysis (as-is vs. should)

63 Agenda 01 Procedure 02 Gaps 03 Preliminary findings 05 Next steps 04 Work in progress

64 05 Next steps Based on the results from the gap analysis, derive the recommendations about the controls that a EU-wide cloud security certification scheme should cover.

65 Conchi Cortés División ICT / ICT Division IT Competitiveness Concepcion.cortes@tecnalia.com C/ Velázquez 64-66, 2º Derecha E Madrid (Spain) Tel: *. Tel: (International Calls) Mob: Visita nuestro blog: