The Cloud Security Alliance (CSA) has released the long awaited version 3 of the ‘Security Guidance for Critical Areas of Focus in Cloud Computing’. This is the first update to the guidance since version 2.1 was released in 2009 and is a major overhaul bringing the guidance up to date in the new and fast moving world that is ‘cloud’ computing.
In addition to updating all of the existing domains of the guidance, there has been the addition of Domain 14 – Security as a Service (SecaaS), this is the domain I have contributed extensively to and has it’s basis in the white paper I co-chaired the publication or a few months ago.
As an overview version 3 comprises of the following domains in the context of cloud security;
Section I. Cloud Architecture
- Domain 1: Cloud Computing Architectural Framework
Section II. Governing in the Cloud
- Domain 2: Governance and Enterprise Risk Management
- Domain 3: Legal Issues: Contracts and Electronic Discovery
- Domain 4: Compliance and Audit Management
- Domain 5: Information Management and Data Security
- Domain 6: Interoperability and Portability
Section III. Operating in the Cloud
- Domain 7: Traditional Security, Business Continuity, and Disaster Recovery
- Domain 8: Data Centre Operations
- Domain 9: Incident Response
- Domain 10: Application Security
- Domain 11: Encryption and Key Management
- Domain 12: Identity, Entitlement, and Access Management
- Domain 13: Virtualization
- Domain 14: Security as a Service
The guidance can be freely downloaded from the CSA website here;
https://cloudsecurityalliance.org/research/initiatives/security-guidance/
It is relatively long, but covers a lot of what you need to know about cloud security and things you need to consider if you are planning to move your data to a ‘cloud’ type service.
K
