Business Requirements to Adopt Cloud Service

Decision should be made that assist the business in reaching its long-term goals. They should never be made because they seem attractive or your competitors are doing it. You should have sound business reasons for deciding to use a cloud provider and for determining which one to choose.

Reference from CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide
https://www.amazon.com/Certified-Cloud-Security-Professional-Official/dp/1119277418

ISO27034-1 ONF, ANF

Organization Normative Framework (ONF)

the ONF is a company-wide repository of Application Security Controls (ASC) and processes. The organization can store and update ASCs in a central library caled an ASC Library, which is part of the ONF. The ONF also specifies how and when an application development project should use a particular security activity, such as conducting a penetration test.

Application Normative Framework (ANF)

The ANF is the set of ASCs and application security processes that apply to a particular application, based on its contexts, specifications (i.e. functional requirements or user stories) and its development & operational processes (a.k.a. application life cycle).

Referenced from https://blog.securitycompass.com/a-laymans-guide-to-the-iso-27034-17c72b91ae07

Trade Secrets

They cannot be disclosed to the public, and efforts must be made to maintain secrecy.

Reference from CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide
https://www.amazon.com/Certified-Cloud-Security-Professional-Official/dp/1119277418

Policies

Policies ensure that the organization is operating within its risk profile. Policies actually define, or are the expression of, the organization's risk tolerance.

When engaging in risk tolerance, people and business consider how far they will go in taking risk before the potential risk outweighs the opportunity.

It is also the CCSP's job to educate stakeholders about cloud computing risks and benefits so that they are better to make fact-based decisions as opposed to relying on hearsay and gossip.

The risk profile of the organization is a comprehensive analysis of the possible risks the organization is exposed to.

It is impossible to remove risk. Never believe anyone who says that something has "zero risk" or that a control offers "100 percent security." Even with all possible controls placed on a business function, there will still remain some level of risk; we call this "residual risk."

Reference from CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide
https://www.amazon.com/Certified-Cloud-Security-Professional-Official/dp/1119277418

Cryptography

The single most effective way to combat multitenancy issues, data leakage, and similar problems is by using encryption.

Referenced from CSCP (ISC)2 Certified Cloud Security Professional Official Study Guide

Security Controls

1. Physical Control
Limit physical access to assets or that operate in a manner that reduce the impact of a physical event. E.g., locks on door, fire suppression equipment, fences and guards.

2. Technical Control
Also referred to as logical control. Enhance some facets of the CIA triad, usually operating within a system, often in electronic fashion. E.g., Encryption mechanisms, access control lists, audit trails and logs of system activity.

3. Administrative Control
Process and activities (necessarily not physical or technical) that provide some aspect of security. E.g., personnel background checks, scheduled routine log reviews, mandatory vacations, robust and comprehensive security policies and procedures, and designing business process so that there are no single point of failure and so that proper separation of duties exists.

Referenced from CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide.

CCSP 準備

1. what are the new security considerations when moving out to the cloud or using cloud services?

2. What are the new risks from cloud computing?

3. These security considerations can be technical, policy compliance and even jurisdiction. Cloud computing has advantages. At the same time, organisations lose some control when moving to cloud. What control do they lose?

4. What are the options available to address these new cloud-related risks?

5. Who is responsible for what aspects of security? Cloud provider or cloud customer?

6. How does an organisation ensure their data in the cloud is secure?

7. The location of cloud provider DC is important from a legal, privacy and compliance perspective. How does one ensure compliance with different laws?

Reference from:
http://www.techexams.net/forums/isc-sscp-cissp/125863-my-ccsp-experience-comments.html

Access Management

Access Management should (depending on the business / security requirements, and the type if cloud model, Iaas, Paas, or Saas being deployed) govern access to the;

• Network layer. Without meeting the entitlement rules it may not even be possible to "see" (i.e. Ping or route) to the cloud system. The entitlement rule may also direct access to particular interfaces.
• System layer. The entitlement rules may define the protocols that are permitted to access and modify systems, such as terminal server vs. web.
• Application layer. The entitlement rules may map Identity and/or Attributes to functionality provided by a specific application, such as being presented with a reduced set of menus or options.
• Process layer. The entitlement rules can be used to define the processes. (or functions) that can be run within an application. Entitlement may also define that enhanced functions (such as transferring money out of the ecosystem) need additional verification (which may be obtained directly or derived in the background).
• Data layer. The entitlement rules may limit access to areas of the data and file structure or even individual files or fields within files (e.g., in a database). At a more advanced level, entitlement could be used to auto-redact documents, such that two users accessing identical documents would view different contents (e.g., constructing a specific dynamic view of a database table).

The entitlement process starts with the customer to turn business requirement and security requirements into a set of entitlement rules. This process will define the identities and Attribute required to be able to evaluate the rules. These rules in turn drive the authorization/access system.

Reference from CSA Security Guidance for Critical Areas of Focus in Cloud Computing V3.0.

The Four D's Perimeter Security

1. Deter
2. Detect
3. Delay
4. Deny

Risk Profile

The risk profile is determined by an organization's willingness to take risks as well as the threats to which it is exposed.

The risk profile should identify the level of risk to be accepted, the way risks are taken, and the way risk-based decision making is performed. Additionally, the risk profile should take into account potential costs and disruptions should one or more risks be exploited.

Referenced from The Official ISC2 Guide to the CCSP CBK.

Due Care / Due Diligence

Due Care: the development and implementation of policies and procedures to aid in protecting the company, its assets, and its people from threats. (避免風險, 降低風險)

Due Diligence: the act of investigating and understanding the risks a company faces. (找出風險, 評估風險)

Key Principles of an Enterprise Architecture

1. Define protection that enable trust in the cloud

2. Develop cross-platform capabilities and patterns for proprietary and open source providers.

3. Facilitate trusted and efficient access, administration, and resiliency to the customer or consumer.

4. Provide direction to secure information that is protected by regulations.

5. Facilitate proper and efficient identification, authentication, authorization, administration, and  auditability.

6. Centralize security policy, maintenance operation, and oversight functions.

7. Make access to information both secure and easy to obtain.

8. Delegate of federate access control where appropriate.

9. Ensure ease of adoption and consumption, supporting the design of security patterns.

10. Make the architecture elastic, flexible, and resilient, supporting mutitenant, mutilandlord platforms.

11. Ensure the architecture address and support multiple levels of protection, including network, OS, and application security needs.