Cloud Services and Security

The report analyzes information security risks associated with cloud services and defines controls organizations should implement to manage them. Cloud adoption is widespread, including both deliberate use for business transformation, agility, and cost reduction (e.g., email and CRM) and informal employee-driven use to “get the job done.” Cloud computing is framed as an alternative delivery method rather than a strategic question in itself; the central task is balancing risks and rewards for each business need.

Because cloud services place infrastructure and service control primarily with the Cloud Service Provider (CSP), risk and compliance conditions change, and responsibility becomes shared. Large CSPs often implement strong infrastructure security, making customer misunderstanding of shared responsibility and weak customer-side controls a common cause of breaches. Compliance is frequently more complex than security because customers may remain accountable even if a CSP fails, while contracts typically limit CSP liability. Regulated-data use therefore requires independent verification of compliance and, where needed, supplementary customer controls.

Risk and responsibility vary by service model (IaaS, PaaS, SaaS, plus BPaaS and cloud-delivered IT management services) and by deployment model (public, private, community, hybrid). The report recommends governance-based risk management rooted in business objectives, procurement discipline, and measurable security/compliance requirements. It emphasizes information-centric security: classify data and applications by sensitivity and business criticality, then select controls accordingly. Key risk areas include loss of governance, lock-in and data return, non-compliant processing and privacy obligations, ineffective identity and access management, business continuity disruptions, cyber threats (DDoS/malware), platform isolation failures, insider abuse, management-interface compromise, interception of data in transit, ineffective data deletion, media loss/data breach, loss of keys/passwords, backup and recovery gaps, and log/journal compromise.

• Cloud service use places control of service and infrastructure in the hands of the Cloud Service Provider (CSP).
• Overall responsibility for security is shared between the cloud customer and the CSP.
• The NIST definition describes five essential characteristics, three service models, and four deployment models of cloud computing.
• IaaS provides basic computing infrastructure such as processing power, storage, and network.
• PaaS provides hosted application development and delivery capabilities, including tools and middleware.
• SaaS delivers packaged applications managed and run by the service provider, often bought on a charge-per-use basis.
• Public cloud services process customer data on shared infrastructure and are available for anyone to subscribe to and use.
• A private cloud deployment guarantees that some infrastructure is exclusive to an individual customer.
• GDPR is described as coming into force in May 2018 and applying worldwide to organizations processing data relating to EU residents.
• The report cites Spectre and Meltdown vulnerabilities as examples that could compromise isolation on shared machines.

• “Cloud computing is not a strategic business or IT question.”
• “The challenge is to balance the risks and rewards for each specific business need.”
• “A governance-based approach allows trust in the CSP to be assured through a combination of internal processes, standards and independent assessments.”
• “In all cases the cloud customer is responsible for the security and compliance of the data processed in cloud services.”
• “Organizations need to take an information centric approach to the security of cloud services.”
• “Information centric security is fundamental to regulatory compliance.”
• “The key security objectives are confidentiality, integrity and availability of information and compliance with laws and regulations.”
• “The first step to an information centric approach is data classification.”
• “You can’t protect what you don’t know you have.”
• “There is no such thing as perfect security; managing security is always a question of balancing risk against rewards”