In 2009, the Cloud Security Alliance (CSA) released its first Security Guidance for Cloud Computing document. 15 years later, it has published the fifth version, Security Guidance for Critical Areas of Focus in Cloud Computing. Additions include the latest developments in zero trust, generative AI, CI/CD, security monitoring and operations, resilience, cloud telemetry and security analytics, and data lakes. Version 5 also has reduced coverage of laws and regulations and has removed the security-as-a-service domain.
Cloud security domains covered:
- Cloud computing concepts and architectures
- Cloud governance
- Risk, audit, and compliance
- Organization management
- Identity and access management
- Security monitoring
- Infrastructure and networking
- Cloud workload security
- Data security
- Application security
- Incident response and resilience
- Related technologies and strategies.
Cloud resilience guidance
In terms of resilience, this focuses on ‘Preparation and Resilience Planning’ and covers the following:
Preparation
- Perform proactive scanning, monitoring, vulnerability, and risk assessments.
- Subscribe to third-party threat intelligence services.
- Evaluate cloud service providers’ capabilities to support IR.
- Regularly audit logs, snapshots, forensic capabilities, and e-discovery features.
- Conduct regular backup restoration and disaster recovery tests.
Resilience Planning
Single-Region Resiliency
- Employ strategies like autoscaling and load balancing.
- Implement backup and recovery strategies.
Multi-Region Resiliency
- Run parallel deployments across multiple regions.
- Handle additional costs for data synchronization and transfer charges.
Multi-Provider Resiliency
- Spread the application’s footprint across multiple cloud providers.
- Manage disparate networking, storage, and security models.
- Address increased costs and complexities for critical applications.
