Cloud Security checklist

Is the security team ready for the Cloud?

• Is the security team aware of / knowledgeable about cloud?
• Does the organization have a cloud security strategy with which its auditors would be happy?
• Has security governance been adapted to include cloud?
• Does the team’s structure enable cloud security?
• Has the security team updated all security policies and procedures to incorporate cloud?
• Has the security team provided guidance to the business on how to remain secure within a cloud environment?

Management

• Is everyone aware of his or her cloud security responsibilities?
• Is there a mechanism for assessing the security of a cloud service?
• Does the business governance mitigate the security risks that can result from cloud-based “shadow IT”?
• Does the organization know within which jurisdictions its data can reside?
• Is there a mechanism for managing cloud-related risks?
• Does the organization understand the data architecture needed to operate with appropriate security at all levels?
• Can the organization be confident of end-to-end service continuity across several cloud service providers?
• Can the provider comply with all relevant industry standards (e.g. the UK’s Data Protection Act)?
• Does the compliance function understand the specific regulatory issues pertaining to the organization’s adoption of cloud services?

Operation

• Are regulatory compliance reports, audit reports and reporting information available form the provider?
• Does the provider have the right attitude to incident resolutions and configuration management, even when services involve multiple providers?
• Does using a cloud provider give the organization an environmental advantage?
• Does the organization know in which application or database each data entity is stored or mastered?
• Is the cloud-based application maintained and disaster tolerant (i.e. would it recover from an internal or externally caused disaster)?
• Are all personnel appropriately vetted, monitored and supervised?
• Is the provider able to deliver a service within the required performance parameters?
• Is it easy to securely integrate the cloud-based applications at run time and contract termination?
• Do you know the location from which the provider will deliver support and management services?
• Do the procurement processes contain cloud security requirements?

Technology

• Are there appropriate access controls (e.g. federated single sign-on) that give users controlled access to cloud applications?
• Is data separation maintained between the organization’s information and that of other customers of the provider, at run time and during backup (including data disposal)
• Has the organization considered and addressed backup, recovery, archiving and decommissioning of data stored in a cloud environment?
• Are mechanisms in place for identification, authorization and key management in a cloud environment?
• Are all cloud-based systems, infrastructure and physical locations suitably protected?
• Are the network designs suitably secure for the organization’s cloud adoption strategy?

Hardening

• Install all security patches.
• Have an easy way to show patches installed.
• Scan your servers for vulnerabilities (at least quarterly).
• Re-mediate vulnerabilities within a reasonable time frame in an automated way.
• Bake hardening and patches into images. When servers come up, they should be security- and compliance-“ready.”
• Build integration testing into your security if you don’t already have it, lest your regression testing be pain full.
• Allow least privileges on ports in firewalls, network ACLs, security groups, iptables/firewall, Windows Advanced Firewalls, and the like. Use Infrastructure as Code if and whenever possible.
• Use industry guides to help you harden
• Don’t shoot for 100 percent up front but make reasonable progress. This is what auditors expect to see
• Use tools to help you scan and harden.
• Keep a compliance dashboard.

Logging 

• Use Rsyslog, Windows Event Log Forwarding, third-party tool, etc. for log shipping, and use a method to ship logs securely for analysis, storage, and archiving.
• Retain logs for minimum control requirements (often 1-7 years).
• Ensure that storage of logs with sensitive data is encrypted (this includes backups!).
• Ensure that access to sensitive data is logged.

Encryption checklist:

• Use hardware encryption for encryption at rest. This will reduce the impact on performance. Cycle the key at least annually. If hardware encryption isn’t available, encrypt disks with software (and expect a performance hit).
• For encryption in transit, ensure that HTTPS or SSL is used with medium-strength ciphers at a minimum (over 128 bits) and strong hashes. Only terminate encryption at the point of processing.
• Safeguard all private keys for certificates and public keys.
• Encrypt data in databases if you can handle the performance loss. It’s an extra layer of protection.
• Encrypt backups with AES-256 or stronger encryption.
• Encrypt stored files (think S3) with AES-256 or stronger encryption.
• Use VPN tunnels with at least AES-256 or stronger encryption.