Cloud Security Alliance

Алексей Вячеславович Бердник

Milan Chauhan, Stavros Shiaeles

The rapidly growing use of cloud computing raises security concerns. This study paper seeks to examine cloud security frameworks, addressing cloud-associated issues and suggesting solutions. This research provides greater knowledge of the various frameworks, assisting in making educated decisions about selecting and implementing suitable security measures for cloud-based systems. The study begins with introducing cloud technology, its issues and frameworks to secure infrastructure, and an examination of the various cloud security frameworks available in the industry. A full comparison is performed to assess the framework’s focus, scope, approach, strength, limitations, implementation steps and tools required in the implementation process. The frameworks focused on in the paper are COBIT5, NIST (National Institute of Standards and Technology), ISO (International Organization for Standardization), CSA (Cloud Security Alliance) STAR and AWS (Amazon Web Services) well-architected framework. Later, the study digs into identifying and analyzing prevalent cloud security issues. This contains attack vectors that are inherent in cloud settings. Plus, this part includes the risk factor of top cloud security threats and their effect on cloud platforms. Also, it presents ideas and countermeasures to reduce the observed difficulties.

Taarika Hegde, Josh Gangl, Stanislav Babenko, Joel Coffman

The expansion of cloud computing applications and services has introduced a number of control and audit frameworks designed to provide a standard around data access, cloud security, and digital enablement. While certification frameworks and security standards have become the de facto industry guidance for IT governance, there is a notable absence of a fundamental rating and review system for the frameworks themselves. This research evaluates cloud provider security standards set forth by ISO/IEC 27001 and 27002, FedRAMP, and SOC 2 against a third-party benchmark, the Cloud Controls Matrix (CCM) created by the Cloud Security Alliance (CSA), as well as the CSA's "Treacherous Twelve" of the top threats to cloud computing security. Recent revisions of ISO/IEC-27001 and 27002 and FedRAMP significantly improve their coverage of CCM controls; SOC 2 provides less coverage overall but remains a viable alternative to the aforementioned certifications.

Amartya Sen, S. Madria

R. Samani, Brian Honan, J. Reavis