A reference guide for cloud security based on security and risk Management (SRM) framework.

1. By - Mithilesh Kumar (kumar.mithilesh@gmail.com)
1Reference :- cloudsecurityalliance.org

2.  Define protections that enable trust in the cloud.
 Develop cross-platform capabilities and patterns for proprietary and open-source providers.
 Will facilitate trusted and efficient access, administration and resiliency to the
customer/consumer.
 Provide direction to secure information that is protected by regulations.
 The Architecture must facilitate proper and efficient identification, authentication,
authorization, administration and auditability.
 Centralize security policy, maintenance operation and oversight functions.
 Access to information must be secure yet still easy to obtain.
 Delegate or Federate access control where appropriate.
 Must be easy to adopt and consume, supporting the design of security patterns.
 The Architecture must be elastic, flexible and resilient supporting multi-tenant, multi-landlord
platforms.
 The architecture must address and support multiple levels of protection, including network,
operating system, and application security needs.
2

3. 3

4. 4

5. SRM
5

6. SRM
Security & Risk Management
6
When every business is a digital business, IT security and business risk
become one and the same.

7.  Privilege Management Infrastructure
 Threat andVulnerability Management
 Infrastructure Protection Services
 Data Protection
 Policies and Standards
 Governance Risk & Compliance
 InfoSec Management
7

8. Identity Management
Domain Unique Identifier
Identity Provisioning
Attribute Provisioning
Federated IDM
Authentication Services
SAMLToken
Risk Based Auth
Multifactor
OTP
Smart Card
Password Management
Biometrics
NetworkAuthentication
Single Sign On
WS-Security
Middleware Authentication
IdentityVerification
OTBAutN
Authorization Services
Entitlement Review
Policy Enforcement
Policy Definition
Policy Management
Principal Data Management
Resource Data Management
XACML
Role Management
Obligation
Out of the Box (OTB)AutZ
Privilege Usage Management
Keystroke/Session Logging
PasswordVaulting
Privilege Usage Gateway
Resource Protection
Hypervisor Governance and Compliance
8

9. ComplianceTesting
Network
Server
Database
PenetrationTesting
Internal
External
Vulnerability Management
Application
Database
Infrastructure
Threat Management
Source Code Scanning
Risk Management
9

10. Server
Behavioral Malware Prevention
White Listing
Sensitive File Protection
Anti-Virus
HIPS / HIDS
Host Firewall
End-Point
Anti-Virus,Anti-Spam,Anti-Malware
HIPS /HIDS
Host Firewall
Media Lockdown
Hardware BasedTrustedAssets
Behavioral Malware Prevention
InventoryControl
Content Filtering
ForensicTools
White Listing
Network
Behavioral Malware Prevention
Firewall
Content Filtering
Deep Packet Inspection
NIPS / NIDS
Wireless Protection
Link Layer Network Security
Black Listing Filtering
Application
Application Firewall
Secure Messaging
Secure Collaboration
RealTime Filtering
XML Application
10

11. Data lifecycle management
Meta Data Control
Data De-Identification
Data Masking
DataTagging
Data Obscuring
Data Seeding
Life cycle management
eSignature (Unstructured data)
Data Loss Prevention
Data Discovery
Network (Data inTransit)
End-Point (Data in Use)
Server (Data at Rest)
Intellectual Property Protection
Intellectual Property
Digital Rights Management
Cryptographic Services
Symmetric Key Management
Asymmetric Key Management
PKI
Signature Services
Data-in-use Encryption (Memory)
Data-in-Transit Encryption (Transitory, Fixed)
Data-at-Rest Encryption (DB, File, SAN, Desktop, Mobile)
11

12. Operational Security Baselines
Job Aid Guidelines
Role Based Awareness
Information Security Policies
Technical Security Standards
Data/Asset Classification
Best Practices & Regulatory correlation
12

13. Compliance Management
Policy Management
Exceptions
Self Assessment
Vendor Management
Audit Management
IT Risk Management
TechnicalAwareness andTraining
13

14. Capability Mapping
Risk Portfolio Management
Risk Dashboard
Residual Risk Management
14

15.  Email:- kumar.mithilesh@gmail.com
 LinkedIn :- https://in.linkedin.com/in/kumarmithilesh
15