Independent Cloud Auditing (R. Cope, S. Cope, Erl, Morawala)
How can cloud-hosted IT resources be audited for compliance and SLA requirements when they are not owned or accessible by cloud consumers?
ProblemAssessments for security requirement objectives of confidentiality, integrity, and availability need to be performed by cloud consumers, providers, and third-party participants to ensure legal, security compliance, audit policy, and service level agreement (SLA) requirements are met. However, depending on the cloud service and delivery models, the organization does not own all the IT resources being consumed.
SolutionA specialized auditing approach is implemented in coordination with the cloud consumer, cloud provider, and a third-party cloud auditor.
ApplicationAuditing implementation, including configuration of security information and event management (SIEM) systems, can be determined based on regulatory compliance requirements and collaboration responsibilities between the cloud consumer, cloud provider, and a third party.
Compound PatternsBurst In, Burst Out to Private Cloud, Burst Out to Public Cloud, Cloud Authentication, Elastic Environment, Infrastructure-as-a-Service (IaaS), Isolated Trust Boundary, Multitenant Environment, Platform-as-a-Service (PaaS), Private Cloud, Public Cloud, Resilient Environment, Resource Workload Management, Secure Burst Out to Private Cloud/Public Cloud, Software-as-a-Service (SaaS)
A sample cloud auditing process (Part I).
A sample cloud auditing process (Part II).