Cloud Security

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.10.2 Cloud Security], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

The responsibilities and roles for information security and personal information protection shall be clearly defined with the cloud service provider and reflected in the contract (SLA, etc.).

• Roles and responsibilities according to cloud service type (example)

Cloud service type	Cloud service provider	Cloud service user
IaaS	- Facility security and access control of the physical area - Security patching of the host OS - Security management of virtual machines such as the hypervisor, etc.	- Security patching of the guest OS, middleware, and applications - Security configuration and settings for the guest OS, middleware, applications, and private network area - Data security - Administrator and user privilege management, etc.
PaaS	- Roles and responsibilities of the cloud service provider in the IaaS area - Security settings of the network area - Security patching, security configuration, and settings for the guest OS and middleware area	- Application security patching and security settings - Data security - Administrator and user privilege management, etc.
SaaS	- Roles and responsibilities of the cloud service provider in the IaaS and PaaS areas - Application security patching and security settings - Data security (data-level access control, encryption, etc.), etc.	- Application administrator and user privilege management, etc.

※ This may vary depending on the cloud service operator, service configuration, and characteristics, etc.

When using cloud services, security control policies such as security configuration and setting standards, security setting change and approval procedures, secure access methods, and permission structures shall be established and implemented by assessing the security risks according to the service type so as to prevent unauthorized access, configuration errors, and the like.

• Risk assessment for the use of external cloud services : consider aspects such as service quality and continuity, legal compliance, and security

• Establishment/implementation of security control policies that reflect the results of the cloud service risk assessment

  ※ Cloud service security control policy (example) (needs to reflect characteristics according to the cloud service type)

  • Roles and responsibilities related to security management
  • Virtual network security configuration and access control
  • Cloud service administrator account and privilege management (top administrator and per-domain administrators, etc.)
  • Strengthened authentication for cloud service administrators (OTP, etc.)
  • Security setting standards (authentication, encryption, session management, access control, public exposure settings, lockout for long-term inactivity, log recording, backup, etc.)
  • Security setting registration/change/deletion procedures (application, approval, etc.)
  • Adequacy review of security configuration and settings
  • Access control and privilege management procedures for the cloud management console
  • Management procedures for the issuance, use, and revocation of Access Keys
  • Cloud service remote access paths and methods (VPN, IP address restriction, 2-factor authentication, etc.)
  • Cloud service security monitoring and alarm/monitoring measures
  • Security audit procedures, etc.

Cloud service administrator privileges shall be granted with minimization according to role, and protection measures such as strengthened authentication, encryption, access control, and audit logging shall be applied to prevent unauthorized access to and misuse/abuse of administrator privileges.

• Granularization of cloud service administrator privileges : top administrator, virtual network administrator, security administrator, DevOps administrator, etc.
• Minimized granting of administrator privileges according to task and role
• Application of strengthened authentication for cloud administrator privileged access : OTP, security key, etc.
• Application of communication encryption or VPN for the remote access segment
• Detailed logging and monitoring of cloud administrator access and privilege settings, etc.

Cloud service security setting changes, operational status, and the like shall be monitored, and their adequacy shall be reviewed periodically.

• Alarm settings and monitoring so that unapproved environment configuration and security setting changes to cloud services can be detected

• Periodic review and remediation of whether cloud service security settings are adequate

  ※ Precautions

  • All other necessary protection measures, such as the adequacy of access control (network access, information system access, database access, application access, etc.) in the cloud environment, authentication and privilege management, encryption, and system and service security management, must be applied

[Status of CSA cloud service security threats]

	Top 7 cloud security threats (2010)	Top 9 cloud security threats (2011)	Top 12 cloud security threats (2016)
Administrative security threats	Abuse of cloud computing Malicious insiders	Abuse of cloud computing Malicious insiders Lack of understanding of cloud services	Abuse of cloud computing Malicious insiders Lack of understanding of cloud services Insufficient authentication and access management APT
Technical security threats	Insecure APIs Virtualization vulnerabilities Data loss Account, service & traffic hijacking Undisclosed threats	Insecure APIs Virtualization vulnerabilities Account, service & traffic hijacking Data leakage Data loss Denial of service (DoS)	Insecure APIs Virtualization vulnerabilities Account, service & traffic hijacking Data leakage Data loss Denial of service (DoS) System vulnerabilities

※CSA : Cloud Security Alliance

<Source> Cloud Information Security Guide (KISA)

[Example of the procedure for establishing a cloud security architecture]

Phase	Procedure	Details
Definition of the current security architecture	Definition of the current security architecture	- Security policies/guidelines/procedures - Security configuration diagrams/relationship diagrams/technical documents
Definition of the current security architecture	Analysis of the current security architecture	- Analysis of the administrative/technical/physical security status
Cloud security analysis	Analysis by cloud security element	- Service environment analysis - Definition of element technologies
Cloud security analysis	Summary of issues and analysis results by cloud security perspective
Goal setting and task definition	Definition of cloud security application measures
Goal setting and task definition	Setting of cloud security architecture goals	- Cloud configuration diagram - Technologies and elements applied to the cloud
Goal setting and task definition	Definition and execution of cloud security architecture tasks

<Source> Cloud Information Security Guide (KISA)