Cloud Security Audit Process

 Phase I - Conduct As-Is Analysis

·         Technology Assessment

o   Hardware

§  On premise server

§  Router/Switch/Firewall

§  Encryption

o   Software

§  OS

§  DB

§  Application (Fuzz testing)

o   Cloud

§  Existing

·         Cloudfare (All services being purchased and used)

o   CDN (Cloud Delivery Network)

o   PWA (Progessive Web App)

·         Radware (All services being purchased and used)

o   (CWAF) Cloud Web Application Firewall

o   Bot Management

§  Capabilities

·         Secure Web Gateways (SWG)

·         Cloud Access Security Broker (CASB)

·         Zero Trust Network Access (ZTNA)

·         Firewall-as-a-service (FWaaS)

·         Data Assessment

o   Company Data

o   Customer Data

·         Communication Assessment

o   Data in transit cryptography

·         Documentation Assessment

o   Incident Response Plan (IRP)

o   Information System Contingency Plan (IRP)

o   System Security Plan (SSP)

o   Vulnerability Management Plan (VMP)

o   Concept of Operations (CONOPS)

·         Threat Landscape

o   Threat surface

o   Threat vector

o   Threat actor

§  Nation State

§  Insider Threat

§  Competitors

·         Compliance Requirements

o   PCI

o   GBLA

o   Privacy Act

o   FISMA 2002

o   GDPR (Europe)

o   DISA STIG

o   CIS Benchmark

 

Phase II - To-Be Recommendation

·         Technology

o   Hardware Recommendation

§  Router/Switch/Firewall Architecture

§  Encryption (AES 256 or higher)

o   Software Hardening Recommendation

§  OS Hardening

§  DB Hardening

§  Application Hardening

§  Data at Rest Encryption

§  Data in Transit Encryption

§  RBAC

o   Cloud Cybersecurity Recommendation

§  Multi Vendor

§  Single Vendor

o   Testing Recommendation

§  Based on compliance requirements

·         Documentation

o   System Architecture

o   Security Boundary

o   Incident Response Plan (IRP)

o   Information System Contingency Plan (IRP)

o   System Security Plan (SSP)

o   Vulnerability Management Plan (VMP)

o   Concept of Operations (CONOPS)

Vulnerability Management Plan

 A Vulnerability Management Plan (VMP) is a comprehensive strategy designed to proactively identify, assess, prioritize, and mitigate vulnerabilities in an organization's IT systems and infrastructure. It involves the systematic process of discovering, analyzing, and addressing potential weaknesses that could be exploited by malicious actors.

Here are the key elements typically included in a Vulnerability Management Plan:

1. Policy and Governance: Establish a formal policy and governance framework that outlines the organization's commitment to vulnerability management. This includes defining roles and responsibilities, establishing reporting and escalation procedures, and ensuring compliance with relevant regulations and standards.

2. Vulnerability Scanning and Assessment: Conduct regular vulnerability scans using automated tools to identify weaknesses and security flaws in systems, networks, and applications. These scans may include network scans, web application scans, and penetration testing to identify vulnerabilities from different angles.

3. Risk Assessment and Prioritization: Evaluate the identified vulnerabilities based on their potential impact and likelihood of exploitation. Assign risk ratings or scores to prioritize remediation efforts based on criticality, business impact, and other relevant factors.

4. Remediation and Patch Management: Develop a systematic process for addressing vulnerabilities, including patch management procedures, configuration changes, or other mitigation techniques. Establish timelines and accountability for applying patches or implementing remediation measures promptly.

5. Incident Response and Communication: Define protocols for responding to and addressing vulnerability-related incidents. This includes establishing an incident response team, defining communication channels, and coordinating with stakeholders, such as IT teams, management, and relevant authorities.

6. Continuous Monitoring and Reporting: Implement ongoing monitoring and periodic assessments to ensure that vulnerabilities are effectively managed. Generate reports on the status of vulnerabilities, remediation progress, and overall risk posture to provide visibility and support decision-making.

7. Training and Awareness: Promote security awareness among employees and stakeholders to educate them about the importance of vulnerability management and their role in maintaining a secure environment. Offer training programs, guidelines, and resources to help individuals understand and respond to vulnerabilities effectively.

Remember, a Vulnerability Management Plan is a dynamic document that needs to be regularly updated and adapted to address emerging threats and changes in the IT landscape. It should be integrated into the organization's overall security program and aligned with other risk management processes to ensure a comprehensive and robust security posture.

Carbon Black Container's Secret Scanning tool

Synk tool

PHP_CodeSniffer Overview

 

Keys to Continuous Delivery

 

• Process should be automated

• Reduces the number of features introduced per release, minimizing shock to users

• Will reduce the standard release cycle

• Changes approach to releasing software from an event to a non-event

• Helps to avoid off-hour, high risk, expensive deployments

• Know your rollback plan (do you rollback or roll forward only)

• Build in health checks

Improve Deployments-DevOps

 Here are some common things that DevOps teams do to improve software releases:

• Increase efficiency – less waste

• Decrease time to commit software changes

• Automate tests

• Identify defects/issues quickly

• Automate the build process

• Simplify the deployment process

• Make deployments reproducible

• Automate as much as possible

How CI Improves Efficiency

 

• Simplify Merges

• Rapid Feedback

• Identify problems early

• Makes bugs easier to find

• Reduce bug accumulation

• Visibility (team and stakeholders)

• Builds Automated 

• minimizes manual intervention

• plug-ins (i.e. for static code analysis, gathering metrics)

• Precursor to Continuous Delivery & Deployment

Principles of Continuous Integration

 

• Maintain a code repository

• Automate the build

• Make the build self-testing

• Everyone commits to the baseline every day

• Every commit (to baseline) should be built

• Keep the build fast

• Test in a clone of the production environment

• Make it easy to get the latest deliverables

• Everyone can see the results of the latest build

• Facilitate automated deployments