ISACA spells out how to implement controls for a secure cloud
Connecting state and local government leaders
A new book on how to implement effective controls and governance for cloud computing, designed to work with NIST's model, could help government agencies build secure cloud infrastructures.
A new book that gives guidance on how to implement effective controls and governance for cloud computing could be useful to government agencies looking to deploy secure cloud infrastructures.
The book, "IT Control Objectives for Cloud Computing: Controls and Assurance in the Cloud," is designed to help organizations manage increasing risk and ensure continuity of critical business processes that extend beyond the data center, according to officials with ISACA, the organization that published the new guidelines.
ISACA is a global provider of knowledge, certifications, community, advocacy and education on information systems assurance and security and IT governance. The organization, which has 95,000 constituents in 160 countries, was formerly known as the Information Systems Audit and Control Association.
Related coverage:
Done right, a virtualized cloud can improve your security, DHS official says
Based in Rolling Meadows, Ill, ISACA developed the Control Objectives for Information and Related Technology (COBIT), a comprehensive framework that addresses every aspect of IT.
The book provides insight into how ISACA frameworks and tools such as COBIT, Risk IT, Val IT and the Business Model for Information Security can assist enterprises in assessing the cloud’s business value versus its business risk.
This information might be valuable to government agencies using COBIT to assess security controls for private clouds.
For instance, the Homeland Security Department used COBIT and National Institute of Standards and Technology security controls to assess the security requirements for a virtualized cloud infrastructure, said Greg Capella, deputy executive director with DHS’ CIO Office.
DHS has ongoing initiatives in the private and public clouds. Assessing the various security controls outlined in COBIT and NIST 800-53, DHS officials determined that applying virtualization technology without additional controls and procedure would have an adverse impact on cloud environments. However, implementation of the right processes and procedures could provide better security than in physical environments, Capella said July 20 during a presentation at the FOSE conference in Washington, D.C.
The book gives managers implementing cloud infrastructures “prescriptive guidance of how you would use the control frameworks in a cloud,” said Robert Stroud, a member of ISACA’s Strategic Advisory Council and a strategy and innovation executive with CA Technologies.
Additionally, the guidelines will help managers make the right fundamental decisions about what to move to the cloud versus applications and systems that should be kept internally, he said.
Cloud computing provides on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or interaction from the service provider.
ISACA used NIST security guidelines for the cloud as the overarching model for the organization’s "IT Control Objectives for Cloud Computing," Stroud said.
“We leveraged NIST as a model and mapped back the requirements to NIST," Stroud said. "You can use this document in conjunction with the NIST model."
ISACA members can download "IT Control Objectives for Cloud Computing" as an e-book free of charge or buy the print version for $35. Non-members can download the e-book for $50 or buy the book for $60.