In recent years, there has been a massive shift to the cloud: Organizations are using different cloud computing environments to scale and widen their resources in a cost-effective manner. But this also leaves them vulnerable to cyberattacks via the cloud, highlighting the need for heightened cloud security. The Cloud Security Alliance (CSA) seeks to tackle this.
The CSA is a non-profit organization that works towards ensuring a secure cloud computing environment by raising awareness of the cloud's best practices. They do this by researching the best ways to secure cloud computing and by harnessing the expertise of those in the industry—from providers to customers, entrepreneurs to government—to provide information, research, education, certification, events, and podcasts specifically about cloud security. This benefits all parties involved, because it creates a forum where all work together to build and maintain a trusted cloud system.
In addition to creating a community that works together to strengthen cloud security, the CSA also offers frameworks, educational courses and certifications that help organizations in understanding the cloud architecture and strengthening their own cloud infrastructure, namely:
The CSA's Cloud Controls Matrix is a framework for cybersecurity control in cloud computing. It consists of a spreadsheet of 16 domains that cover all aspects of cloud technology, from the different frameworks to the industry regulations that companies would have to comply with. Each domain is divided into 133 cloud security control objectives, providing organizations with the guidance they need on security controls that should be implemented.
This framework has since become the standard for cloud security and to ensure compliance. It includes:
The CCM provides a form of standardization that helps both large and small organizations alike. For large organizations, it provides a standardization that developers can adhere to which makes it easier to handle the different cloud platforms used. For smaller organizations, it offers a standard to which they can align their cloud security infrastructure.
Alongside the cloud controls matrix, organizations can also leverage the CSA's CAIQ to assess the different cloud service providers and their own cloud security infrastructures. This is done in the form of a survey that provides a set of yes or no questions that organizations can use to assess their cloud providers.
The cloud landscape is changing everyday to accommodate new technologies. To ensure that organizations can keep up with this changing landscape, the CSA also provides certifications that have since become the standard of expertise for cloud security. The different cloud security certifications include:
Since the cloud computing matrix has become the standard in cloud security, the CSA awards organizations whose infrastructure is in line with the framework with STAR certification.
| Level 1: | This is a self-assessment that organizations can take to promote trust and transparency. With this, organizations that are in low-risk environments can assess their security using CCM and CAIQ and can assess their privacy based on the General Data Protection Regulation Code of Conduct. |
| Level 2: | This is for organizations that require third-party audits and is more suitable for medium-risk environments. |
The program consists of STAR Attestation and STAR Certification, which are extensions of the SOC2 and ISO27001 frameworks respectively, but it also utilizes the CCM framework.
Organizations can choose to apply for the certifications based on their requirements. The certifications don't just provide credibility to organizations, but also establish a form of trust, transparency, and an assurance that all the efforts to secure the cloud are in line with industry standards.
Zoho Corporation Pvt. Ltd. All rights reserved.
