Cloud Audit and Standards | Cloud Security, Compliance and Governance

This presentation introduces the fundamentals of cloud auditing, security compliance, and governance. It explains the cloud audit process, cloud lifecycle management, Governance, Risk and Compliance (GRC), audit assurance, and SOC 1, SOC 2, and SOC 3 reports.

Key topics include cloud security compliance frameworks such as the Cloud Security Alliance (CSA), Cloud Controls Matrix (CCM), NIST SP 800-53, PCI DSS, HIPAA, ISO/IEC 27001, FISMA, and ITIL. The presentation also explores legal safeguards in cloud computing, Indian data protection legislation, Service Level Agreements (SLAs), emerging cloud security trends, and practical case studies involving data leakage, unauthorized access, and cloud backup and recovery failures.

Designed for undergraduate students and computing professionals, these materials support learning about cloud security auditing, risk identification, compliance requirements, and best practices for secure cloud operations.

Transcript

1. Cloud Audit and Standards By Dr. Nagaraju Kilari Associate Professor Kristu Jayanti (Deemed To Be University) Bengaluru Karnataka India
2. Cloud-based IT audit process A cloud audit is the process of checking a cloud environment to ensure that: Data is secure Services work properly Rules and regulations are followed
3. Cloud-based IT audit process  Why is a cloud audit important?  Security: Protects data from hackers and unauthorized users.  Privacy: Protects personal information.  Compliance: Ensures that rules and standards are followed.  Data integrity: Ensures that data is accurate and has not been changed improperly.  Availability: Ensures that cloud services are accessible when needed.  Risk identification: Finds weaknesses before they cause serious problems.
4. Cloud-based IT audit process  Steps in the Cloud Audit Process:  Step 1: Planning:  Decide what systems to check, which cloud model is used (IaaS, PaaS or SaaS), and which standards apply.  Step 2: Data Collection:  Collect system logs, configurations and access records.  Ask administrators how the system is managed.  Step 3: Evaluation:  Compare the collected information with security policies and applicable standards.  Identify problems and risks.
5. Cloud-based IT audit process Step 4: Reporting: Prepare a report describing the problems found and suggest corrective actions. Step 5: Follow-up: Check whether the identified problems have been corrected. Conduct another audit if necessary.
6. Cloud-based IT audit process  Lifecycle Management for the Cloud:  Cloud lifecycle management means managing cloud resources and data throughout their entire life, from planning and creation to final deletion.  Five phases of cloud lifecycle management:  1. Planning and Design:  Identify requirements, budget, security needs and the appropriate cloud model.  2. Deployment:  Create and configure (Setup) cloud resources and apply security settings.
7. Cloud-based IT audit process  3. Operation:  Monitor performance, install updates, fix errors and maintain the system.  4. Optimization:  Reduce unnecessary costs utilization and performance. and improve resource  5. Decommissioning:  Safely remove unused resources, delete data according to applicable retention rules, revoke access and document closure.
8. Cloud-based IT audit process  Governance, Risk and Compliance (GRC) Frameworks:  GRC stands for Governance, Risk and Compliance.  It helps an organization manage its IT systems properly, identify risks and follow applicable rules.  1. Governance — Making rules:  Ensures that IT activities support the organization's goals.  It defines responsibilities, policies and procedures.  2. Risk Management — Finding and reducing risks:  Identifies possible problems, assesses their impact and takes steps to reduce them.
9. Cloud-based IT audit process  3. Compliance — Following rules:  Ensures that an organization follows applicable laws, policies and security standards.  Governance = Making Rules;  Risk = Problems;  Compliance = Following rules.
10. Cloud-based IT audit process  Examples of GRC frameworks: Framework Explanation COBIT (Control Objectives for Information and Related Technologies) Helps govern and manage enterprise IT. ISO 31000 Provides guidance for managing risks. NIST RMF (Risk Management Framework) Provides a structured approach to managing cybersecurity risks.
11. Cloud-based IT audit process  Audit Assurance:  Audit assurance provides confidence that an organization's cloud operations follow appropriate security and privacy requirements.  Types of audit assurance:  - Internal assurance: The organization's own internal auditors check its systems.  - External assurance: An independent third party checks the organization's controls.
12. Cloud-based IT audit process  Benefits:  Builds trust with customers.  Checks whether security controls are working.  Helps demonstrate requirements. compliance with applicable  Supports certifications and regulatory approvals.
13. Cloud-based IT audit process  3 types - SOC assurance reports:  SOC stands for System and Organization Controls. Report Simple meaning Example SOC 1 Controls related to financial reporting Checking controls used by a service that processes payroll. SOC 2 Controls related to security, availability, confidentiality, processing integrity and privacy Evaluating a cloud provider's security and data protection controls. A public-facing report based on SOC 2 principles A cloud company publishes a general assurance report for customers. SOC 3
14. Cloud-based IT audit process  SOC 1 = Financial controls;  SOC 2 = Detailed trust-related controls;  SOC 3 = Public-facing report.
15. Cloud-based IT audit process  Example:  Suppose a faculty member logs into a cloud database and changes a student's marks.  The audit log might record: Time User Activity 10:00 AM Faculty01 Logged in 10:05 AM Faculty01 Updated student marks 10:10 AM Admin01 Changed user permissions
16. Cloud-based IT audit process  A tamper-proof audit log is designed to prevent unauthorized alteration or deletion of recorded events.  1. Immutable storage  Stores records in a way that prevents modification or deletion during a defined retention period.  2. Blockchain-based logging  Uses linked records and cryptographic techniques to make unauthorized changes detectable.  3. Digital signatures and hashing  Help detect whether a log record has been modified.
17. Cloud-based IT audit process  Importance of tamper-proof logs  Help detect insider threats.  Support forensic investigations after security incidents.  Provide evidence for security audits.  Help demonstrate compliance with applicable laws and standards.  Important:  Hashing and digital signatures can reveal unauthorized changes, but they do not automatically prevent every form of deletion or tampering.  Proper access control and protected storage are also needed.
18. Cloud-based IT audit process  Essential Compliance Frameworks for Cloud Security:  A compliance framework is a set of rules, guidelines, and security practices that an organization follows to protect its data and meet required standards.  Importance:  Protects sensitive data.  Prevents unauthorized access.  Helps organizations follow required rules.  Builds customer trust.  Reduces security risks.
19. Cloud-based IT audit process  CSA – Cloud Security Alliance:  The Cloud Security Alliance (CSA) is an organization that helps companies use cloud computing securely.  It provides guidelines, tools, and best practices for cloud security.  CSA CCM (Cloud Controls Matrix):  CCM is a checklist of security controls used to assess the security of cloud services.  It maps cloud security controls to other standards and frameworks.
20. Cloud-based IT audit process  CAIQ (Consensus Assessments Initiative Questionnaire):  CAIQ is a questionnaire that organizations can use to assess and communicate their cloud security practices.  Example:  Before storing customer data with a cloud provider, a company uses a security questionnaire to understand the provider's security measures.  CSA STAR (Security, Trust & Assurance Registry):  STAR is a public registry where cloud providers publish information about their security practices and assurance.  Example:  A business checks a cloud provider's STAR information before selecting it to host its application.
21. Cloud-based IT audit process  Multi-compliance mapping:  CSA CCM maps controls to multiple standards, reducing the effort required to assess each framework separately.  Example:  Microsoft Azure and CSA  Microsoft Azure is an example of a CSA STAR-certified cloud provider.  Customers can review its STAR information to understand its cloud security practices.
22. Cloud-based IT audit process  Important Cloud Security Compliance Frameworks:  1. CSA – Cloud Security Alliance:  Purpose: Cloud security best practices.  It provides guidelines and the Cloud Controls Matrix (CCM) to assess cloud security.  2. NIST SP 800-53:  Purpose: Cybersecurity and risk management.  It provides a catalogue of security and privacy controls for protecting information systems.  Example: An organization uses access-control rules and audit logging to protect its cloud system.
23. Cloud-based IT audit process  3. PCI DSS – Payment Card Industry Data Security Standard:  Purpose: Protecting payment card information.  It sets security requirements for environments that store, process, or transmit payment card data.  Example: An online shopping website protects customers' card details during payment.  4. HIPAA – Health Insurance Portability and Accountability Act:  Purpose: Protecting healthcare information in the United States.  It establishes requirements for protecting specified health information handled by covered organizations and their business associates.  Example: A hospital restricts access to patients' medical records.
24. Cloud-based IT audit process  5. ISO/IEC 27001:  Purpose: Information Security Management System (ISMS).  It provides requirements for establishing, maintaining, and continually improving an information security management system.  Example: A company identifies security risks, defines policies, and regularly reviews its security practices.  6. FISMA – Federal Information Security Modernization Act:  Purpose: Security of U.S. federal information systems.  It establishes requirements for managing information security risks in federal agencies and applicable systems.  Example: A U.S. federal agency applies security controls to protect government information.
25. Cloud-based IT audit process  7. ITIL – Information Technology Infrastructure Library:  Purpose: IT service management.  ITIL provides guidance for managing and improving IT services.  These frameworks are not interchangeable.  Some provide security controls, some establish legal or regulatory requirements, and others guide service management.
27. Cloud-based IT audit process Framework Main purpose Example CSA Cloud security best practices Checking cloud security controls NIST SP 800-53 Security and privacy controls Restricting access to records PCI DSS Payment card security Securing online payments HIPAA Healthcare data protection Protecting patient records ISO 27001 Information security management Managing organizational security risks FISMA U.S. federal system security Protecting government systems ITIL IT service management Resolving IT service problems
28. Cloud-based IT audit process  CSA helps organizations improve cloud security.  CCM is a cloud security controls framework.  CAIQ is a security assessment questionnaire.  STAR is a public registry for cloud security assurance information.  NIST SP 800-53 provides security and privacy controls.  PCI DSS focuses on payment card security.  HIPAA protects specified healthcare information in the U.S.  ISO 27001 focuses on information security management.  FISMA concerns U.S. federal information security.  ITIL focuses on IT service management.
29. Cloud-based IT audit process Legal Safeguards in Cloud Computing: Legal safeguards are laws, rules, and contractual agreements that protect data, users, and organizations when they use cloud services. When an organization stores its data on platforms such as AWS, Microsoft Azure, or Google Cloud, it must ensure that the data is protected and handled legally.
30. Cloud-based IT audit process  Legal Safeguards in Cloud Computing:  legal safeguards - importance:  Protect personal and confidential information.  Prevent unauthorized access to data.  Define the responsibilities of the cloud provider and customer.  Help organizations comply with applicable laws.
31. Cloud-based IT audit process  Legal Safeguards in Cloud Computing:  Important legal safeguards in India:  1. Digital Personal Data Protection Act, 2023 (DPDP Act):  Provides a legal framework for processing digital personal data in India, including obligations for organizations handling personal data, subject to the Act's provisions and applicable rules.  2. Information Technology Act, 2000:  Provides legal recognition for electronic records and electronic transactions and addresses certain cyber offences.
32. Cloud-based IT audit process  Legal Safeguards in Cloud Computing:  3. Indian Contract Act, 1872:  Provides the general legal framework for enforceable contracts, subject to applicable law.  Example: If a cloud provider fails to fulfil an enforceable contractual commitment, the customer may have legal remedies.
33. Cloud-based IT audit process  Legal Safeguards in Cloud Computing:  Other important safeguards:  Data confidentiality: Only authorized people should access sensitive data.  Data backup and recovery: Data should be recoverable after accidental deletion or system failure.  Access control: Users should receive only the permissions they need.  Data location and transfer: Organizations should consider applicable rules governing where data is stored and transferred.  Incident reporting: Security incidents must be handled according to applicable legal and contractual requirements.
34. Cloud-based IT audit process  Service Level Agreement (SLA):  A Service Level Agreement (SLA) is an agreement between a cloud service provider and a customer that defines the expected level of service.  It explains what service the provider promises, how performance is measured, and what happens if the agreed service level is not met.
35. Cloud-based IT audit process  Important components of an SLA:  1. Availability:  Specifies the percentage of time the service is expected to be operational.  2. Performance:  Defines expected response times, processing speed, or other performance measures.  3. Support and response time:  Defines how quickly the provider responds to service problems.
36. Cloud-based IT audit process  Important components of an SLA:  4. Backup and disaster recovery:  Specifies relevant backup, restoration, commitments. and recovery  Example: The provider commits to a defined recovery time after a major failure.  5. Penalties and service credits:  Explains the remedies available if service commitments are not met.  Example: The customer receives a service credit if the provider breaches the applicable availability commitment.
37. Cloud-based IT audit process  Emerging Trends in Cloud Security and Auditing:  Emerging trends are new or rapidly developing technologies and practices used to protect cloud systems and improve the auditing process.  1. AI-powered security auditing:  Artificial intelligence helps analyze large amounts of security data and identify unusual activities.  2. Zero Trust Security:  Zero Trust follows the principle of “Never trust automatically; always verify.”  Users and devices must be verified before access is granted.
38. Cloud-based IT audit process  Emerging Trends in Cloud Security and Auditing:  3. Cloud Security Posture Management (CSPM):  CSPM tools identify cloud misconfigurations and security risks.  4. Immutable Audit Logs:  Logs are stored using controls that prevent unauthorized alteration or deletion, or make such changes detectable.  5. Advanced Encryption and Key Management:  Encryption protects data, while key management controls how encryption keys are created, stored, and used.
39. Cloud-based IT audit process  Emerging Trends in Cloud Security and Auditing:  6. Continuous Compliance Monitoring:  Automated tools continuously check whether cloud resources meet selected security policies and compliance requirements.  7. Container and Cloud-Native Security:  Security tools examine containers, container images, configurations, and workloads for vulnerabilities and unsafe settings.
40. Cloud-based IT audit process  Case Studies in Cloud Audits:  A cloud audit is the process of checking whether an organization's cloud systems are secure, reliable, compliant with regulations, and properly managed.  A cloud audit examines:  Data security and privacy.  User access permissions.  Compliance with security standards.  Backup and recovery procedures.  Cloud service provider performance.  Audit logs and suspicious activities.
41. Cloud-based IT audit process  Case Studies in Cloud Audits:  Case  Study 1: Data Leakage in Cloud Storage:  Scenario  A company stores customer records in cloud storage. Due to incorrect configuration, the storage bucket is publicly accessible.  Problems identified  Unauthorized users can access customer data.  Sensitive information may be leaked.  The company may face legal and financial consequences.
42. Cloud-based IT audit process  Case Studies in Cloud Audits:  Audit findings and solutions:  Review storage access permissions.  Disable public access unless explicitly required.  Enable encryption and access logging.  Conduct regular configuration audits.  Learning point:  Cloud storage must be private by default, with access granted only to authorized users.
43. Cloud-based IT audit process  Case Studies in Cloud Audits:  Case Study 2: Unauthorized Access to Cloud Resources:  Scenario  An employee leaves an organization, but their cloud account remains active. The account could be misused to access company data.  Problems identified  Former employees retain access.  Excessive permissions increase security risks.  Account activity may go unnoticed.
44. Cloud-based IT audit process  Case Studies in Cloud Audits:  Audit findings and solutions  Review user accounts and access rights.  Remove accounts when employees leave.  Apply the principle of least privilege.  Enable multi-factor authentication (MFA).  Monitor login and access logs.  Learning point:  Only authorized users should have access to cloud resources, and their permissions must be reviewed regularly.
45. Cloud-based IT audit process  Case Studies in Cloud Audits:  Case Study 3: Failure of Cloud Backup and Recovery:  Scenario  An online shopping company experiences a server failure. Although backups exist, the company discovers that some backup files are corrupted.  Problems identified  Customer orders may be lost.  Services remain unavailable.  Business operations are interrupted.
46. Cloud-based IT audit process  Case Studies in Cloud Audits:  Audit findings and solutions  Verify backup schedules.  Test backup restoration periodically.  Maintain copies in separate locations.  Define recovery time and recovery point objectives (RTO and RPO).  Document a disaster recovery plan.  Learning point:  Creating backups is not enough; organizations must test whether the data can actually be restored.
47. Cloud-based IT audit process  Case Studies in Cloud Audits:  Case Study 4: Failure to Meet Compliance Requirements  Scenario  A hospital stores patient records in the cloud but does not properly restrict access or maintain sufficient audit logs.  Audit findings  Patient information may be exposed.  Access to records cannot be fully traced.  Applicable healthcare privacy requirements may be violated.
48. Cloud-based IT audit process  Case Studies in Cloud Audits:  Solutions  Classify sensitive data.  Encrypt data at rest and in transit.  Maintain access and activity logs.  Review compliance requirements applicable to the organization and country.  Perform periodic compliance audits.  Learning point:  Cloud systems must follow applicable legal, privacy, and industry-specific requirements.
49. Cloud-based IT audit process  Cloud Audit Process:
50. Cloud-based IT audit process  Best Practices in Cloud Governance:  Cloud governance refers to the policies, rules, roles, and processes an organization uses to manage its cloud resources securely, efficiently, and responsibly.  For example, a university using cloud services to store student records needs rules for who can access the records, how much the services can cost, and how data should be protected.
51. Cloud-based IT audit process  Important best practices: Best practice Explanation Simple example 1. Identity and Students can view their own Control who can access cloud Access marks but cannot modify resources. Management (IAM) them. 2. Least privilege Give users only the permissions they need. A faculty member can upload marks but cannot manage cloud billing. 3. Data encryption Protect data from unauthorized reading. Encrypt student records stored in the cloud. 4. Continuous monitoring Track activities and detect unusual behavior. Alert the administrator after repeated failed logins. 5. Regular auditing Check security and compliance periodically. Review cloud permissions every semester.
52. Cloud-based IT audit process Important best practices: Best practice Explanation Simple example 6. Backup and disaster recovery Prepare for data loss and service failure. Maintain backups of examination results. 7. Cost management Monitor usage and prevent unnecessary spending. Shut down unused virtual machines. 8. Compliance management Follow applicable laws, regulations, and standards. Check relevant privacy and security requirements before storing personal data. 9. Incident response Establish procedures for handling security incidents. Disable a compromised account and investigate its activity. 10. Shared responsibility Understand the division of security duties between provider and customer. The provider secures underlying infrastructure, while the customer configures user permissions correctly.
53. Cloud-based IT audit process  Cloud auditing identifies security and compliance weaknesses.  Cloud governance establishes the rules and responsibilities that help prevent those weaknesses from recurring.
54. Cloud-based IT audit process THANK YOU!!!