1. CSN
  2. All Volumes and Issues
  3. Volume 6, Number 1, 2024
  4. The Concept of Automated Compliance Verification as the Foundation of a Fundamental Cloud Security Model

The Concept of Automated Compliance Verification as the Foundation of a Fundamental Cloud Security Model

CSN.
2024;
Volume 6, Number 1
: pp. 108 - 123
https://doi.org/10.23939/csn2024.01.108
Authors:
  1. Yevhenii Matseniuk
  2. Andrii Partyka
1
Lviv Polytechnic National University, Information Security Department
2
Lviv Polytechnic National University, Ukraine

The primary objective of this research is to develop an advanced automated method for configuring and managing public cloud accounts and subscriptions on prominent platforms such as AWS, GCP, and Azure. This method involves the application of standardized configurations to ensure optimal performance and security compliance. A significant component of this methodology is the intermittent scanning of the infrastructure of these cloud accounts and subscriptions. This scanning is meticulously designed to identify and address any deviations or non-compliance issues with globally recognized security standards, including NIST 800-53, ISO 27001, HIPAA, and PCIDSS.

The approach leverages cutting-edge automation technologies to streamline the deployment and management of cloud resources. By automating the application of configurations, the method aims to reduce manual effort, minimize the likelihood of human error, and enhance operational efficiency. This automation extends to the continuous monitoring and auditing processes, enabling real-time detection of configuration drifts or security vulnerabilities. Furthermore, the research delves into the development of a dynamic, responsive system capable of adapting to the evolving requirements of cloud security. The automated scanning component plays a pivotal role in this aspect, providing ongoing assurance that the cloud environments adhere to the strictest security protocols and standards.

Continuous compliance monitoring is critical in today’s ever-changing digital landscape, where threats to data security and privacy are increasingly sophisticated. By integrating these automated processes, the proposed method promises not only to bolster the security posture of cloud environments but also to offer a scalable, efficient solution for cloud infrastructure management. This automated approach is poised to set a new standard in cloud management, aligning with best practices in IT security and compliance, and paving the way for more secure, manageable, and efficient cloud computing practices.

Hosting
security standards
automation
cloud technologies
cloud service models
  1. Hashmi Ahtisham & Ranjan Aarushi & Anan Abhineet. (2018). Security and Compliance Management in Cloud Computing. International Journal of Advanced Studies in Computer Science and Engineering (2278-7917). 7. 47–54. Available at: https://www.researchgate.net/publication/323081755_Security_and_Compliance_Management_in_ Cloud_Computing
  2. Lakhno V., Kozlovskii V., Boiko Y., Mishchenko A., & Opirskyy I. (2017). Management of information protection based on the integrated implementation of decision support systems. Eastern-European Journal of Enterprise Technologies, 5(9 (89), 36–42. DOI: 10.15587/1729-4061.2017.111081
  3. Susukailo V., Opirskyy I. and Vasylyshyn S. Analysis of the attack vectors used by threat actors during the pandemic (2020) IEEE 15th International Conference on Computer Sciences and Information Technologies (CSIT), Zbarazh, Ukraine, 2020, pp. 261–264. DOI: 10.1109/CSIT49958.2020.9321897
  4. What is cloud security? Available at: https://www.microsoft.com/uk-ua/security/business/security-101/what-is- cloud-security
  5. Vakhula O., Opirskyy I., Mykhaylova O. Research on Security Challenges in Cloud Environments and Solutions based on the security-as-Code Approach, Workshop on Cybersecurity Providing in Information and Telecommunication Systems II, vol. 3550, (2023) 55–69. Available at: https://ceur-ws.org/Vol-3550/
  6. Kalra Sanchi & Atal Kunal & Jain Rachna. (2017). Security Issues in Cloud Computing. International Journal of Computer Applications. 167. 37–41. DOI: 10.5120/ijca2017914190
  7. Sreedharan Sherin (2013). Security and Privacy Issues of Cloud Computing; Solutions and Secure Framework. IOSR Journal of Computer Engineering. 10. 33–37. DOI: 10.9790/0661-01043337
  8. Sharma Deepak & Dhote Chandrashekhar & Potey Manish. (2013). Security-as-a-Service from Clouds: A Comprehensive Analysis. International Journal of Computer Applications. 67. 15–18. DOI: 10.5120/11374-6642
  9. Shevchuk D., Harasymchuk O., Partyka A., Korshun N. Designing Secured Services for Authentication, Authorization, and Accounting of Users, Workshop on Cybersecurity Providing in Information and Telecommunication Systems II, vol. 3550, (2023) 217–225. Available at: https://ceur-ws.org/Vol-3550/
  10. Chirra Prudhvi & Kumar Vineeth. (2023). Multi-cloud networking: investigating strategies and tools for networking in multi-cloud environments. DOI: 10.13140/RG.2.2.11542.93768
  11. Inap. (2020, December 15). What are the Differences Between IaaS, PaaS and SaaS? INAP. Available at: https://www.inap.com/blog/iaas-paas-saas-differences/
  12. Choi Brendan & Medina Erwin. (2023). Setting Up an Ansible Learning Environment. DOI: 10.1007/978-1- 4842-9624-0_4
  13. Choi Brendan. (2021). Introduction to Python Network Automation: The First Journey. DOI: 10.1007/978-1- 4842-6806-3
  14. Sabharwal Navin & Pandey Sarvesh & Pandey Piyush. (2021). Infrastructure-as-Code Automation Using Terraform, Packer, Vault, Nomad and Consul: Hands-on Deployment, Configuration, and Best Practices. DOI: 10.1007/978-1-4842-7129-2
  15. National Institute of Standards and Technology (NIST). (Latest Update Year). “NIST Special Publication 800- 53: Security and Privacy Controls for Federal Information Systems and Organizations.” [Online]. Available at: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
  16. Edwards K., & Riis J. (2004). Expected and Realized Costs and Benefits from Implementing Product Configuration Systems., 216–231. DOI: 10.4018/978-1-60566-260-2.CH012
  17. Dawson John & Twum Frimpong & Acquah James & Missah Yaw. (2023). PRISMA Archetype-Based Systematic Literature Review of Security Algorithms in the Cloud. Security and Communication Networks. 2023. 1–17. DOI: 10.1155/2023/9210803
  18. Catescu Georgeta. (2018). Detecting insider threats using Security Information and Event Management (SIEM). DOI: 10.13140/RG.2.2.11716.99200
  19. Spinellis Diomidis. (2014). Service Orchestration with Rundeck. Software, IEEE. 31. 16–18. DOI: 10.1109/MS.2014.92
  20. Rajavaram Harika & Rajula Vineet & BalasubramanianThangaraju. (2019). Automation of Microservices Application Deployment Made Easy By Rundeck and Kubernetes. 1–3. DOI: 10.1109/CONECCT47791.2019.9012811
  21. HashiCorp. (Latest Update Year). Vault by HashiCorp. [Online]. Available at: https://www.vaultproject.io/
  22. Maksymovych V., Shabatura M.; Harasymchuk O., Shevchuk R., Sawicki P., Zajac T. Combined Pseudo- Random Sequence Generator for Cybersecurity. Sensors 2022, 22, 9700. DOI: 10.3390/s22249700
  23. Maksymovych V., Nyemkova E., Justice C., Shabatura M., Harasymchuk O., Lakh Y., Rusynko M. Simulation of Authentication in Information-Processing Electronic Devices Based on Poisson Pulse Sequence Generators. Electronics. (2022); 11(13):2039. DOI: 10.3390/electronics11132039
  24. Maksymovych V., Shabatura M., Harasymchuk O., Karpinski M., Jancarczyk D., Sawicki P. Development of Additive Fibonacci Generators with Improved Characteristics for Cybersecurity Needs. Appl. Sci. (2022), 12(3), 1519. DOI: 10.3390/app12031519
  25. Riti Pierluigi & Flynn David. (2021). Vault HCL. DOI: 10.1007/978-1-4842-6634-2_7
  26. ITSM – IT Service Management Solution of your business. Available at:  https://www.creatio.com/page/itsm-system
  27. Maes Stephane & team, IFS. (2023). ITSM beyond IT. Take the service experience to new heights. IFS. Available at:https://www.researchgate.net/publication/372217278_ITSM_beyond_IT_Take_the_service_experience_to_new_heights
  28. What is a REST API? Available at: https://www.redhat.com/en/topics/api/what-is-a-rest-api
  29. Williams Brad & Tadlock Justin & Jacoby John. (2020). REST API. DOI: 10.1002/9781119666981.ch12