The Inner Circle

 View Only

  • 1.  CSA CCM - 'Typical Control Applicability and Ownership'

    Posted Sep 05, 2023 08:45:00 AM

    This is hopefully an easy question.  I was in a friendly debate recently on the meaning behind the value of 'CSP-Owned' in regards to some controls.

    The specific example is around Infrastructure & Virtualization Security (IVS); the case given is that we should have controls that are auditable around host hardening (IVS-04) despite the value of "CSP-Owned" since Guest OS hardening is certainly our responsibility with IaaS.

    The two sides are:

    1. CSP-Owned means that we have no responsibility to implement or be audited on the controls efficacy and the Cloud Service Provider is responsible
    2. CSP-Owned is just 'typical' ownership of the control... we still have responsibilities where it makes sense (e.g. Guest OS hardening)

    My personal understanding is #2, that we have some responsibilities. 

    Has anyone come across this debate before?  If so, is there something from CSA that helps detangle it?



    ------------------------------
    JW Merrow
    CyberSecurity Architect
    Huntington National Bank
    ------------------------------



  • 2.  RE: CSA CCM - 'Typical Control Applicability and Ownership'

    Posted Sep 06, 2023 07:37:00 AM

    Hi, I've wondered the same thing as well, however, I'm normally selected CSP-owned in regards to controls like this even though their is a shared responsibly by both parties. However, I'm interested to hear what other think about this and would appreciate if CSA can clarify the true ownership meaning to help us complete the CAIQ.



    ------------------------------
    Peter Holcomb
    ------------------------------

    Original Message


  • 3.  RE: CSA CCM - 'Typical Control Applicability and Ownership'

    Posted Sep 07, 2023 12:15:00 PM
    In my understanding, CSP is owning up to only the Infrastructure in an IaaS model. Access, privilege, services are always the responsibility of the organization contracting the service. 
    Therefore, a hardening has to be a shared responsibility, it mayn't be offered 'by default' by the CSP and hence putting the responsibility completely on the CSP may not be acceptable. A good check will be to refer to the contract / terms of a IaaS model, and see if the CSP will accept this as their ownership / responsibility.
     
    I'll like for CSA to clarify and enlighten on this though.




    Best regards
    Mayurakshi



    Original Message


  • 4.  RE: CSA CCM - 'Typical Control Applicability and Ownership'

    Posted Sep 07, 2023 11:04:00 AM

    I'm assuming you are asking this question from a Customer (CSC) point of view. 

    In this case, your CSP should have provided you with a Shared Secuirity Responsibility Model, which explains and delineate the responsibility for the implementation of every control, for the specific service provided, defining the responsibility areas (which is the responsibility from the CSP and from CSC). 

    In this case, the provider is responsible for hardening the OS host, but it should be your responsibility to harden the guest OS. 



    ------------------------------
    Francesco Calabretta
    Consultant
    BIP Cybersec
    ------------------------------

    Original Message


  • 5.  RE: CSA CCM - 'Typical Control Applicability and Ownership'

    Posted Sep 07, 2023 11:04:00 AM

    Your CSP should have provided you with a Shared Security Responsibility Model regarding the service at hand. In this model, you should be able to identify the areas of your direct responsibility and the areas managed directly by the provider. 

    For example, in the control you are mentioning, considering an IaaS service, you should find that the hardening of the Hypervisor is a CSP responsibility, while the hardening of the guest OS must be managed directly by the customer, as the CSP only provides you with an infrastructure. 



    ------------------------------
    Francesco Calabretta
    Consultant
    BIP Cybersec
    ------------------------------

    Original Message


  • 6.  RE: CSA CCM - 'Typical Control Applicability and Ownership'

    Posted Sep 08, 2023 09:29:00 AM

    To sum up all the points, it seems as though using the Shared Responsibility Model from the CSP to gain an understanding of that division is the best way to go.  It would be good if some of the "CSP-Owned" items were marked with an asterisk or had an explanation that these were dictated by the Shared Responsibility Model.  I'll have to see where I can submit feedback on the CSA CCM for the next version to maybe add some commentary to that effect.

    In my friendly debate, the other parties were under the impression that since it was marked "CSP-Owned" the onus for controls implementation laid upon the CSP.  Which was incorrect and eventually able to be made clear.  

    The summary around managing the Guest OS security made perfect sense and was the logical 'argument' I utilized to make it clear that the control ownership was 'Shared'. :)

    Thanks for the clarity and affirmation on the approach!



    ------------------------------
    JW Merrow
    CyberSecurity Architect
    Huntington National Bank
    ------------------------------

    Original Message


  • 7.  RE: CSA CCM - 'Typical Control Applicability and Ownership'

    Posted Sep 25, 2023 08:53:00 AM
    Edited by Lefteris Skoutaris Sep 25, 2023 09:04:32 AM

    CSA and the CCM WG have been developing since the beginning of this year the 'SSRM Implementation Guidelines' for the CCM V4 control specifications.

    The so called 'SSRM project' is a big project, currently in progress, and only just recently a first draft was delivered. Primary project objective is to develop and deliver quality and well justified SSRM implementation guidelines per CSP/CSC that pertain to the Shared Security Responsibility model for each control in the CCM V4.

    Given the vast size of the project will not enter details at this point. However, feel free to ask any questions you might have.

    You can access here the first CCM V4 SSRM Guidelines draft. Upon completion, this work is expected to update both the current "Typical Control Applicability and Ownership matrix" and the existing "Implementation Guidelines" of the CCM V4.

    For CCM/CAIQ related discussions please consider joining the CCM WG community here in Circle, where you can also find additional information to join the SSRM project calls. 

    Best regards,



    ------------------------------
    Eleftherios Skoutaris
    Program Manager
    Cloud Security Alliance
    ------------------------------

    Original Message