Auditing Cloud Computing

The auditor's guide to ensuring correct security and privacy practices in a cloud computing environment Many organizations are reporting or projecting a significant cost savings through the use of cloud computing—utilizing shared computing resources to provide ubiquitous access for organizations and end users. Just as many organizations, however, are expressing concern with security and privacy issues for their organization's data in the "cloud." Auditing Cloud Computing provides necessary guidance to build a proper audit to ensure operational integrity and customer data protection, among other aspects, are addressed for cloud based resources. Provides necessary guidance to ensure auditors address security and privacy aspects that through a proper audit can provide a specified level of assurance for an organization's resources Reveals effective methods for evaluating the security and privacy practices of cloud services A cloud computing reference for auditors and IT security professionals, as well as those preparing for certification credentials, such as Certified Information Systems Auditor (CISA) Timely and practical, Auditing Cloud Computing expertly provides information to assist in preparing for an audit addressing cloud computing security and privacy for both businesses and cloud based service providers.

This book mainly focuses on cloud security and high performance computing for cloud auditing. The book discusses emerging challenges and techniques developed for high performance semantic cloud auditing, and presents the state of the art in cloud auditing, computing and security techniques with focus on technical aspects and feasibility of auditing issues in federated cloud computing environments. In summer 2011, the United States Air Force Research Laboratory (AFRL) CyberBAT Cloud Security and Auditing Team initiated the exploration of the cloud security challenges and future cloud auditing research directions that are covered in this book. This work was supported by the United States government funds from the Air Force Office of Scientific Research (AFOSR), the AFOSR Summer Faculty Fellowship Program (SFFP), the Air Force Research Laboratory (AFRL) Visiting Faculty Research Program (VFRP), the National Science Foundation (NSF) and the National Institute of Health (NIH). All chapters were partially supported by the AFOSR Information Operations and Security Program extramural and intramural funds (AFOSR/RSL Program Manager: Dr. Robert Herklotz). Key Features: · Contains surveys of cyber threats and security issues in cloud computing and presents secure cloud architectures · Presents in-depth cloud auditing techniques, federated cloud security architectures, cloud access control models, and access assured information sharing technologies · Outlines a wide range of challenges and provides solutions to manage and control very large and complex data sets

Many Cloud data auditing algorithms have been proposed to maintain the integrity and privacy of data held in the Cloud. In this book, we present a survey of the state of the art and research of Cloud data auditing techniques with a brief introduction of the basic cloud computing concepts, its architecture and security issues. This book presents an overview of the various methods presently used to perform Cloud data auditing, mostly focusing on integrity and privacy.

This book provides a comprehensive review of the most up to date research related to cloud security auditing and discusses auditing the cloud infrastructure from the structural point of view, while focusing on virtualization-related security properties and consistency between multiple control layers. It presents an off-line automated framework for auditing consistent isolation between virtual networks in OpenStack-managed cloud spanning over overlay and layer 2 by considering both cloud layers’ views. A runtime security auditing framework for the cloud with special focus on the user-level including common access control and authentication mechanisms e.g., RBAC, ABAC and SSO is covered as well. This book also discusses a learning-based proactive security auditing system, which extracts probabilistic dependencies between runtime events and applies such dependencies to proactively audit and prevent security violations resulting from critical events. Finally, this book elaborates the design and implementation of a middleware as a pluggable interface to OpenStack for intercepting and verifying the legitimacy of user requests at runtime. Many companies nowadays leverage cloud services for conducting major business operations (e.g., Web service, inventory management, customer service, etc.). However, the fear of losing control and governance still persists due to the inherent lack of transparency and trust in clouds. The complex design and implementation of cloud infrastructures may cause numerous vulnerabilities and misconfigurations, while the unique properties of clouds (elastic, self-service, multi-tenancy) can bring novel security challenges. In this book, the authors discuss how state-of-the-art security auditing solutions may help increase cloud tenants’ trust in the service providers by providing assurance on the compliance with the applicable laws, regulations, policies, and standards. This book introduces the latest research results on both traditional retroactive auditing and novel (runtime and proactive) auditing techniques to serve different stakeholders in the cloud. This book covers security threats from different cloud abstraction levels and discusses a wide-range of security properties related to cloud-specific standards (e.g., Cloud Control Matrix (CCM) and ISO 27017). It also elaborates on the integration of security auditing solutions into real world cloud management platforms (e.g., OpenStack, Amazon AWS and Google GCP). This book targets industrial scientists, who are working on cloud or security-related topics, as well as security practitioners, administrators, cloud providers and operators.Researchers and advanced-level students studying and working in computer science, practically in cloud security will also be interested in this book.

Ensure compliance across the top cloud players by diving into AWS, Azure, and GCP cloud auditing to minimize security risks Key FeaturesLeverage best practices and emerging technologies to effectively audit a cloud environmentGet better at auditing and unlock career opportunities in cloud audits and complianceExplore multiple assessments of various features in a cloud environment to see how it's doneBook Description As more and more companies are moving to cloud and multi-cloud environments, being able to assess the compliance of these environments properly is becoming more important. But in this fast-moving domain, getting the most up-to-date information is a challenge—so where do you turn? Cloud Auditing Best Practices has all the information you'll need. With an explanation of the fundamental concepts and hands-on walk-throughs of the three big cloud players, this book will get you up to speed with cloud auditing before you know it. After a quick introduction to cloud architecture and an understanding of the importance of performing cloud control assessments, you'll quickly get to grips with navigating AWS, Azure, and GCP cloud environments. As you explore the vital role an IT auditor plays in any company's network, you'll learn how to successfully build cloud IT auditing programs, including using standard tools such as Terraform, Azure Automation, AWS Policy Sentry, and many more. You'll also get plenty of tips and tricks for preparing an effective and advanced audit and understanding how to monitor and assess cloud environments using standard tools. By the end of this book, you will be able to confidently apply and assess security controls for AWS, Azure, and GCP, allowing you to independently and effectively confirm compliance in the cloud. What you will learnUnderstand the cloud shared responsibility and role of an IT auditorExplore change management and integrate it with DevSecOps processesUnderstand the value of performing cloud control assessmentsLearn tips and tricks to perform an advanced and effective auditing programEnhance visibility by monitoring and assessing cloud environmentsExamine IAM, network, infrastructure, and logging controlsUse policy and compliance automation with tools such as TerraformWho this book is for This book is for IT auditors looking to learn more about assessing cloud environments for compliance, as well as those looking for practical tips on how to audit them and what security controls are available to map to IT general computing controls. Other IT professionals whose job includes assessing compliance, such as DevSecOps teams, identity, and access management analysts, cloud engineers, and cloud security architects, will also find plenty of useful information in this book. Before you get started, you'll need a basic understanding of IT systems and a solid grasp of cybersecurity basics.

The purpose of this is to explain the importance of HIPAA and research what it takes for Healthcare data to be HIPAA Compliant. Also, explaining what is expected of Healthcare industries if there is an audit and how does Auditing play a big part in HIPAA compliance.

Auditing is constantly and quickly changing due to the continuous evolution of information and communication technologies. As the auditing process is forced to adapt to these changes, issues have arisen that lead to a decrease in the auditing effectiveness and efficiency, leading to a greater dissatisfaction among users. More research is needed to provide effective management and mitigation of the risk associated to organizational transactions and to assign a more reliable and accurate character to the execution of business transactions and processes. Organizational Auditing and Assurance in the Digital Age is an essential reference source that discusses challenges, identifies opportunities, and presents solutions in relation to issues in auditing, information systems auditing, and assurance services and provides best practices for ensuring accountability, accuracy, and transparency. Featuring research on topics such as forensic auditing, financial services, and corporate governance, this book is ideally designed for internal and external auditors, assurance providers, managers, risk managers, academicians, professionals, and students.