- [Instructor] So in this segment,
we're gonna take a closer look at CSA,
that's the Cloud Security Alliance,
Cloud Controls Matrix known as the CCM.
Now, to do that,
we're gonna go out to cloudsecurityalliance.org.
Now there are several resources that are worth discovering.
But I really wanna focus in on the Cloud Controls Matrix.
So I'm coming up here to the top to STAR program
and I'm going to the Cloud Controls Matrix or CCM.
Now, the CSA, Cloud Controls Matrix,
is a cybersecurity control framework for cloud computing
and it's really awesome.
It's composed of 197 control objectives that are structured
into 17 domains covering all aspects of cloud technology.
You can use it for a systematic assessment
of your cloud implementation,
as well as it provides guidance
on which security controls should be implemented
by which actor within the cloud supply chain.
Meaning the provider or the user.
The controls framework is aligned with the CSA
Security Guidance for Cloud Computing
and is absolutely considered the defacto standard
for cloud security assurance and compliance.
Now, the CCM has recently been updated
and it includes controls, mapping, a questionnaire,
implementation guidelines, auditing guidelines, metrics,
and if you're doing automation,
it has machine readable files.
So how can you use the CCM and the CAIQ?
That's the questionnaire.
Well first of all, you can use it to document controls
for multiple standards and regulations in one place.
The controls in the CCM are mapped
against industry accepted security standard regulations
and control frameworks, including but not limited to,
ISO, NIST, the German BSI-CS,
PCI DSS, Payment Card Industry Data Security Standard.
ISACA COBIT, NERC, FedRamp,
CIS, and many others.
Now you can use it to also clarify
the shared responsibility model
that we talked about in the lesson.
The CCM defines the attributes of the responsibility
between the cloud service provider and the customer.
And it also helps define the organizational relevance
of each control based on the work done
by the CSA Enterprise Architecture Working Group.
Now, you can also use this to assess your service providers.
There is a questionnaire
that's called the CAIQ questionnaire.
In version four, the version we're looking at
includes a consensus assessment initiative questionnaire
known as a CAIQ in the same document.
Now, the CAIQ provides a set of yes or no questions
that can be used to assess a cloud service provider
and it eliminates the needs
to have multiple different questionnaires
for individual cloud consumers.
The other thing I want you to take a look at
when you're out at the site is the STAR program.
Now, there are two levels to the STAR program,
level one and level two.
And what the STAR program does is it tells you
how closely aligned with the security controls, right,
the various cloud vendors are.
So let's take a look at STAR level two.
We're gonna look at view companies at level two.
This is our Security Trust Assurance and Risk Registry.
That's what the STAR stands for.
I can scroll down and look at various vendors.
Let's say I wanna look at Accenture.
I can view their listing.
I can see that they are a STAR level one
which is a self-assessment.
A STAR level two because they have a certification.
In this case, they have earned
the ISO 27001 2013 certification
and they've also been awarded
the Trusted Cloud Provider by CSA.
And if I wanna view the listing,
I can go into View Listing.
I can see that they have Accenture itself
and then private cloud, and I can go further in and look.
I can see their self-assessment.
I could download the self-assessment that they did,
and I could take a look at their certification.
So a really awesome way to say,
"Okay I wanna see how the cloud providers
that I'm thinking of doing business with."
This would be during your due diligence period.
You know, how well do they meet this criteria?
So you can use this for assessing your providers
as well as in bringing down
those cloud control matrix controls
to help you make sure that you have
a really, really secure and awesome cloud environment.
And that, my friends, is a closer look.