Cloud security guidance

• Lightweight approach and SaaS security
• The lightweight cloud security framework
• 1. Data encryption
• 2. Authentication and access control
• 3. Security logging and incident management
• 4. Governance
• Further reading

The lightweight approach focuses the cloud security measures which mitigate the most common cyber attacks. The approach works best for SaaS services as they usually focus on solving a single business problem (though it can apply to any cloud service).

To make the process ‘lightweight’, we have intentionally chosen to ask questions that can be answered without in-depth research, or direct consultation with the service provider.

Even without deep research, the lightweight approach can give you confidence that the service:

• protects your data in transit between clients and the service, as well as within the service
• protects user accounts with modern authentication, and authorisation policies
• provides logging and auditing, to maintain user experience and flexibility for the majority of responsible users (this approach is preferable to prevention and control, which some users may try to work around)

Lightweight approach and sensitive workloads

If you are going to use a service for more sensitive workloads (such as processing large amounts of personal data, commercially sensitive information, or as part of a larger more trusted system) you should conduct a more thorough analysis of the service using the full 14 cloud security principles.

Note that the lightweight framework does not directly consider some potentially important issues regarding cloud security and risk management.

There are 4 key areas where you will be relying on a cloud service provider to appropriately protect your data:

1. Data encryption
2. Authentication and access control
3. Security logging and incident management
4. Governance

For each of these, we have provided:

• a description of what you should expect from the supplier
• questions that you should seek to answer by scrutinising the service's website, or questioning their support staff

Your IT team, or a security professional, may also be able to verify some of the answers when they use the service. You should expect a good service to be able to answer 'yes' to all of the listed questions.

Transport Layer Security (TLS) is a protocol which provides privacy between communicating applications and their users, or directly between communicating services. When a server and client communicate, well-configured TLS ensures that no third party can eavesdrop, or tamper with any message.

Data-in-transit protection between clients and service

Data should be protected as it transits over the internet between the client and the cloud service.

If relying on a protocol that uses TLS (such as HTTPS) you should ensure that the service supports TLS version 1.2 or above and ensure that it is configured to use cipher suites and certificate sizes recommended in our TLS guidance. The predecessor to the TLS protocol was the Secure Sockets Layer (SSL) protocol; all versions of SSL are now regarded as insecure.

The NCSC recommends a set of preferred TLS profiles which SaaS providers are encouraged to adopt.

Question:  Does the service protect external data in transit over the Internet between the user and service, using TLS?

Question:  Does the service protect external data in transit using correctly configured certificates, as described in NCSC’s TLS guidance?

Data-at-rest protection

Data stored in the cloud service should be encrypted when on disk.

Question: Does the service encrypt data when at rest?

The service should support modern approaches to authentication to the service and its administrative interfaces.

Authentication to services and APIs

All internet-facing ways of accessing the service which can return protected information (including those to APIs) should require successful authentication.

Question:  If APIs are available, are internal and external APIs protected by authentication?

2-factor authentication

Services that are accessed over the internet should implement a method of 2-factor authentication (2FA) to the service. This is sometimes called 2-step verification (2SV) or multi factor authentication (MFA).

Using 2FA helps lower the impact of credential theft. It should ideally be enabled by default, rather than requiring users to opt-in.

Question: Can 2FA be mandated for all users?

Question:  If  there is a concept of privilege levels, do you at least make 2FA/multi-factor authentication available on high privileged accounts?

Single sign-on

A service that can be configured to use single sign-on allows your users to securely authenticate to the service without having to remember and manage extra passwords.

Question: Does the service support Single Sign-On to my organisation’s identity provider?

Privilege separation

The service should implement levels of privilege and have authorisation mechanisms in place to enforce the separation of privileges between different types of account.

A privileged user account is usually described as an administrator or owner, and can create new users, apply configuration to all users and sometimes access the data of other users.

Question:  Does the service have the concept of privileged administrative users that can alter configurations, and standard users that cannot?

The cloud service should provide you with enough data to detect and respond to an incident that affects your data, and have processes in place to mitigate security issues identified in the service itself.

Logging and event collection

The cloud service should generate all relevant security-critical logs, which helps you or the service provider find out what went wrong if there is a breach. Logs may include authentication attempts, configuration changes, and details about resources being accessed.

Question:  Does the service collect security logs?

Availability of logs

The cloud service should make security-critical events available to you, which may allow export to your audit and monitoring service.

Question:  Do you make security logs available to the customer?

Clear policy for incident response and applying updates

The cloud service should have a clearly defined policy for applying security updates to its internal systems and responding to identified security issues. The provider’s previous track record on this is a good metric to see how they’ll cope with any new issues.

Question:  Do you have an incident response process?

Question:  Do you have a policy for applying security updates in response to publicly reported issues in your service, or libraries that the service uses?

Vulnerability disclosure process

The cloud service should have a documented process that allows customers and security researchers to report vulnerabilities in the service itself, allowing them to be fixed.

Question: Do you have a vulnerability disclosure process?

Your cloud provider should have clear policies describing where they keep your data, how they protect it, and how they can use it.

Privacy policy

Your cloud service should have a privacy policy that specifies whether they share any of your data with third parties, and who those third parties are. This may be part of a more general terms of service.

Question: Do you publish a privacy policy?

Data location and legal jurisdiction

The service provider should be able to tell you where your data is processed, where it will be stored, and in what country the company (and any of its providers that handle your data) is legally based.

Question: Can you tell me where my data will be processed and stored?

Clear and transparent details about a product’s security features

The service provider should publish a clear description of the security features that they have implemented, and how best to configure them.

Question: How easy has it been to answer the other questions in this assessment?

Question: Are the answers you’ve needed been published on their website? This could be in a security whitepaper or the report from an independent audit?

Question: Do you publish a good-practice security guide that explains how to use the service’s security features well?

NCSC guidance
 

• Choosing a cloud provider
• The cloud security principles

NCSC blogs

• Managing the risk of cloud-enabled products