Cloud Security: Controls and Shared Responsibility

Cloud Security Fundamentals

Cloud computing introduces a distinct security paradigm where responsibility for protecting data and systems is divided between the cloud service provider (CSP) and the customer. For CISA candidates, understanding cloud security is essential because organizations increasingly rely on cloud services, and auditors must evaluate whether appropriate controls exist to protect cloud-hosted assets. The shared responsibility model defines the boundaries of this divided accountability.

Cloud security requires adapting traditional security controls to the cloud environment while leveraging cloud-native security capabilities. Auditors must understand both the technical controls and the contractual agreements that govern cloud security.

The Shared Responsibility Model

Responsibility by Service Model

The division of security responsibilities varies based on the cloud service model:

Infrastructure as a Service (IaaS): The CSP manages physical infrastructure, network, and hypervisor security. The customer is responsible for operating systems, applications, data, and access controls
Platform as a Service (PaaS): The CSP additionally manages the operating system and runtime environment. The customer is responsible for applications, data, and user access
Software as a Service (SaaS): The CSP manages nearly everything except user access, data classification, and client-side security. The customer retains responsibility for data governance and user management

Auditors should verify that organizations clearly understand their responsibilities under each service model and have implemented controls accordingly.

Cloud Security Controls

Identity and Access Management

Cloud IAM is the cornerstone of cloud security. Key controls include:

Strong authentication: Enforcing MFA for all cloud console and API access
Least privilege: Granting minimal permissions using cloud-native IAM policies
Service accounts: Managing and monitoring non-human identities used for automation and integration
Conditional access: Enforcing access policies based on device, location, and risk level

Data Protection

Protecting data in cloud environments requires encryption at rest and in transit, data classification and labeling, data loss prevention controls, and retention and disposal policies. Auditors should verify that the customer controls encryption keys (rather than relying solely on CSP-managed keys) for sensitive data.

Network Security

Cloud network security controls include virtual network segmentation, security groups and network access control lists, web application firewalls, and DDoS protection services. Auditors should evaluate whether network configurations follow the principle of least privilege and whether network monitoring captures relevant security events.

Compliance and Governance

Organizations must ensure that cloud usage complies with regulatory requirements and internal policies. Key governance activities include maintaining cloud asset inventories, monitoring cloud spending and resource utilization, enforcing tagging and naming conventions, and conducting regular cloud security assessments. CSP compliance certifications (SOC 2, ISO 27001, FedRAMP) provide assurance over the provider's controls but do not cover the customer's responsibilities.

Audit Approach

IS auditors evaluating cloud security should review the organization's understanding of the shared responsibility model, assess cloud IAM configurations and access reviews, evaluate data protection controls (encryption, DLP, backup), review CSP compliance reports and assess their coverage, test network security configurations and segmentation, verify logging and monitoring capabilities, and assess incident response procedures specific to cloud environments. Auditors should also evaluate vendor management processes, including contract terms, data portability provisions, and exit strategies.