System, Storage, and Communication Protection Controls

From a hardware and systems perspective, the underlying makeup of cloud infrastructure is somewhat similar to a traditional data center. The main challenge in the cloud is the sheer number of assets and the scale at which they need to be managed and secured.

The best approach to securing complex systems is breaking them down into smaller components, making it more manageable to implement appropriate security controls at each step. The level of exposure the customer has to the underlying infrastructure and the necessity to protect it depends on the cloud model (IaaS, PaaS, or SaaS).

There are three security mechanisms in play regarding controls at this stage:

• Policy and procedures: These are the established requirements for system protection. These requirements should be well defined, including the purpose, scope, role, and responsibilities needed to achieve them. These policies and procedures must be regularly reviewed...