PECB Lead Cloud Sec cheat sheet

Essential characteristics (ISO/IEC 17788): broad network access, measured service, multi-tenancy, on-demand self-service, rapid elasticity and scalability, resource pooling.

Service models: SaaS delivers applications; PaaS delivers platform/runtime; IaaS delivers compute, storage, and network. Control shifts from customer (IaaS) toward provider (SaaS).

Deployment models: public, private, community, hybrid. Hybrid combines two or more distinct models bound by proprietary or standardized technology enabling data and application portability.

Cloud service customer roles (ISO/IEC 17789): cloud service customer, cloud service provider, cloud service partner, cloud service auditor. Sub-roles include cloud service user, administrator, business manager, and integrator.

Shared responsibility: the provider secures the cloud infrastructure; the customer secures what it puts in the cloud. The split point moves by service model and must be documented in the agreement.

Virtualization underlies resource pooling; residual risks include hypervisor compromise, VM escape, noisy-neighbour resource contention, and image sprawl.

Data location and sovereignty: data may be stored and processed in multiple jurisdictions; the customer remains accountable for lawful processing regardless of provider location.

Portability and interoperability are design goals, not guarantees; exit planning must address data formats, APIs, and deletion verification.

ISO/IEC 27001 clause 5.2 requires a top-management-approved information security policy; cloud-specific policy extends it with cloud usage rules, approved service models, and data classification constraints.

Clause 7.5 documented information: creation, updating, identification, format, review, approval, distribution, access, retrieval, retention, and disposal must be controlled.

Acceptable use policy for cloud defines which data classes may go to which service model, who may procure cloud services, and prohibited shadow IT.

Policy hierarchy: overarching information security policy, cloud security policy, topic-specific policies (access control, cryptography, supplier relationships), and procedures.

Evidence retention: records of risk assessments, supplier due diligence, audit logs, and management review must be protected and retained per legal and contractual periods.

Version control: every document carries identifier, version, date, author, approver, and change history; superseded versions are withdrawn from active use.

Cloud-specific policy content includes data residency, encryption requirements, provider selection criteria, exit strategy, and incident notification obligations.

Documented information can be in any medium; cloud-hosted documents need access control, backup, and integrity protection equivalent to on-premises records.

Risk = likelihood × consequence. ISO/IEC 27005 process: establish context, identify, analyse, evaluate, treat, accept, communicate, monitor and review.

Cloud risk identification sources: provider audit reports (ISO/IEC 27001, SOC 2), shared responsibility matrix, data flow mapping, contract review, and threat intelligence.

Supplier risk is not eliminated by certification; the customer must assess scope of the provider's certification, carve-outs, and sub-processor chain.

Risk treatment options: modify (controls), retain (accept), avoid (exit or do not use), share (transfer via contract or insurance).

Cloud-specific threats: multi-tenancy isolation failure, insecure APIs, account or service hijacking, data loss, denial of service, and provider lock-in.

Risk criteria must define acceptance thresholds and who may accept residual risk; risk owners are accountable, not the security team.

Concentration risk: dependency on a single provider or region increases impact; mitigation includes multi-region design and exit plans.

Risk register entries for cloud services should record service model, data classification, provider, jurisdiction, control gaps, and review date.

ISO/IEC 27017 extends ISO/IEC 27002 with cloud-specific guidance and assigns each control to cloud service provider, cloud service customer, or both.

ISO/IEC 27017 clause 8.1.1: roles and responsibilities for cloud services must be defined and agreed between provider and customer.

ISO/IEC 27017 clause 9.5.1: the customer should assess provider security controls and the provider should supply evidence such as certifications and audit reports.

ISO/IEC 27017 clause 12.4.5: provider logging and monitoring, with customer access to relevant logs where agreed.

ISO/IEC 27017 clause 13.1.3: separation of virtual computing environments, administrative operations, and virtual networks between tenants.

ISO/IEC 27018: publicly available cloud acting as processor must handle PII per customer instructions, return or delete PII at contract end, and disclose sub-processors before use.

ISO/IEC 27018 requires transparency about government access requests and lawful disclosure, and breach notification to the customer without undue delay.

ISO/IEC 27018 requires that PII used for marketing or secondary purposes be subject to explicit consent and that data be restored in a timely manner after an incident.

Cryptography: encrypt data in transit (TLS), at rest (provider-managed or customer-managed keys), and manage key custody separately from the data store.

Awareness builds attitude; training builds skill; education builds deeper competence. Cloud awareness targets all staff; role-based training targets administrators, developers, and procurement.

Shared responsibility must be communicated per service model: SaaS users focus on access and data handling; IaaS administrators also handle OS patching and network configuration.

High-risk cloud behaviours to target: shadow IT adoption, public bucket or share misconfiguration, credential sharing, and unencrypted data upload.

Competence requirements (ISO/IEC 27001 clause 7.2) must be determined, met, and evidenced by records of training and experience.

Cloud administrator training covers identity federation, key management, logging, backup, cost controls, and provider console security settings.

Developer training covers secure API design, secrets management, infrastructure as code review, and secure CI/CD pipeline controls.

Procurement and legal staff need training on data residency, sub-processor approval, exit clauses, and audit rights.

Awareness effectiveness is measured by phishing simulation results, misconfiguration trends, incident reports, and assessment scores, not attendance counts.

ISO/IEC 27035 phases: prepare, detect and report, assess and decide, respond, learn. Cloud incidents require a joint response model with the provider.

Contract clauses must define provider notification timelines, escalation contacts, evidence sharing, and support for customer regulatory reporting.

Detection sources: provider notifications, cloud-native detection services, SIEM correlation, billing anomalies, and user reports.

Evidence handling in cloud: logs may be provider-controlled; agree on retention periods and export capability before an incident, and preserve chain of custody.

Containment in cloud: revoke credentials and tokens, isolate instances via security groups, snapshot volumes, and disable compromised accounts.

Data breach notification: GDPR requires notification to the supervisory authority within 72 hours of awareness where required; the provider's delay must not consume the customer's window.

Root cause analysis should distinguish customer misconfiguration, provider failure, and shared-interface failure, since remediation ownership differs.

Lessons learned must feed back into risk assessment, control changes, and awareness content; track corrective actions to closure.

Monitoring layers: provider infrastructure telemetry, control plane audit logs (API activity), data plane logs, and application logs.

ISO/IEC 27001 clause 9.1 requires evaluation of security performance; define metrics such as patch latency, misconfiguration count, and mean time to detect.

Vulnerability management in IaaS includes OS and image scanning; in PaaS and SaaS the customer scope is configuration, identity, and code.

Penetration testing of provider infrastructure usually requires prior written authorization and is restricted by provider policy; customer-scoped testing of own workloads is typically permitted with notice.

Configuration compliance: benchmark against CIS or provider hardening baselines and continuously assess drift.

Internal audit (clause 9.2) and management review (clause 9.3) must cover cloud services, supplier performance, and risk treatment progress.

Nonconformity and corrective action (clause 10.2) apply to cloud control failures; record root cause and verify effectiveness.

Continual improvement (clause 10.1) uses monitoring data, incident trends, audit findings, and provider changes to update controls and policy.