Effective Techniques for Preparing to Audit Cloud Environments

The areas and scope for your company’s audit will be dependent on your company’s goals, controls, and environment setup. However, when it comes to cloud auditing, there are some key common elements that you can use to ensure you are successfully prepared to assess the cloud environment according to the defined audit scope. By understanding these elements, you can take advantage of established tools and frameworks to build confidence in the coverage and completeness of your audit.

This chapter will guide you through cloud auditing frameworks, as well as cloud vendor and open source tools available to assist with testing controls that verify management goals for compliance.

In this chapter, we’ll cover the following main topics:

• Understanding the steps in preparing to audit an enterprise customer cloud environment
• Effective techniques to map controls to cloud auditing activities
...

Preparing to perform a cloud assessment

As an auditor, you are performing a critical role in assessing cloud controls. According to several reputable organizations, most cloud security failures and breaches are due to misconfigurations. Diligent and thorough auditing can help you identify those misconfigurations so that they can be addressed and the associated risks can be remediated. Like many other IT audits, performing a cloud assessment begins with a foundation of IT general controls. A gold standard reference for IT general controls is ISACA COBIT controls. In the cloud context, you need to establish other referential and ancillary frameworks that will help with establishing an audit program that is specific to the cloud. The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is one the leading cloud-specific frameworks. More information on additional frameworks will be shared in the Auditing frameworks and governance section later in this chapter.

In preparing to start...

Effective techniques for aligning IT controls to cloud environments

As an IT auditor performing risk and controls assessments within an enterprise cloud environment, establishing audit goals is essential to helping you develop a clear alignment between controls to be tested and the process to effectively test those controls within the cloud. As mentioned in the Preparing to perform a cloud audit section earlier in this chapter, the paradigm of classifying business versus IT functions has changed with the migration to the cloud, requiring a shift in how we think about and assess technical controls within an enterprise cloud. From a broad sense, in the cloud environment, we should focus on determining whether the risks and controls we are assessing for effectiveness are financially focused, operationally focused, or cybersecurity-focused to come up with a logical grouping or mapping of what should be in scope for testing. Let’s look at them in detail:

• Financially focused...

Basic cloud auditing tools and frameworks

Each of the three major cloud providers has some inherent capabilities that support gathering audit evidence. These capabilities are represented in cloud-native tools. In addition, open source tools exist for added coverage where cloud-native tools are limited.

Native tools for auditing Amazon AWS

The following are some tools to audit AWS:

• AWS Security Hub: AWS Security Hub provides a unified view of the security posture in AWS and helps benchmark the AWS environment against security industry standards and best practices.

AWS Security Hub aggregates data from multiple AWS services and third-party partner products to enable prioritization of security issues. The following is a screenshot of the interface of AWS Security Hub:

Figure 2.1 – Interface of AWS Security Hub

Information

You can refer to the AWS Security Hub documentation at https://docs.aws.amazon.com/securityhub/index.html...

Leveraging policy and compliance automation

Cloud deployments are very dynamic for organizations to rely on manual resources. Given the complexity and scale of the platforms on the cloud, it can be a challenge for the teams to manually apply or validate security and compliance policies. As a result, there are numerous opportunities for the IT auditor to leverage automation to assess and enforce policy and compliance in the cloud. Cloud automation is the use of automated tools and processes to execute workflows in a cloud environment that would otherwise have to be performed manually.

One tool an IT auditor can utilize to monitor changes in a cloud customer’s cloud is Terraform Enterprise. Terraform Enterprise has a product named Sentinel. Sentinel has the functionality to ensure an organization’s code against infrastructure aligns with specific policies. This idea is called Compliance as Code or Policy as Code.

With Compliance as Code, controls and policies are...

Summary

In this chapter, we reviewed some key common elements to know about while preparing to perform an effective audit within a cloud environment. Our goal was to ensure you have the frameworks, techniques, and tools at your disposal to build confidence in your enterprise cloud auditing. Knowing and understanding these key elements prepares you for success, provides you with information to be proficient and efficient in your evidence gathering, and potentially reduces the time it takes to complete an audit program. We learned about the preparation steps and frameworks to perform a cloud audit, the established tools that are either natively available or open-source and will help you efficiently collect testing evidence, and the opportunities that exist to automate compliance enforcement and assessment.

The information we discussed in this chapter has hopefully equipped you so that you can begin establishing an audit program playbook using widely available resources. Now that we...