Walk-Through – Assessing Policy Settings and Resource Controls

In the previous chapter, we put our learnings of cloud IAM control settings to the test. Now, we will perform some practice with identifying and assessing policy and resource control settings.

In this chapter, we’ll cover the following main topics:

• Preparing to assess network, infrastructure, and resource controls
• Assessing network and firewall settings
• Assessing resource management policies
• Assessing data security policies

We will pose a sample assessment question for each of the topic areas and execute a basic test procedure. By the end of this chapter, we will have a deeper understanding of assessing network, resource, and data security policies as part of an enterprise cloud audit.

Preparing to assess network, infrastructure, and resource controls

From Chapter 4, Network, Infrastructure, and Security Controls, to Chapter 6, Tips and Techniques for Advanced Auditing, we learned about some of the network, infrastructure, and resource controls available to enterprises across the three major cloud providers. As a reminder, we’ve only covered a subset of the various options that are available in order to provide some foundational knowledge. As we covered in Chapter 2, Effective Techniques for Preparing to Audit Cloud Environments, obtaining a thorough understanding of how the enterprise environment is architected and connected is critical to determining which areas within a cloud environment should be scoped for audit.

Having architectural diagrams that indicate areas of integration will highlight whether there are hybrid and/or multi-cloud controls that should be assessed. As we identified in our control walk-through in Chapter 8, Walk-Through –...

Assessing network and firewall settings

With network and firewall settings, it’s important to have clarity of environment isolation requirements, which resources are deployed in an environment, network traffic requirements, and governance over routing tables and defining subnets.

For our walk-through in this section, our control testing will determine whether traffic logging and alerting have been enabled to detect anomalies with connectivity and network traffic. Please review the compliance frameworks that we referenced in Chapter 2, Effective Techniques for Preparing to Audit Cloud Environments, as these may guide you to additional methods for gathering test evidence. In our example, we will walk through one simple method to obtain this information within the Azure cloud environment; however, please keep in mind that there are often many other ways of collecting the same information. Let’s review one option to do this within Microsoft Azure.

Microsoft Azure

...

Assessing resource management policies

Within cloud environments, there are several different types of resource controls. One type, the ability to manage billing and cost controls, not only has a financial impact but also has technical implications as well. In many cases, these controls may define a hierarchy of who can add additional compute resources, how those resources are provided, and the scale of those resources being allocated. Not managing this properly could lead to environmental sprawl and architecture that is not fully documented or vetted and to significant charges for resource consumption if effective controls are not in place. Additionally, in some cases, being defined as a billing administrator also provides a level of privileged technical access within the enterprise cloud environment, making this ability especially sensitive. Another type of resource control that we covered in Chapter 5, Financial Resources and Change Management, was the use of enabling policies,...

Assessing data security policies

Data within an enterprise may be one of the most essential assets that an organization owns, and ensuring that any sensitive data is properly protected through means such as encryption, data masking, and logging of changes to data are likely to be critical controls. In this walk-through, we’ll look at assessing adherence to data security policies in AWS and Azure by checking to see that logging and appropriate levels of encryption have been enabled.

AWS

One primary way to check adherence to data security policies within AWS is by reviewing findings in the AWS Security Hub. To review these findings, we will need to perform the following steps:

1. Navigate and log on to the AWS Console.
2. Select the Security, Identity, & Compliance service.
3. Select Security Hub.

Within the Security Hub report, we can review a list of findings that relate to some of the standards and frameworks that were referenced in Chapter 2, Effective...

Summary

In this chapter, we performed a walk-through of basic testing and evidence gathering that can be used for enterprise cloud policy settings and resource controls. We covered preparing to assess network, infrastructure, and resource controls and did some general walk-throughs of the various cloud environments.

In our final chapter, we’ll wrap up our walk-throughs by assessing logs, change management, and monitoring and alerting controls across the cloud providers.