Financial Resource and Change Management Controls

Due to the dynamic and automated capabilities that enable the quick procurement, deployment, and modification of cloud services, understanding how to review and assess the configuration of financial and change management controls in cloud systems is an essential skill for auditing these environments.

In this chapter, we’ll cover the following main topics:

• Policies for resource management
• Policies for change management
• Change management integration and workflows
• Reviewing change history
• Financial billing and cost controls
• Financial resource ownership

By the end of this chapter, we will be able to identify policies and tags and know some options for configuring or applying these across the three cloud providers. We’ll also gain insight into how tags impact resource management and learn why tags might be used. We’ll learn how native DevSecOps tools may be integrated for change...

Example resource management controls

As mentioned in Chapter 2, Effective Techniques for Preparing to Audit Cloud Environments, several frameworks can be used as guidelines for a list of applicable controls and test procedures when defining the scope of your audit. As a reference for this chapter, we’ll highlight a few example controls from the Center for Internet Security (CIS) and Cloud Security Alliance (CSA) that are relevant to resource management, tagging, change management, change history, and financial features within an enterprise cloud environment.

Center for Internet Security (CIS) benchmark controls

As a reminder, determining all applicable controls will need to be based on system architecture and integration, business risk management goals, and enterprise operational procedures:

• CIS Control 3 Sub-Control 3.7 – Establish and Maintain a Data Classification Scheme: Establish and maintain an overall data classification scheme for the enterprise...

Policies for resource management

To ensure that cloud resources (particularly when using IaaS and PaaS services) align with operational and security policies, it’s often necessary to leverage technical policies to enforce these within a cloud environment. These technical policies allow organizations to configure a technical template of standards that the cloud resources are either configured to adhere to at the time of setup, reconfigured to adhere to as changes are made, or potentially create alerts for an administrator when the resource is no longer in compliance. In many cases, different policies might be assigned to different resources based on the intent and use of the resource. For example, there may be a need to apply more restrictive policies to a resource that is in a production environment versus a sandbox environment, or those resources that are accessible to external users versus those that are only accessible to users within a corporate directory. The determination...

Performing changes

Beyond using policies and tags to control compliant management of resources, these same features, along with others, may be used to restrict changes. Each of the cloud providers offers a way of grouping resources together for ease of classification. Both at a group and individual level, settings can be applied to lock the resource against changes or to restrict the level of changes that can be made (as shown in Figure 5.7), in addition to role assignments and access policies, as covered in Chapter 3, Identity and Access Management Controls:

Figure 5.7 – Example Microsoft Azure read-only lock applied

This level of restriction may not be readily apparent when discussing access controls, which is why organizations must document their system architecture. As auditors, we must understand that cloud providers offer a complex mix of controls that can be applied.

Now that we have looked at additional options for controlling changes...

Change management integration and workflows

When adopting IaaS or PaaS cloud services, many companies also choose to adopt change management processes that support continuous integration/continuous deployment (CI/CD). By necessity, this means there should be automated processes embedded into their change management procedures. From an auditing standpoint, this becomes important for a few different reasons. Removing manual processes also reduces the opportunity for manual IT control failures, but organizations now need to ensure that there are safeguards within the automated process that enforce separation of duties, automated policy applications, effective testing and approval gates, and rollback procedures. Automation workflows themselves will need to be regularly reviewed to ensure they adhere to change controls requirements, are not allowing compliance checks to be bypassed, and there is clear visibility and approval for those individuals with access to change the automation workflows...

Change history

As an auditor, one method that may be used to correlate processes and procedures that mitigate risk is to review activity logs. In cloud environments, these logs may be made up of separate sign-in and event logs that are capturing change history and actions performed by user accounts, service accounts, or workload identities.

In each of the cloud environments, you will find multiple options for tracking the activity that’s occurred. The amount of this activity that is tracked, where it is tracked, and for how long this information is made directly available will change based on licensing, cloud system configuration, and cloud provider. In some cases, supplementary data storage tools or platforms may need to be used to ensure longer retention that meets compliance requirements. As an IT auditor, you should also note that not all items are logged by default. In some cases, an organization may need to manually enable logging or the settings to log certain activities...

Financial billing and cost controls

In a cloud environment, setting up services can be as easy as providing a credit card number. Although this provides the benefit of making cloud services easy to enable and consume, this also adds risk in terms of business continuity (what if the credit card holder leaves the company?), as well as a company being financially liable for overages or the misuse of services (someone stands up a rogue server for crypto mining). Like controls in legacy environments that may check who is authorized to approve purchases at a given amount, this should be assessed within the cloud environment as well. Additionally, the IT auditor should ensure there are controls in place that allow an organization to limit potential cost overages and that proper alerting and notification are in place to monitor billing and cost status.

Depending on how the environment has been configured, some access controls may be defined around who can access billing and cost information...

Financial resource ownership

As we reviewed in Chapter 1, Cloud Architecture and Navigation, cloud services operate on the Shared Responsibility Model. Understanding this becomes increasingly important as you begin to assess change management controls, which is the ability to log and view changes in a cloud environment and protect against unexpected costs. In most scenarios, it is not the responsibility of the cloud provider to prevent an organization from occurring overages because they have consumed more resources than planned or because there is a lack of controls around who can request increased quota and services. An organization must be vigilant in establishing and communicating a financial ownership and responsibility structure, with both process and technical controls that enforce that structure.

Summary

In this chapter, we looked at some essential areas for IT controls, change management, and financial resource management, where configuration options exist for identity and access management within the three major cloud providers. We covered where policy and tagging configuration can be found and how this information may be automated and influence access.

We also reviewed tools available for change management controls in a CI/CD cloud environment, as well as how to view change history. We finished this chapter by reviewing some features available for billing and cost controls and the importance of determining financial resource ownership.

In the next chapter, we’ll look at executing an effective cloud portal audit plan and some tips and techniques that will support that.