ORCID:trustworthiness through continuous audit-based certificationLeire Orue-Echevarria02Jesus Luna Garcia023Christian Bansechristian.banse@aisec.fraunhofer.de012Juncal Alonso02TECNALIA02Basque Research02Technology Alliance (BRTA)02Parque Científico y Tecnológico de Bizkaia02Astondo bidea
,
700, E-48160 Derio
,
SpainFraunhofer AISEC
,
Lichtenbergstraße 11, 85748 Garching near Munich
,
GermanyISO, Cloud Security Alliance
,
...), Member States' schemes (e.g., Germany's BSI C5
,
Spain's EsquemaRobert Bosch GmbH
,
Postfach 30 02 20 , 70442 Stuttgart
,
Germany00000002
One of the reasons of the still limited adoption of Cloud Computing in the EU is the EU customers' perceived lack of security and transparency in this technology. Cloud service providers (CSPs) usually rely on security certifications as a mean to improve transparency and trustworthiness, however European CSPs still face multiple challenges for certifying their services (e.g., fragmentation in the certification market, and lack of mutual recognition). In this context, the EU Cybersecurity Act (EU CSA) proposes improving customer's trust in the European ICT market through a European certification scheme (EUCS). The proposed cloud security certification scheme conveys new technological challenges including the notion of automated monitoring for the whole supply chain, which needs to be solved in order to bring all the expected benefits to EU cloud providers and customers. In this context, MEDINA proposes a framework for supporting a continuous audit-based certification for CSPs based on EU CSA's scheme for cloud security certification. MEDINA will tackle challenges in areas like security validation/ testing, machine-readable certification language, cloud security performance, and audit evidence management. MEDINA will provide and empirically validate sustainable outcomes in order to benefit EU adopters. cloud certification scheme, Cybersecurity Act, continuous auditing, continuous certification,
-
smart contracts, certification language
1. Introduction and motivation
Despite the conspicuous benefits to customer’s trustworthiness in cloud services, which result from
leveraging recognized security certifications (just as evidenced by the EU Cybersecurity Act (EU
CSA)), it is also true that European cloud providers currently face multiple challenges to certify their
services. Take for example the European Commission’s study SMART 2016/0029 “Certification
schemes for cloud computing” led by TECNALIA [
3
], which shows that the market penetration of the
cloud security certification is rather uneven. ISO 27001-based certifications are leading the market,
despite being a generic IT systems management standard and not focusing solely on cloud services. The
above-mentioned study has analysed the market penetration of international certification schemes (e.g.,
Nacional de Seguridad – ENS), private initiatives (e.g., Zeker online, EuroCloud), public-private
initiatives (e.g. Trusted Cloud) and cross-border initiatives (e.g., ESCloud) in 50 Cloud Service
Providers (CSPs). The conclusions demonstrate a big fragmentation in the domain of existing
certification schemes.
First workshop on trustworthy software and open source, March 23-25, 2021, Virtual Conference
EMAIL:
In addition to the evident fragmentation in cloud security certification schemes, the EC study also
highlighted the diverse focus of the different security controls in current certification schemes.
The final challenge that European cloud providers face when seeking a certification is the selection
of the conformity assessment method (CAM). Several different CAMs exist at the state of practice such
as self-assessment, evidence-based, ISO-based, and ISAE 3402. Each of these CAMs also have
different scopes. While ISO mainly assesses if security measures are defined and put in place at a certain
point of time, ISAE evaluates the efficiency of the implemented controls in a period of time, usually
six months.
The conspicuous lack of cloud-specific security certifications, in addition to the existing market
fragmentation (scope, methodologies), hinder transparency and accountability in the provision of
European cloud services. Both issues ultimately reflect on the level of customer’s trustworthiness and
adoption of cloud services in Europe.
In an effort to solve some of the challenges depicted above, the EU Cybersecurity Act (EU CSA,
approved in June 2019) in its Title III gives ENISA the mandate of defining and implementing a
European security certification scheme for ICT products, processes and services for three different
levels of assurance (low, substantial, and high). Being cloud computing one of the identified EU CSA
priorities, Articles 54 (j) and 57 (9) propose the possibility of deploying a high-assurance,
evidencebased and continuous certification of European cloud providers. Despite the evident benefits of EU
CSA’s principles for the European market and cloud customers, currently there are no concrete cloud
certification frameworks nor tools for implementing any of those proposals.
To overcome this situation, the main objective of the MEDINA European research project [
14
] is to
provide a holistic framework that enhances cloud customers’ control and trust in consumed cloud
services, by supporting CSPs (IaaS, PaaS and SaaS providers) towards the successful achievement of a
continuous certification aligned to the EU Cybersecurity Act (EU CSA). Such certification should fulfill
the requirements of the EU cloud security certification scheme in their basic, substantial and high
assurance levels. The proposed framework will be comprised of tools, techniques, and processes
supporting the continuous auditing and certification of cloud services where security and accountability
are measurable by design. As the MEDINA framework is leveraged into a cloud supply chain, it will
support continuously assessing the efficiency and efficacy of security measures to ultimately achieve
and maintain a certification.
The rest of this paper is structured in the following manner: Section 2 introduces an overview of the
related state of the art and the progress that MEDINA expect to provide to each topic. Section 3 details
the MEDINA approach for Cloud Security Continuous Certification and section 4 oversees the future
work in MEDINA.
2. Introduction and motivation
In the last years, several projects and initiatives have worked in research areas of interest for
continuous certification of security in Cloud Services. Table 1 shows an overview of the main
challenges identified after the analysis of the current state of the art per area of interest, considering
national and/or international initiatives, and highlighting the main scientific advances that MEDINA
will bring.
Cloud security certification • Fragmented • MEDINA framework
schemes and conformity certification schemes. supports the homogenization of
assessments • Partial coverage of certification schemes, by
[26], [
3
] relevant cloud security controls. aligning to the EU CSA.
• Wide variety of • Framework fully
conformity assessment covers security controls from
methods. relevant standards and good
practices.
• MEDINA leverages
conformity assessment
methodologies proposed to EU
CSA
Continuous assessment, • Static cloud security • Toolset supporting EU
audit and certification configurations, i.e., forced by CSA’s cloud certification
[
22
], [
18
], [
10
], [
19
], [
8
] traditional audits, cannot adapt processes, including
to a changing threat landscape. automation (smart contracts),
• Lack of KPIs and accountability and
techniques for measuring cloud trustworthiness.
security efficiency/efficacy. • Risk-based MEDINA’s
• Trustworthiness of framework supports CSPs in
evidences, and automation are adapting security configuration
missing in current cloud at run-time/design-time, in a
certification processes. certifiable manner.
• Non-technical • Contribution of a
measures are not quantifiable repository containing TOMs,
and thus currently hard to assess metrics and security KPIs
continuously derived from internationally
accepted control frameworks.
• New techniques to
analyse the semantic of
documents and process
descriptions to address
nontechnical and organisational
controls
Policies for certification • Limited scope of • Provision of a broad
language existing tools on new spectrum of evidence gathering
[27], [28], [
6
], [
5
], [29], [
21
] computing paradigms such as techniques for technical
serverless computing measures, such as security
• Existing static code assessment of cloud workloads,
analysis techniques are not containers and serverless
adopted to the needs of functions
gathering evidences in a • Analysis of data flows
certification context of cloud applications using
• Non-technical code property graphs on
measures are not quantifiable incomplete source code
and thus currently hard to assess • Machine-learning and
continuously NLP to analyse the semantic of
• Auditors lack real- documents and process to
world experience on continuous address non-technical or
certification organisational measures
• Validation of
techniques based on real-world
audit practices
Economic and risk aspects • Lack of (economic) • MEDINA framework
of certification analysis for evaluating the cost- for quantitative risk-assessment
[
16
], [
15
], [30], [
2
], [
11
], benefit of security for cloud security certification.
[31], [
12
], [
7
] certifications, and related • Contribution of
cybersecurity risks. validated cost-benefit analysis
• No CSP guidance for to ensure the cost-effectiveness
selecting risk-assessment of the selected
methodologies for purposes of countermeasures.
cloud certification. • The MEDINA
• Entry barrier for small framework will also help to
EU CSPs, which face costly compare various security
setup of security configurations system configurations to
to achieve a certification. support CSPs in their
certification efforts.
• Provide support
reevaluate the CSP security
configuration at run-time, thus
ensuring continuous
adaptability of the certification.
3. MEDINA approach
The MEDINA approach is depicted in Figure 1 MEDINA approach for continuous Cloud Services
certification against the EU Cloud Certification Scheme (EUCS). It describes the lifecycle of
continuous Cloud security certification, from the definition of the security controls and metrics to the
continuous auditing of the evidences. Such lifecycle can be summarized as follows:
1. Define a catalogue of metrics associated to technical and organizational measures out of the
MEDINA catalogue (e.g., based on EUCS [
4
]). This repository of metrics (Key result 1- [KR1]) and
measures entails a clear definition of the technical and organizational measures (TOMs) relevant for
cloud service providers. The repository also includes the corresponding security metrics (both
quantitative and qualitative) for security requirements/TOMs such as those related to system security
and integrity, operational security, business continuity and incident management.
2. Select controls: Taking into consideration the CSPs risk appetite following a risk-based
approach and the chosen assurance level, the CSP shall select the implementing TOMs and related
metrics for all security controls considering its risk appetite. MEDINA offers a tool-supported
riskbased approach [KR2] to select the appropriate controls aligned with the overall risk “appetite” of
the organisation. This will be based on a risk self-assessment tool and will help to identify the core
assets of the service (considering all involved stakeholders), help to value them and identify the
relevant threats. Furthermore, the framework will be improved to propose an (near) optimal security
configuration to ensure the optimal coverage of security risks. After that, assets of the cloud service
and relevant IT threats shall be identified, and additional implementing TOMs proposed [KR2].
MEDINA proposes a tool-supported methodology for the selection of additional controls and
associated TOMs, which address the concrete needs of a CSP taking into consideration both its risk
appetite and requested certification’s assurance level.
3. Specify the certification language: currently certification schemes are expressed using natural
language. MEDINA proposes to transform this certification language into a machine-readable
expression [KR3], by using NLP, including aspects such as scope of the certification, assurance level
and conformity assessment method. For a lean and seamless trait d'union between what is required
by official documents of the European Commission in terms of certification to the definition of the
machine-readable certification language [KR3] MEDINA intends to develop:
• A procedure to semi-automatically translate Natural Language (NL) certifications terms and
conditions, as they appear on official documents like, e.g., the Cybersecurity Act, into a Controlled
Natural Language (CNL) [
9
];
• A tool to edit, tune and revise semi-automatically generated CNL, to manually improve the
translation and verify the generated statements;
• A component to map the CNL to a runtime-enforceable Domain-Specific Language (DSL) that
can be used by assessment tools to check the compliance status of the stated certification terms and
conditions.
4. Collect and evaluate evidences, continuously and automatically audit: Once the scope of the
certification scheme is established, the evidences need to be collected [KR4] at cloud service as well
as code level, both at design and at operation time, that is, during the whole lifecycle of the cloud
service. The collected evidences need to be ensured that no one has tampered with them and are
trustworthy. MEDINA refers to Distributed Ledger Technologies (DLT)-based that manage
evidence (e.g., on a private blockchain) based on additional information about the deployed or
tobe-deployed services. Moreover, these evidences are continuously evaluated [KR5] and the risks
continuously monitored and updated [KR6], in order to have a secure operational service certifiable
through the selected conformity assessment method.
5. Achieving continuous certification is the process of continuously evaluating whether
appropriate evidence is collected [KR4] that supports the fulfilment of individual controls of a
certification target. MEDINA aims to greatly reduce this effort by providing quantitative measures
for both the target as well as the evidence. Since evidence is collected as a set of measurable metrics
(e.g., by measuring the value 256 of the metric key-size, simple Boolean expressions such as
keysize => 128 in the certification target can be employed), MEDINA is able to validate whether a
measurement result fulfil the certifiable requirement or not [KR5].
Summarizing from the table above (Table 1) and the approach presented here it can be concluded
that no initiative or commercial solution fully covers the objectives of MEDINA.
4. Use cases
The MEDINA framework will be validated in two use cases:
1. European Certification of Multi-cloud backends for IoT Solutions, provided a big industrial
player such as Bosch. This use case will deploy a set of IaaS and PaaS services, commonly used for IoT
backends, in at least three public CSPs (e.g., Microsoft Azure, AWS, and Fabasoft). This case includes
managed Kubernetes clusters, transactional SQL databases, raw virtual storage, virtual networks, virtual
machines (e.g., as jump hosts), and serverless PaaS (e.g., functions). Furthermore, widely used
“support” PaaS will be also deployed e.g., virtual hardware security modules (HSM), log repositories,
application gateways, and network security groups/firewalls-as-a-service. Those PaaS components will
be orchestrated to mock-up and IoT service based on the company’s industrial experience. Having a
measurable, holistic, and end-to-end view of the security measures (TOMs) implemented in such a
complex cloud ecosystem becomes essential for the certification process of the supply chain. Beyond
its usage for the European certification, the continuously achieved levels of security transparency bring
a huge benefit to the internal processes of the organization providing the IoT solution e.g., security
governance, security benchmarking, measurable efficiency and efficacy of implemented TOMs, and
enablement of secure DevOps.
2. Continuous Audit of SaaS Solutions for the Public Sector: this use case provided by Fabasoft
aims to provide a high level of automation to the current audit process of a SaaS provider in alignment
to the EU CSA, with particular focus on continuous audit-based certification. At the state of practice,
for a good number of requirements in current certification schemes (e.g., BSI C5, SOC2, ISO 20017,
etc.), several CSPs already collect evidence automatically by using monitoring tools, log files, internal
versioning and the likes. However, this generated evidence cannot, to date, be evaluated and audited
automatically (continuously) due to the lack of standardized processes and tool chains. Furthermore,
there is no clear definition of what “real evidence” is (i.e., evidence that auditors consider trustworthy
for certification purposes), when it is automatically produced. The tools and techniques proposed by
MEDINA will be validated in this use case, taking into consideration the objectives and Key Results
expected from the project.
5. Conclusions and future work
This paper presented the proposed MEDINA approach to support current challenges in the
continuous security certification of Cloud Computing services. MEDINA proposes to increase the
trustworthiness of the Cloud Services and Cloud Service Providers through a framework of methods,
mechanism and tools supporting continuous cloud security certification, through trustworthy
evidencemanagement methods. The project started in November 2020 and will last 36 months. Currently the
reference architecture for the MEDINA framework is being designed, and the first versions of the
methods and prototypes will be ready during 2021.These initial versions will be validated by two
European Cloud Providers which are part of the MEDINA consortium, Robert Bosch GmbH and
Fabasoft.
Acknowledgements References
This work has been partially funded by the European project MEDINA (Horizon 2020 research and
innovation Programme, under grant agreement no 952633).
[26] “Unleashing the Potential of Cloud Computing in Europe,” EC, 2012.
[27] OSCAL, (n.d.).
[28] OWL - Semantic Web Standards, (n.d.).
[29] Natural Language Toolkit — NLTK 3.5 documentation, (n.d.).
[30] PAe - MAGERIT v.3 : Metodología de Análisis y Gestión de Riesgos de los Sistemas de