MEDINA project presentation during the EUCloudEdgeIoT session at NexusForum2023

1. This project has received funding from the European
Union’s Horizon 2020 research and innovation
programme under grant agreement No 952633
Towards Continuous Security
Compliance in the Cloud Continuum -
MEDINA Project & beyond
Juncal Alonso
TECNALIA, Spain / EU MEDINA Project

2. Why the EU-funded MEDINA Project?
Let’s understand the
real-world
implications from an
EUCS perspective…
…and one day
we will fully
realize
automation in
EUCS processes!
06.10.2023
NexusForum2023
‘basic’ level
‘substantial’ level
‘high’ level
🤞
👍
👮 Continuous monitoring of compliance
* Preliminary analysis documented in our whitepaper.
The implementation of “continuous monitoring”
brings some *challenges to Cloud Service Providers,
but also to Conformance Assessment Bodies auditing
those requirements

3. MEDINA Framework – OS components
Auditors
CSPs CAB, NCCA 06.10.2023
NexusForum2023
Repository of Metrics and Measures
Risk Based Selection of controls to reach
certification assurance levels
Certification language
Continuous Evidence Management tools
Continuous Cloud Certificate Evaluator
Risk based Auditor tool

4. Towards Continuous Certification as a
Service in the Cloud: EMERALD IA action
06.10.2023
NexusForum2023

5. Addressed challenges
Security compliance in Cloud is becoming a must
Dynamic infrastructure needs a high sample rate
Complex Cloud-Edge environments can auto-scale up rapidly
Cloud Nature services abstract underlying infrastructure
Resources in cloud environments often have dependencies
on each other
Hybrid approaches are the new “Business as usual”
06.10.2023
NexusForum2023
Ensuring that frequent application and infrastructure changes
comply with security and compliance policies is challenging

6. Leveraging automation, ensuring compliance,
enhancing trust.
@MedinaprojectEU
MEDINA Project - Continuous
cloud security certification
@MedinaprojectEU
www.medina-project.eu // juncal.alonso@tecnalia.com
Thank you!
www.medina-project.eu