With the Cloud migration waves in almost all types of organizations, audit and compliance programs have to jump into the world of cloud. Cloud platforms provide unique capabilities and challenges for audit and compliance professionals.

1. Title
Name
Role
Confidential
October 1, 2019

2. | 61Confidential
Pouria is Interac’s Info Security Manager with over
13 years of experience. He is passionate about
securing public cloud platforms (AWS, OCI, and
Azure) and developing enterprise security compliance
programs in modern application platforms. In addition,
he has extensive experience in implementing
DevSecOps, SDLC security, and Privileged Access
Management solutions. He holds multiple professional
certifications in cloud security, security audit, and
security management.
Up Next: Pouria Ghatrenabi
Information Security Governance Manager

3. Into the Fluffs
Security Compliance and Audit in the Cloud
Interac Business and Compliance Forum - 2020
Pouria Ghatrenabi

4. Tiny about Me
| 63
Pouria Ghatrenabi

5. • Agenda
| 64
• Cloud Formation: Cloud Computing Concept and Drivers
• Inside the Puffs: Cloud Native Security and Compliance
• Make it Rain: Examples of Conducting Security Audit in the Cloud
• Summary and Conclusions
• QnA

6. Cloud Formation: Cloud Computing Concept and Drivers
| 65

7. Cloud Computing Concept
| 66
Ref: https://www.redhat.com/en/topics/cloud-computing/iaas-vs-paas-vs-saas

8. Business Drivers
Strategy Total Cost
of
Ownership
Change in
IT Cost
Structure
Scalability Agility
| 67

9. Getting Aligned with the Business
| 68
Ref: https://en.wikipedia.org/wiki/Archery

10. Inside the Puffs: Cloud Native Security and Compliance
| 69

11. Shared Responsibility Model
| 70
Ref: https://aws.amazon.com/compliance/shared-responsibility-model/
Cloud
Service
Provider
You

12. Cloud Service Providers Compliance Programs
Global
| 71

13. Cloud Service Providers Compliance Programs
Americas
| 72

14. Standardized Infrastructure
Standard
Machine
Images
Configuration
Templates
Service
Catalogues
Infrastructure
Orchestration &
Management
Tools
Infrastructure
as Code
| 73

15. Infrastructure as Code (IaC)
| 74
Ref: https://www.hashroot.com/infrastructure-as-code

16. Policy as Code
• Policy as code is the idea of writing code in a high-level language to manage
and automate policies.
| 75
Codification
Version
Control
Automation
Testing and
Promoting
Auditability

17. Make it Rain
Examples of Conducting Security Audit in the Cloud
| 76

18. Case 1 - Establishing Roles and Responsibilities
12.8 Maintain and implement policies and procedures to manage service providers with whom cardholder
data is shared, or that could affect the security of cardholder data,
12.8.5 Maintain information about which PCI DSS requirements are managed by each service provider,
and which are managed by the entity.
| 77

19. AWS Artifact
| 78

20. AWS Artifact
| 79

21. Case 2 - Access and Account Recertification
| 80
8.1.1 Assign all users a unique ID before allowing them to access system components or cardholder data.
8.1.4 Remove/disable inactive user accounts within 90 days.
8.2 In addition to assigning a unique ID, ensure proper user-authentication management for non-consumer
users and administrators on all system components by employing at least one of the following methods to
authenticate all users:
• Something you know, such as a password or passphrase
• Something you have, such as a token device or smart card
• Something you are, such as a biometric.
8.2.4 Change user passwords/passphrases at least once every 90 days.

22. AWS IAM - Credential Report
| 81

23. AWS IAM - Credential Report
| 82

24. AWS IAM - Credential Report
| 83
• user_creation_time
• password_last_used
• password_last_changed
• password_next_rotation
• mfa_active
• …

25. Case 3 - Verifying Audit Logs Integrity
10.5 Secure audit trails so they cannot be altered.
| 84

26. Verifying Audit Logs Integrity
| 85
Enable
aws cloudtrail update-trail --name your-trail-name --enable-log-file-validation
Validate
aws cloudtrail validate-logs --trail-arn <trailARN> --start-time <start-time> [--
end-time <end-time>] [--s3-bucket <bucket-name>] [--s3-prefix <prefix>] [--verbose]

27. Summary and Conclusions
| 86

28. Summing It Up
Enterprises are going to the cloud inevitably, and audit
and compliance programs have to follow the migration.
Compliance policies are applied in an automated,
standardized, and codified manner in the cloud
There are cloud native services to support security
audits in public cloud
| 87

29. QnA
| 88

30. Thank You