Using AWS in the Context of CESG UK’s Cloud Security Principles
Last year, CESG UK published the Cloud Security Guidance documents for public sector organizations that are considering the use of cloud services for handling information classified as OFFICIAL. The guidance aims to help public sector organizations make informed decisions about cloud services and choose a cloud service that balances business benefits and security risks. In relation to this, the legacy Impact Level accreditation scheme has been phased out and is no longer the mechanism used to describe the security properties of cloud services.
In order to provide you with guidance regarding the Cloud Security Principles and to make an informed decision when performing risk assessments, we have published a whitepaper called Using AWS in the Context of CESG UK’s Cloud Security Principles.
This whitepaper provides insights into implementation and assurance approaches within AWS based on the published guidance for each of the 14 Cloud Security Principles and Subprinciples. If you are a Senior Information Risk Officer or a CESG-Listed Advisor Scheme consultant supporting a decision-making process for selecting a cloud service at a UK public sector organization, the whitepaper provides an in-depth view into the AWS implementation approach in relation to the Cloud Security Principles. Based on this information, UK public sector organizations and their information security functions can conduct informed risk assessments and select the appropriate AWS services for their cloud environment.
AWS currently provides the following 11 services on the UK Government Digital Marketplace:
- Amazon CloudWatch – Digital Marketplace link
- Amazon Elastic Block Store (Amazon EBS) – Digital Marketplace link
- Amazon Elastic Compute Cloud (Amazon EC2) – Digital Marketplace link
- Amazon Glacier – Digital Marketplace link
- Amazon Relational Database Service (Amazon RDS) – Digital Marketplace link
- Amazon Simple Storage Service (Amazon S3) – Digital Marketplace link
- Amazon Virtual Private Cloud (Amazon VPC) – Digital Marketplace link
- Auto Scaling – Digital Marketplace link
- AWS Direct Connect – Digital Marketplace link
- AWS Identity and Access Management (AWS IAM) – Digital Marketplace link
- Elastic Load Balancing – Digital Marketplace link
We look forward to hearing how you are using the whitepaper and the ways we can improve it. Please contact us for questions about meeting your compliance requirements in the cloud.
Please refer to these related links for more information:
– Chad Woolf, Director, AWS Risk and Compliance
Want more AWS Security how-to content, news, and feature announcements? Follow us on Twitter.