Cloud Security Alliance Unveils GRC Stack

Free tools help organizations create public and private clouds that comply with accepted governance, risk, and compliance best practices

The Cloud Security Alliance (CSA) on Wednesday announced the release of a new governance, risk management, and compliance stack for cloud computing. The suite of cloud security tools, available for free download, is meant to help organizations create public and private clouds that comply with industry standards for accepted governance, risk, and compliance (GRC) best practices.
The GRC stack has three components: a technical foundation, a controls framework, and a questionnaire for assessing what the CSA calls industry-accepted ways to document what security controls exist for infrastructure-, platform-, and software-as-a-service offerings.
Philippe Courtot, chairman and CEO of Qualys, sees the framework as a big step in the right direction, both for assuaging customers concerns as well as keeping vendors honest. As cloud computing is rapidly changing the way we do business, such a framework is essential [for] ensuring that our data is secure and that cloud computing vendors adhere to privacy and regulatory requirements, he said.
Of course, businesses are already adopting cloud computing, driven by its relatively low cost and ease of management. By 2012, predicts a report from Gartner, 20% of businesses will own no IT assets, instead just renting them.
But according to a recent survey from Novell, half of businesses still see the state of cloud computing security as a barrier to adoption, and 81% have compliance-related concerns over storing data in the cloud.
What constitutes an acceptable level of cloud-based data security? According to Scott Charney, corporate VP for Microsofts trustworthy computing group, cloud computing brings tremendous benefits to business, but these models also raise questions around compliance and shared responsibility for data protection.
With luck, this framework will help foster agreement about what constitutes cloud security, as well as verification that any given cloud providers approach complies with GRC best practices.
RSA, for example, said it would build the framework into its Archer eGRC platform, which is part of its RSA Solution for Cloud Security and Compliance. Gaining visibility into service provider environments and governing them according to overall enterprise GRC strategy have emerged as major concerns for organizations when considering the use of public cloud services, said Eric Baize, senior director of cloud security strategy at RSA, which is part of EMC.
Have a comment on this story? Please click Discuss below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Cloud Security Alliance Unveils GRC Stack