+Managing Vulnerabilities, Malfunctions and Errors - System Hardening

Managing Vulnerabilities, Malfunctions and Errors - System Hardening

System components in the production environment used to provide the cloud service under the Cloud Service Provider's responsibility are hardened according to generally accepted industry standards. The hardening requirements for each system component are documented.
If non-modifiable ("immutable") images are used, compliance with the hardening specifications as defined in the hardening requirements is checked upon creation of the images. Configuration and log files regarding the continuous availability of the images are retained.
Additonal CriteriaSystem components in the Cloud Service Provider's area of responsibility are automatically monitored for compliance with hardening specifications. Deviations from the specifications are automatically reported to the appropriate departments of the Cloud Service Provider for immediate assessment and action.
Supplementary Information - About the CriteriaSystem components in the sense of the basic criterion are the objects required for the information security of the cloud service during the creation, processing, storage, transmission, deletion or destruction of information in the Cloud Service Provider's area of responsibility, e.g. firewalls, load balancers, web servers, application servers and database servers. These system components in turn consist of hardware and software objects. This criterion is limited to software objects such as hypervisors, operating systems, databases, programming interfaces (APIs), images (e.g. for virtual machines and containers) and applications for logging and monitoring security events.
The configuration and log files for non-modifiable mages include e.g.:
• Configuration of the images used with regards to implemented hardening; and specifications including version history
• Logs for file integrity monitoring of images in productive use.
Generally accepted industry standards are, for example, the Security Configuration Benchmark of the “Centre for Internet Security” (CIS) or the corresponding modules in the BSI ITGrundschutzKompendium.
Compliance with hardening specifications can be monitored with e.g. file integrity monitoring

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

Requisitos

3. Regulaciones relacionadas

Regulaciones