+KSI-CNA Cloud Native Architecture
---+KSI-CNA-DFP Defining Functionality and Privileges
---+KSI-CNA-EIS Enforcing Intended State
---+KSI-CNA-IBP Implementing Best Practices
---+KSI-CNA-MAT Minimizing Attack Surface
---+KSI-CNA-OFA Optimizing for Availability
---+KSI-CNA-RNT Restricting Network Traffic
---+KSI-CNA-RVP Reviewing Protections
---+KSI-CNA-ULN Using Logical Networking

KSI-CNA Cloud Native Architecture

1. Ülevaade

KSI-CNA-DFP Defining Functionality and Privileges

The functionality and privileges for infrastructure and services are strictly defined.

NIST SP 800-53 Rev. 5 controls: CM-2, CM-8(4), CP-10(4), IR-9(4), SI-3
KSI-CNA-EIS Enforcing Intended State

Class B

Optional: Automated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state.

Class C

Automated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state.

NIST SP 800-53 Rev. 5 controls: CA-2(1), CM-11, CM-6(2), CP-10(4), IR-9(4), SC-24, SC-7(18), SI-4(22), SI-7, SI-7(1), SI-7(5), SI-7(7)

Defined terms: Information Resource, Machine-Based (Information Resources), Persistently
KSI-CNA-IBP Implementing Best Practices

The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance.

NIST SP 800-53 Rev. 5 controls: AC-17(3), CM-2, PL-10, SC-7(18)

Defined terms: Information Resource, Machine-Based (Information Resources), Persistently
KSI-CNA-MAT Minimizing Attack Surface

Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised.

NIST SP 800-53 Rev. 5 controls: AC-17(3), AC-18(1), AC-18(3), AC-20(1), CA-9, SC-10, SC-7(18), SC-7(3), SC-7(4), SC-7(5), SC-7(8), SC-8, SI-10, SI-11, SI-16

Defined terms: Information Resource, Machine-Based (Information Resources), Persistently
KSI-CNA-OFA Optimizing for Availability

Machine-based information resources are persistently reviewed to ensure they are appropriately optimized for high availability and rapid recovery.

NIST SP 800-53 Rev. 5 controls: CP-2(5), SC-12(1)

Defined terms: Information Resource, Machine-Based (Information Resources), Persistently
KSI-CNA-RNT Restricting Network Traffic

Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic.

NIST SP 800-53 Rev. 5 controls: AC-17(3), CA-9, CM-7(1), SC-7(10), SC-7(18), SC-7(20), SC-7(21), SC-7(5), SI-10, SI-4(11), SI-4(18), SI-4(4), SI-8

Defined terms: Information Resource, Machine-Based (Information Resources), Persistently
KSI-CNA-RVP Reviewing Protections

The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed.

NIST SP 800-53 Rev. 5 controls: IR-4(2), SC-5, SC-7(18), SI-8, SI-8(2)

Defined terms: Information Resource, Machine-Based (Information Resources), Persistently
KSI-CNA-ULN Using Logical Networking

Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls.

NIST SP 800-53 Rev. 5 controls: AC-12, AC-17(3), AC-4(21), CA-9, CM-11, SC-10, SC-4, SC-7, SC-7(20), SC-7(21), SC-7(7), SC-8

Defined terms: Persistently

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

Nõuded

3. Seotud regulatsioonid

Regulatsioonid
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.