+Product Safety and Security (PSS)
---+Guidelines and Recommendations for Cloud Customers
---+Identification of Vulnerabilities of the Cloud Service
---+Online Register of Known Vulnerabilities
---+Error handling and Logging Mechanisms
---+Authentication Mechanisms
---+Session Management
---+Confidentiality of Authentication Information
---+Roles and Rights Concept
---+Authorisation Mechanisms
---+Software Defined Networking
---+Images for Virtual Machines and Containers
---+Locations of Data Processing and Storage

Product Safety and Security (PSS)

None

1. Forbhreathnú

Guidelines and Recommendations for Cloud Customers The Cloud Service Provider provides cloud customers with guidelines and recommendations for the secure use of the cloud service provided. The information contained therein is intended to assist the cloud customer in the secure configuration, installation and use of the cloud service, to the extent applicable to the cloud service and the responsibility of the cloud user.
The type and scope of the information provided will be based on the needs of subject matter experts of the cloud customers who set information security requirements, implement them or verify the implementation (e.g. IT, Compliance, Internal Audit). The information in the guidelines and recommendations for the secure use of the cloud service address the following aspects, where applicable to the cloud service:
• Instructions for secure configuration;
• Information sources on known vulnerabilities and update mechanisms;
• Error handling and logging mechanisms;
• Authentication mechanisms;
• Roles and rights concept including combinations that result in anelevated risk; and
• Services and functions for administration of the cloud service by privileged users.
The information is maintained so that it is applicable to the cloud service provided in the version intended for productive use.
Additonal Criteria-
Supplementary Information - About the Criteria-
Identification of Vulnerabilities of the Cloud Service The Cloud Service Provider applies appropriate measures to check the cloud service for vulnerabilities which might have been integrated into the cloud service during the software development process.
The procedures for identifying such vulnerabilities are part of the software development process and, depending on a risk assessment, include the following activities:
• Static Application Security Testing;
• Dynamic Application Security Testing;
• Code reviews by the Cloud Service Provider's subject matter experts; and
• Obtaining information about confirmed vulnerabilities in software libraries provided by third parties and used in their own cloud service.
The severity of identified vulnerabilities is assessed according to defined criteria and measures are taken to immediately eliminate or mitigate them.
Additonal CriteriaThe procedures for identifying such vulnerabilities also include annual code reviews or security penetration tests by qualified external third parties.
Supplementary Information - About the CriteriaKnown vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the Cloud Service Provider's software development process are the subject of criteria OPS23 (Management of vulnerabilities, malfunctions and errors open vulnerability assessment).
Online Register of Known Vulnerabilities The Cloud Service Provider operates or refers to a daily updated online register of known vulnerabilities that affect the Cloud Service Provider and assets provided by the Cloud Service Provider that the cloud customers have to install, provide or operate themselves under the customers responsibility.
The presentation of the vulnerabilities follows the Common Vulnerability Scoring System (CVSS).
The online register is easily accessible to any cloud customer. The information contained therein forms a suitable basis for risk assessment and possible follow-up measures on the part of cloud users.
For each vulnerability, it is indicated whether software updates (e.g. patch, update) are available, when they will be rolled out and whether they will be deployed by the Cloud Service Provider, the cloud customer or both of them together.
Additonal CriteriaAssets provided by the Cloud Service Provider, which must be installed, provided or operated by cloud users within their area of responsibility, are equipped with automatic update mechanisms. After approval by the respective cloud user, software updates can be rolled out in such a way that they can be distributed to all affected users without human interaction.
Supplementary Information - About the CriteriaAssets provided by the Cloud Service Provider that cloud customers have to install, deploy or operate themselves in their area of responsibility are for example local software clients and apps as well as tools for integrating the cloud service.
If the cloud service relies on other cloud services, this registry has to incorporate or refer to the vulnerabilities of those other cloud services in order for this criterion to be met.
Error handling and Logging Mechanisms The cloud service provided is equipped with error handling and logging mechanisms. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the data, services or functions it provides.
The information is detailed enough to allow cloud users to check the following aspects, insofar as they are applicable to the cloud service:
• Which data, services or functions available to the cloud user within the cloud service, have been accessed by whom and when (Audit Logs);
• Malfunctions during processing of automatic or manual actions; and
• Changes to security-relevant configuration parameters, error handling and logging mechanisms, user authentication, action authorisation, cryptography, and communication security.
The logged information is protected from unauthorised access and modification and can be deleted by the Cloud Customer.
If the cloud customer is responsible for the activation or type and scope of logging, the Cloud Service Provider must provide appropriate logging capabilities.
Additonal CriteriaCloud users can retrieve security-related information via documented interfaces which are suitable for further processing this information as part of their Security Information and Event Management (SIEM).
Supplementary Information - About the CriteriaIn the case of a SaaS service for secure data exchange, the terms data, services or functions would mean, for example, the logging of all read or write accesses to the stored files and their metadata.
Authentication Mechanisms The Cloud Service Provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility.These authentication mechanisms are set up at all access points that allow users, IT components or applications to interact with the cloud service.
For privileged users, IT components or applications, these authentication mechanisms are enforced.
Additonal CriteriaThe cloud service offers outofband authentication (OOB), in which the factors are transmitted via different channels (e.g. Internet and mobile network).
Supplementary Information - About the CriteriaIT components in the sense of this criterion are independently usable objects with external interfaces that can be connected with other IT components.
Access points in the sense of this criterion are those that can be accessed by users, IT components or applications via networks (for users, for example, the login screen on the publicly accessible website of the Cloud Service Provider).
Multi-factor authentication can be performed with cryptographic certificates, smart cards or tokens, for example.
Session Management To protect confidentiality, availability, integrity and authenticity during interactions with the cloud service, a suitable session management system is used that at least corresponds to the stateoftheart and is protected against known attacks. Mechanisms are implemented that invalidate a session after it has been detected as inactive. The inactivity can be detected by time measurement. In this case, the time interval can be configured by the Cloud Service Provider or if technically possible - by the cloud customer.
Additonal Criteria-
Supplementary Information - About the CriteriaKnown attacks include manipulation, forgery, session takeover, denial of service attacks, enveloping, replay and null cipher attacks.
Confidentiality of Authentication Information If passwords are used as authentication information for the cloud service, their confidentiality is ensured by the following procedures:
• Users can initially create the password themselves or must change an initial password when logging in to the cloud service for the first time. An initial password loses its validity after a maximum of 14 days.
• When creating passwords, compliance with the length and complexity requirements of the Cloud Service Provider (cf. IDM-09) or the cloud customer is technically enforced.
• The user is informed about changing or resetting the password.
• The serverside storage takes place using stateoftheart cryptographically strong hash functions in combination with at least 32-bit long salt values.
Additonal Criteria-
Supplementary Information - About the CriteriaThe stateoftheart regarding cryptographically strong hash functions is described in the current version of the BSI Technical Guideline TR021021 "Cryptographic mechanisms: Recommendations and key lengths". In version 201901 of this guideline these were:
• SHA256, SHA512/256, SHA384, SHA512; and
• SHA3256, SHA3384, SHA3-512.
Roles and Rights Concept The Cloud Service Provider provides cloud users with a roles and rights concept for managing access rights. It describes rights profiles for the functions provided by the cloud service.
The rights profiles are suitable for enabling cloud users to manage access authorisations and permissions in accordance with the principle of leastprivilege and how it is necessary for the performance of tasks ("needto-know principle") and to implement the principle of functional separation between operational and controlling functions ("separation of duties").
Additonal Criteria-
Supplementary Information - About the CriteriaIn IaaS, a role and rights concept would describe, among other things, the rights profiles for the following functions of the cloud service:
• Administration of the states of virtual machines (start,pause, stop) as well as for their migration or monitoring;
• Management of available images that can be used to create virtual machines; and
• Management of virtual networks (e.g. configuration of virtual routers and switches).
Authorisation Mechanisms Access to the functions provided by the cloud service is restricted by access controls (authorisation mechanisms) that verify whether users, IT components, or applications are authorised to perform certain actions.
The Cloud Service Provider validates the functionality of the authorisation mechanisms before new functions are made available to cloud users and in the event of changes to the authorisation mechanisms of existing functions (cf. DEV06). The severity of identified vulnerabilities is assessed according to defined criteria based on industry standard metrics (e.g. Common Vulnerability Scoring System) and measures for timely resolution or mitigation are initiated. Vulnerabilities that have not been fixed are listed in the online register of known vulnerabilities (cf. PSS02).
Additonal CriteriaAccess controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).
Supplementary Information - About the Criteria-
Software Defined Networking If the Cloud Service offers functions for software-defined networking (SDN), the confidentiality of the data of the cloud user is ensured by suitable SDN procedures.
The Cloud Service Provider validates the functionality of the SDN functions before providing new SDN features to cloud users or modifying existing SDN features. Identified defects are assessed and corrected in a risk-oriented manner.
Additonal Criteria-
Supplementary Information - About the CriteriaThis criterion is typically not applicable to the SaaS service model.
Suitable SDN methods for increasing confidentiality are, for example, L2 overlay networking (tagging) or tunnelling/encapsulation.
Images for Virtual Machines and Containers If cloud customers operate virtual machines or containers with the cloud service, the Cloud Service Provider must ensure the following aspects:
• The cloud customer can restrict the selection of images of virtual machines or containers according to his specifications, so that users of this cloud customer can only launch the images or containers released according to these restrictions.
• If the Cloud Service Provider provides images of virtual machines or containers to the Cloud Customer, the Cloud Service Provider appropriately inform the Cloud Customer of the changes made to the previous version.
• In addition, these images provided by the Cloud Service Provider are hardened according to generally accepted industry standards.
Additonal CriteriaAt startup and runtime of virtual machine or container images, an integrity check is performed that detects image manipulations and reports them to the cloud customer.
Supplementary Information - About the CriteriaThis criterion is typically not applicable to the SaaS service model.
Generally accepted industry standards are, for example, the Security Configuration Benchmark of the Centre for Internet Security (CIS) or the corresponding modules in the BSI ITGrundschutzKompendium.
Locations of Data Processing and Storage The cloud customer is able to specify the locations (location/country) of the data processing and storage including data backups according to the contractually available options.
This must be ensured by the cloud architecture.
Additonal Criteria-
Supplementary Information - About the CriteriaThis criterion supplements the General Condition BC-01.
The cloud architecture must exist in such a way that it enables the technical design of the IT infrastructure to provide the cloud service in accordance with the data location specifications agreed with the customer.

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Rialacháin ghaolmhara

Rialacháin