Implementing CCM: Interoperability & Portability Controls

The Cloud Controls Matrix (CCM) is a framework of controls that are essential for cloud computing security. The CCM is created and updated by CSA and aligned to CSA best practices.

You can use CCM to systematically assess and guide the security of any cloud implementation. CCM also provides guidance on which actors within the cloud supply chain should implement which security controls. Both cloud service customers (CSCs) and cloud service providers (CSPs) use CCM in many ways.

CSCs use CCM to:

• Assess the cloud security posture of current or potential cloud vendors. If a cloud vendor isn’t transparent about their security controls, the risk of doing business with them can be quite high.
• Compare vendors’ level of compliance with relevant standards like ISO 27001.
• Clarify the security roles and responsibilities between themselves and the CSP.

CSPs use CCM to:

• Assess, establish, and maintain a robust and internationally accepted cloud security program. CCM helps solidify CSPs' positions as trusted and transparent providers of cloud services.
• Compare their strengths and weaknesses against those of other organizations.
• Document controls for multiple standards in one place. CSA has mapped the controls in CCM against several industry-accepted security standards, regulations, and control frameworks.

CCM contains 197 control objectives structured into 17 domains that cover all key aspects of cloud technology:

 

CCM Domains

 

Today we’re looking at implementing the eleventh domain of CCM: Interoperability & Portability (IPY). The IPY domain helps ensure secure and seamless data exchange across multiple platforms and CSPs. These controls help CSCs avoid vendor lock-in and foster an environment where security doesn't limit portability. 

The IPY domain consists of only 4 control specifications:

1. Interoperability and Portability Policy and Procedures
2. Application Interface Availability
3. Secure Interoperability and Portability Management
4. Data Portability Contractual Obligations

According to a study by Bain and Company, 2/3 of CIOs would like to use public cloud services from multiple CSPs. However, 71% of the companies standardize on one CSP. The remaining 29% use multiple vendors, but they still spend an average of 95% of their cloud budget on one CSP. This data shows how much CSCs tend to rely on a single party. 

Implementing IPY controls helps make sure that if a company wants to move from one CSP to another, they easily can.

 

---

Understanding the Control Specifications

Interoperability and Portability Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for interoperability and portability including requirements for:

• Communications between application interfaces
• Information processing interoperability
• Application development portability
• Information/Data exchange, usage, portability, integrity, and persistence

Review and update the policies and procedures at least annually.

The first control is around IPY policies and procedures. Each CSP and CSC should have established, documented, approved, and well-communicated policies and procedures. They should have requirements on:

• The communication between application interfaces
• How to process information
• How the information can have interoperability
• Information and data exchange

These policies should be well-documented so that a team can follow them step-by-step when moving from one CSP to another. Stakeholders should review and update all policies and procedures at least annually.

The top risks that this control is trying to mitigate are noncompliance and ineffective communication. Policies may become outdated, leading to non-adherence to the current standards and regulations. Poor communication can result in stakeholders not understanding or following policies and procedures properly. Without well-documented policies and procedures, it becomes difficult to ensure that employees perform all the steps correctly.

A few control implementation best practices that address these risks include:

• Regularly reviewing and updating governance documentation
• Ensuring communication channels are effective
• Involving relevant stakeholders in the policies and procedures lifecycle

 

Application Interface Availability

Provide application interface(s) to CSCs so that they programmatically retrieve their data to enable interoperability and portability.

The second IPY control is about application interface availability. CSCs should be aware of what kind of application interfaces their CSPs provide. Then, CSCs can programmatically retrieve their data. This ultimately enables interoperability and portability. 

A few of the risks that this control is attempting to address include:

• Inadequate API security
• Lack of API standardization
• Poor documentation

Improper API security can lead to unauthorized access and data breaches. Lack of standardization can hinder interoperability. Inefficient or outdated API documentation can lead to misuse. 

Best practices to mitigate these risks include:

• Using secure and standardized APIs
• Providing accurate and updated API documentation
• Regularly testing APIs for security and functionality

 

Secure Interoperability and Portability Management

Implement cryptographically secure and standardized network protocols for the management, import and export of data.

The third control is about securing IPY management. What kind of cryptographically secure network protocols can you implement so that there's a secure exchange of data?

A few of the risks associated with not implementing this control are:

• Data breaches during data transfers
• Weak cryptographic protocols
• Inconsistent encryption practices

Some of the control implementation best practices for these risks include:

• Implementing strong encryption protocols
• Regularly updating your cryptographic standards
• Ensuring secure key management and certification renewal
• Conducting regular security audits of your cryptographic program

 

Data Portability Contractual Obligations

Agreements must include provisions specifying CSCs access to data upon contract termination and will include:

• Data format
• Length of time the data will be stored
• Scope of the data retained and made available to the CSCs
• Data deletion policy

The last control focuses on data portability contractual obligations between CSCs and CSPs. At a minimum, any contract should include the format the data will be in during the event of a contract termination. What is the length of time the CSP will store the data and make it available to the CSC? What is the CSP’s data deletion policy? 

The key risk associated with not implementing this control is data loss and corruption during transfer. 

Some of the control implementation best practices that can help mitigate this risk are:

• Defining clear data formats and retention periods
• Ensuring comprehensive data deletion policies
• Providing tools and support for data
• Exporting, transferring, and conducting regular reviews of contractual obligations
• Ensuring compliance with data portability and diligence standards

 

Shared Responsibilities

In the Shared Security Responsibility Model (SSRM), both CSPs and CSCs independently share responsibility for ensuring interoperability and portability in the cloud ecosystem.

CSPs are typically responsible for:

• Implementing a standardized communication protocol
• Ensuring those communication channels are secure
• Maintaining cross platform compatibility
• Standardizing the data formats, data processing, and data exchange protocols

CSCs are typically responsible for:

• Understanding what kind of tools and protocols are provided by the CSP for making sure that they have secure data backups
• Transferring and restoring programs and processes, including using interoperable data encryption
• Understanding the management, monitoring, and reporting of the interfaces provided by the CSP and the integration of those interfaces among multiple ecosystems 

The CSP and CSC are jointly responsible for documenting data portability contractual obligations, such as defining data ownership and migration procedures.

 

---

Make sure to check out the CCM and CCM Implementation Guidelines documents. All CSA documentation is free to download and use. Learn how to implement the other CCM domains by reading the rest of the blogs in this series. Be on the lookout for the next installation: Infrastructure & Virtualization Security.