Government of Canada Cloud Security Risk Management Approach and Procedures

3.2.1 Concept of High Watermark

A business activity may be composed of business processes and information assets with differing levels of assessed injury. For example, one type of related information may have an assessed injury level of low and another type of related information an assessed injury level of medium for the same security objective. Similarly, a GC service may support several business activities, each composed of business processes and information assets having different injury levels. These individual values are important and should be documented. However, for the purpose of selecting the most appropriate cloud security control profile, the security category of the GC service should reflect the highest level of injury of all related business processes and information assets.

Determining the security category of a GC service therefore requires the business owner to consider the security categories of all related business processes and information assets. For a given GC service, the potential injury level values assigned to the respective security objectives (confidentiality, integrity, availability) must be the highest values (i.e., high water mark) from among those security categories that have been determined for each of the business processes and information assets.

For example, a department may decide to implement an information system service to support two business activities, one having an overall security category of (Protected A, Medium Integrity, Medium Availability), and another having an overall security category of (Protected B, Medium Integrity, Low Availability). In this case, as illustrated in Table ‎3-1, the information system service would be attributed the security category of (Protected B, Medium Integrity, Medium Availability).

3.6.1 Security Assessment

When implementing a cloud-based GC service, required security controls need to be assessed to establish the extent to which they are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the business security requirements. Understanding the overall effectiveness of security controls is essential in determining and managing the residual risks under which the cloud-based GC service will be operating.

As illustrated in Figure ‎3-3, the scope of GC cloud profiles includes not just the CSP cloud service infrastructure but all CSP and GC infrastructure components that are used to both provide and consume the cloud-based GC service. As a result, both the CSP and the GC need to conduct security assessments for the security controls that fall within their respective scope of responsibility.

The results of these security assessments are key parts of the documentation package that authorizing officials need to consider to determine whether they should authorize operations of the cloud-based GC service and accept residual risks.

3.6.2 Mapping Security Controls to Existing Certification Programs

Because a GC consumer organization does not have direct control over all the security controls in a cloud-based GC service, or sufficient visibility into the design, development, installation, and assessment of those security controls, alternative security assessment approaches need to be applied. In the GC cloud security risk management approach, this is accomplished by the GC security assessor by taking into account other security assessments that have been conducted, or are in the process of being conducted. Results from these security assessments, if deemed applicable and reliable, are incorporated into the GC security assessments.

In the context of the GC cloud security risk management approach, these security assessments mainly consist of third-party certifications. A third-party certification requires an independent third party that is bound to be objective and apply professional standards to the evidence it reviews and produces. A self-assessment has less value because it is not reviewed by a third party.

GC security control profiles include mapping of existing industry certifications to guide the GC security assessor in associating acceptable evidence to the required security controls.

Figure 3-4 - Text version

The GC cloud security risk management approach includes the concept of certification evidence re-use. The GC security control profile for cloud includes mapping of acceptable evidence from industry certifications such as AICPA SOC 2 audit reports, CSA STAR Level 2 Certification, ISO 27001 Third-Party Certification.

The Canadian-specific security controls or departmental controls will require additional evidence and GC assessment of these additional security controls.

3.6.3 Assessment of Additional Security Controls

As illustrated in Figure ‎3-4, third-party certifications do not cover Canadian-specific security controls selected for GC cloud profiles. As part of the procurement process, additional security requirements and contract clauses may need to be included to ensure that CSPs provide required evidence that can be validated by the GC security assessor. It is expected that standard GC security risk management processes and procedures will be followed when performing these additional security assessment activities.

GC consumer organizations are responsible for the security assessment of the security controls that are allocated to them in the GC cloud profiles. As shown in Figure ‎3-4, this responsibility extends to any additional security controls being implemented to satisfy departmental requirements. GC consumer organizations are expected to subject these security controls to security assessment activities following standard GC or departmental security risk management processes and procedures.

3.6.4 Stacking of Authorizations

In the cloud space, many cloud systems rely on other cloud providers to provide a comprehensive set of services for the end customer. An example of this is a software provider utilizing an infrastructure provider to deliver a SaaS offering. In this case, the software provider will inherit security controls from the infrastructure provider.

The GC cloud security risk management approach makes allowance for the stacking of authorizations like building blocks. In this model, the authorization for each cloud system must only describe the implementation of that specific system. For example, a SaaS service provider would not specify in its own documentation implementation details or evidence related to the infrastructure service that it leverages. This reduces the number of certifications or security assessments, eliminates redundancy across authorization packages, and keeps authorizations delineated by information system boundaries.

Much in the same way the software provider in the example above relies on the infrastructure provider to deliver services, the software provider also relies on the security implementation and authorization of the infrastructure provider for the software provider’s implementations and authorization. Accordingly, if a CSP has inherited controls, the authorization of that CSP will be dependent on the authorization of the CSP whose controls they inherit and systems they use to deliver the end service.

Figure 3-5 - Text version

The authorization stacking use case includes multiple layers:

• For the IaaS/PaaS layer, a number of controls will be a assessed under ISO27001, AICPA SOC2, or an alternate certification or audit as part of the provisional authorization of the service provider.
• For the SaaS layer, a number of controls will be a assessed under ISO27001, AICPA SOC2, or an alternate certification or audit as part of the provisional authorization of the service provider.
• The additional departmental controls will be assessed by the department.

The result is a departmental authorization which encompasses the provisional authorizations plus the assessment of the departmental controls.

3.6.5 Authorization Reuse

A cloud service that has been authorized under an acceptable information system security certification program can be reused from department to department with similar requirements. The service provider blocks in Figure ‎3-5 represents those services that each GC consumer organization uses and leverages from an authorization perspective. In this view, if another GC consumer organization subscribes to the same cloud services, then the next GC consumer organization would need to confirm that the chosen security profile meets their business needs, and if acceptable, would be required to complete the security assessment and authorization of the departmental components of the information system service.

When granting an authorization at the departmental level, a GC consumer organization must authorize the use of the entire cloud-based GC service, which consists of both the cloud services and the departmental information system service to be hosted on these cloud services. However, if the cloud services have already been authorized for use as part of a cloud-based GC service under the same GC cloud profile, then the GC consumer organization need only worry about the authorization of the GC service component.

4.2.1 Identify Business Processes and Related Information Assets

The first step of security categorization is for the GC consumer organization to identify all business processes and related information assets that relate to or will be supported by the GC service. There are several sources from which to identify and describe business processes and related information assets, including:

• Business cases, business impact analysis (BIA);
• Concepts of operations (CONOPS);
• Business functional specifications;
• Department’s program alignment architecture (PAA);
• Enterprise architecture documentation which typically describes an organization’s business processes and related information assets in some detail;
• Discussions or interviews with business analysts and other individuals within related business communities; and
• Treasury Board of Canada Secretariat (TBS)’s Government of Canada Strategic Reference Model (GSRM) Service Reference Patterns ^{Footnote 10} may also be useful in identifying and describing business processes.

4.2.2 Assess Injuries from Threat Compromise

Once the business processes and related information assets have been identified, the GC consumer organization will conduct an injury assessment. GC consumer organizations should assess injury for their business processes and related information assets through a departmental process. This process should use multidisciplinary teams that include representatives from business, legal, access to information, security, and privacy areas.

4.2.3 Determine Security Category of GC Service

By applying the high watermark concept^{Footnote 17}, the GC consumer organization extrapolates from the injury assessment the security category of the GC service to be hosted on a cloud service. The result is the security category of the GC service.

4.2.4 Document and Accept Security Categorization Results

The GC consumer organization should document and formally accept the results of the security categorization activity. The results can be consolidated in a security categorization report as follows:

• A short description of the related business processes and information assets;
• A description of the expected injuries from threat compromise;
• The levels of expected injury as they relate to confidentiality, integrity, and availability;
• The rationale for attributing the levels of injury;
• The security category of each business activity;
• The security category of the GC service; and
• An explicit statement of acceptance from stakeholders of the security category.

4.3 Select GC Cloud Security Control Profile

Who: Project authority in consultation with IT security practitioners.

What: Select the correct GC cloud security control profile.

GC consumer organizations are expected to select one of the GC cloud profiles, which have been developed specifically for that purpose, and tailor the security controls within their scope of responsibility according to their needs.

When selecting a GC cloud profile, project authorities, with the support of security practitioners, should perform the following tasks:

• Validate the applicability of the business context;
• Validate the applicability of the technical context; and
• Validate the applicability of the threat context.

When: Before the procurement of a cloud service or as part of the selection of an already authorized cloud service offering.

How: After completing the security categorization, the GC consumer organization selects the security control profile that matches the security category of the GC service^{Footnote 18}. The GC cloud profiles specify minimum sets of security controls that CSPs and GC consumer organizations need to implement to meet GC requirements defined for specific security categories.

4.4 Select (or Confirm) the Deployment and Service Models

Who: Project authority in consultation with the business owner, GC cloud broker, IT practitioners, and IT security practitioners.

What: The information aggregated during the security categorization step aids the GC consumer organization in selecting the cloud deployment model and service model that best match its internal expertise and required assurance levels.

When: Before the procurement of a cloud service or as part of the selection of an already authorized cloud service offering.

How: Based on GC and departmental information system strategies and the security category of the GC service to be hosted on a cloud service, the GC consumer organization selects or confirms which of the cloud deployment model and service model are best suited. The cloud services availability in the marketplace, the capabilities of these cloud services, the security category of the GC service, as well as other aspects of the information system workloads must all be taken into account when deciding if and when to move to or adopt cloud services.

4.5 Assess Security Control Implementation in the Cloud Service Offering

Who: The GC security assessor in consultation with the CSP and a third-party security assessor. Also the departmental security assessor if the GC consumer organization expects the CSP to satisfy departmental security controls. .

What: Assess the CSP’s implementation of the security controls in the selected GC cloud profile to ensure the appropriate mitigation of threats that could compromise the confidentiality, integrity, or availability of the GC information and services to be hosted on the cloud service. .

When: During the procurement process, an initial high-level security assessment is performed on receipt of vendor response to evaluate bid compliance. Upon vendor selection, a security assessment of the complete collection of assessment evidence and assessment results is performed..

How: The GC security assessor (and departmental security assessor, if required) assesses the implementation of security controls, preferably by examining the security assessment evidence that the CSP has produced as part of another information system service certification program. In the case where security assessment evidence cannot be obtained through independent third-party certification results, the GC security assessor will have to obtain assurance of the proper security control implementation. This may happen in the case when Canadian-specific security controls (and departmental security controls) are not covered by CSP-provided evidence.

To assess the security controls in this situation, security assessors use available guidelines to develop security assessment procedures. Security assessment procedures can be gleaned from different information sources such as NIST’s Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations ^{Footnote 11}. The security assessment procedures are then executed and the results documented as part of the security assessment results that will be provided to the authorizer to support authorization.

4.6 Implement Security Controls in the GC Service

Who: IT practitioners and IT security practitioners in consultation with the departmental security assessor, the GC cloud broker, and the CSP.

What: Implement in the GC service the security controls that are required at the layer or layers being implemented.

When: At the scheduled time during the project.

How: Security controls need to be implemented by the project team following the GC consumer organization’s SDLC process. SDLC activities may vary depending on the cloud service model. In most cases, the project team will need to determine the exact set of security controls to implement, specify security configuration, and develop operational security procedures for access control, configuration management, incident response, and auditing. If it is implementing a platform-application over IaaS or an application over PaaS, the project team will also need to incorporate security controls in the GC service design specifications, and develop and test the GC service.

In most cases, the IT project will have to work with the GC cloud broker and the CSP to integrate certain aspects of technical and non-technical security controls to ensure operational visibility and service monitoring.

4.7 Assess Security Control Implementation in the GC Service

Who: Departmental security assessor in consultation with IT practitioners and IT security practitioners.

What: Assess the implementation of the security controls in the GC service (i.e. the GC component of the cloud-based GC service) and any other GC infrastructure components that are used to access and consume the GC service.

When: At the scheduled time during the project.

How: The GC consumer organization conducts security assessment activities as part of the implementation of the cloud-based GC service. Ideally, the security assessment activities are conducted as an integral part of the SDLC process.

4.8 Authorize Operation of Cloud-based GC Service

Who: Business owner in consultation with the project authority, IT practitioners, IT security practitioners and the departmental security assessor.

What: Authorize the use of an enterprise, or departmental cloud-based GC service.

When: While different authorization activities may occur during the project life cycle process (e.g. approve project plan, approve system security controls), this activity represents the risk owner’s decision to authorize a cloud-based GC service for use. It takes place once security assessment activities are completed, and before the cloud-based GC service is declared operational and is available for use.

How: Through the sub-activities described below. Authorization is accomplished as part of the governance and risk management activities to declare information systems operational and hand over from project teams to operational teams.

4.9 Operations and System Maintenance

Who: IT practitioners, IT security practitioners, and the GC cloud broker in consultation with the departmental security assessor and the GC security assessor.

What: Execute the security controls for their respective components as per their operational responsibilities and agreements.

When: During the operational phase of the cloud-based GC service.

How: The GC consumer organization and the CSP execute security controls through operational security procedures in accordance with established schedules. Operational security procedures cover a wide range of activities, including:

• User accounts, groups, and privileges operations;
• User identifiers and authenticators operations;
• Vulnerability assessments and penetration testing;
• Backup and restoration operations;
• Physical access control operations;
• Storage media operations;
• Configuration and maintenance operations;
• System and security events monitoring and reporting;
• Responding to incidents and contingencies; and
• Auditing operations.

4.10 Continuously Monitor and Maintain Authorization

4.10.1 Operational Visibility and CSP Certification Maintenance

An important aspect of a CSP’s continuous monitoring process is to provide evidence that demonstrates the effectiveness of its security program. CSPs are required to provide evidentiary information to operational authorities at a minimum of annually or the declared certification refresh rate associated with commercial third-party certifications that have been used as evidence of a valid and functioning CSP security program. The submission of this updated certification evidence allows GC consumer organizations to maintain confidence that the CSP are committed to and continuing to protect their information systems in line with the security control profiles under which they were certified. If required, the GC consumer organization maintains the right to evaluate the risk posture of the CSP’s service offering by performing their own security assessment activities targeting either all the security controls in a profile, or a subset thereof.

Figure 4-1 - Text version

The continuous monitoring of cloud-based GC service includes various activities between the Cloud Service Provider, and Cloud Broker and/or Business Owner to support risk-based decisions and authorization maintenance including:

• Operational Visibility - evidence and updated annual assessments
• Change Control – significant change forms and updated plan of action and milestones
• Incident Response – engagement with SSC SOC and incident reporting

4.10.3 Incident Response

The GC consumer organization and the CSP need to monitor and assess on an ongoing basis the security posture of their respective components of a cloud-based GC service in collaboration with GC Computer Incident Response Team (CIRT) and departmental Information Protection Centres (IPCs). As outlined in the GC Cyber Security Event Management Plan (CS EMP) ^{Footnote 12}, cyber security events related to GC information systems, whether located within the GC or within a CSP’s environment, can have a significant impact on the delivery of government programs and services to Canadians and, consequently, confidence in government.

Figure 4-2 - Text version

Incident response for cloud-based GC Service requires ongoing monitoring and assessments as part the operational visibility and change control activities.

This includes incident response activities that are aligned with the GC Cyber Security Event Management Plan.

The GC must continue to have the ability to respond to cyber security events in a consistent, coordinated, and timely manner across the GC. Ongoing monitoring and security assessment are essential processes that help GC consumer organizations detect and respond in a timely manner to attacks, security breaches, and other potentially compromising events and changes within and around the information system’s environment. Ongoing monitoring and security assessment inform the information system security function, as well as incident management, change management, and other operational processes to initiate corrective changes.

To effectively monitor the security posture of their cloud services, CSPs, in support of GC authorization authorities, and in collaboration with security practitioners in the information system security function or an IPC, should perform the following activities:

• Monitor and analyze changes in threats, vulnerabilities, impacts, and risks, and identify the need for changes;
• Monitor the performance and functional effectiveness of security mechanisms and solutions;
• Analyze event records to determine the cause of security events;
• Identify, report, and respond to security incidents; and
• Adequately protect logs, reports, and other monitoring artifacts.

The establishment of security incident management requirements is executed through contract negotiations and may be already in place through CSP SLAs and associated performance targets. After contract award, the implementation of the incident response requirements is executed in line with the appropriate SLAs.