WGU D485 DGN2 Task 1 Cloud Security Implementation Plan
Cloud Security Implementation Plan
A. Executive Summary
SWBTL LLC’s Microsoft Azure cloud environment displays many security concerns and does
not align with the company’s business requirements. The following outlines the gaps between
what is evident in the company’s security environment and the company’s business
requirements:
1. Compliance with applicable regulations and standards: SWBTL LLC currently has
contracts with the U.S. government in addition to processing card transactions on a daily
basis. Therefore, the company must comply with the Federal Information Security
Modernization Act (FISMA) and the Payment Card Industry Data Security Standard (PCI
DSS). Currently, SWBTL LLC does not comply with these regulations in their existing
cloud environment.
2. Azure Resource Groups and Azure Role-Based Access Control (RBAC): SWBTL LLC
has a business requirement that departmental resources should only be accessed by the
respective department’s users. This requirement aligns with the principle of least
privilege. However, the cloud environment does not adhere to this concept in its current
state.
3. Azure Key Vaults and Encryption of data-at-rest and data-in-transit: There are no
services spun up to encrypt data at rest or data in transit. Azure Key Vaults can be used
, to secure encryption keys when implementing the Azure Disk Encryption and Azure SQL
Database TDE services for data at rest. Data in transit: Azure Key Vaults enforces
transport-level encryption to protect data between Azure Key Vault and clients.
4. Backups: SWBTL LLC has business requirements pertaining to backups. These
requirements include the frequency and retention of those backups as well as the
recovery objectives of those backups. There is no policy or other configurations in place
that adhere to these business requirements.
5. Vulnerability Scanning: The scope of vulnerability scans are outdated and it’s unknown if
the scans include the cloud environment.
Overall, SWBTL LLC’s cloud environment is lacking the necessary security controls to fulfill its
business requirements and comply with regulations and standards. The company needs to take
the appropriate corrective actions in securing the cloud environment.
B. Proposed Course of Action
The proposed course of action for SWBTL LLC consists of implementing Microsoft’s Azure
Government Infrastructure as a Service (IaaS) solution. This solution provides the company with
a FedRAMP/FedRAMP+ authorized product that is also DoD Impact Level (IL) 5 authorized. In
addition, this service model meets the company’s requirements of allowing deployment and
control of multiple operating systems, virtual machines, and custom applications that can be
supported by compute, storage, and network resources on demand.
Applicable regulatory compliance directives include the following:
- Federal Information Security Modernization Act (FISMA): As a U.S. government
contractor, SWBTL LLC needs to comply with information security standards and
, guidelines required by FISMA, including those standards developed by the National
Institute of Standards and Technology (NIST) (NIST, 2016). The Federal Risk and
Authorization Management Program (FedRAMP) leverages NIST standards to provide
standardized security requirements for cloud services (FedRAMP, n.d.). The Microsoft
Azure Government cloud solution maps their controls to NIST SP 800-53 Rev. 5 controls
to maintain compliance and authorization by FedRAMP (Microsoft, 2024). In addition to
the FedRAMP security controls, the Department of Defense’s (DoD) Defense
Information Systems Agency (DISA) develops and maintains the DoD Cloud Computing
Security Requirements Guide (SRG). Compliance with these SRG and DoD FedRAMP+
controls award cloud solutions a DoD provisional authorization status. In the case of the
Microsoft Azure Government solution, it is designated as DoD IL 5 (Microsoft, 2023).
- Payment Card Industry and Data Security Standard (PCI DSS): PCI DSS is applicable to
any entity that stores, processes, and/or transmits cardholder data. As noted in the
Company Overview and Requirements document, SWBTL LLC processes card
transactions on a daily basis. With that said, PCI DSS applies to SWBTL LLC. The
company must implement security best practices that cover technical and operational
system components pertaining to the processed transactions (PCI Security Standards
Council, 2018).
Security Benefits of Microsoft Azure Government IaaS:
There is a significant amount of security benefits included with the Microsoft Azure Government
IaaS solution. The following outlines those benefits that are required by SWBTL LLC:
- Azure Resource Manager: This solution enables the creation of resource groups and the
ability to manage resources within said resource groups. Azure Resource Manager also
provides a tagging feature to identify resources belonging to resource groups.
, - Azure RBAC: This service factors in access management to resources. The
implementation of Azure RBAC restricts access to resources based on need to know
(NTK) and can help ensure the principle of least principle is taken into account.
- Encryption in Transit: With Azure Storage, you can encrypt data in transit using
transport-level encryption, wire encryption, and/or client-side encryption.
- Encryption at Rest: With Azure Storage you can also encrypt data at rest using storage
service encryption, client-side encryption, Azure SQL Database TDE, and/or Azure Disk
Encryption.
- Azure Backup: This solution provides backup services where authorized users can
backup and restore virtual machines, files, folders, SQL databases, etc. This service is
essential to ensure any lost data can be restored securely after any accidental
destruction (Microsoft, 2022).
Security Challenges of Microsoft Azure Government IaaS:
Although there are numerous security benefits pertaining to the Microsoft Azure Government
IaaS solution, one major security challenge includes the misconfiguration of security controls in
the cloud environment. There is a shared responsibility between the cloud service provider
(CSP) and the customer when it comes to the implementation of security controls (Sisodia &
Khan, 2022). This raises the importance for the customer to properly implement security
controls to industry best practices and ensure those controls are tested for quality assurance. If
the security controls are not properly implemented, this could potentially lead to detrimental
effects regarding the confidentiality, integrity, and availability of the cloud environment.
C. Role-Based Access Control
Cloud Security Implementation Plan
A. Executive Summary
SWBTL LLC’s Microsoft Azure cloud environment displays many security concerns and does
not align with the company’s business requirements. The following outlines the gaps between
what is evident in the company’s security environment and the company’s business
requirements:
1. Compliance with applicable regulations and standards: SWBTL LLC currently has
contracts with the U.S. government in addition to processing card transactions on a daily
basis. Therefore, the company must comply with the Federal Information Security
Modernization Act (FISMA) and the Payment Card Industry Data Security Standard (PCI
DSS). Currently, SWBTL LLC does not comply with these regulations in their existing
cloud environment.
2. Azure Resource Groups and Azure Role-Based Access Control (RBAC): SWBTL LLC
has a business requirement that departmental resources should only be accessed by the
respective department’s users. This requirement aligns with the principle of least
privilege. However, the cloud environment does not adhere to this concept in its current
state.
3. Azure Key Vaults and Encryption of data-at-rest and data-in-transit: There are no
services spun up to encrypt data at rest or data in transit. Azure Key Vaults can be used
, to secure encryption keys when implementing the Azure Disk Encryption and Azure SQL
Database TDE services for data at rest. Data in transit: Azure Key Vaults enforces
transport-level encryption to protect data between Azure Key Vault and clients.
4. Backups: SWBTL LLC has business requirements pertaining to backups. These
requirements include the frequency and retention of those backups as well as the
recovery objectives of those backups. There is no policy or other configurations in place
that adhere to these business requirements.
5. Vulnerability Scanning: The scope of vulnerability scans are outdated and it’s unknown if
the scans include the cloud environment.
Overall, SWBTL LLC’s cloud environment is lacking the necessary security controls to fulfill its
business requirements and comply with regulations and standards. The company needs to take
the appropriate corrective actions in securing the cloud environment.
B. Proposed Course of Action
The proposed course of action for SWBTL LLC consists of implementing Microsoft’s Azure
Government Infrastructure as a Service (IaaS) solution. This solution provides the company with
a FedRAMP/FedRAMP+ authorized product that is also DoD Impact Level (IL) 5 authorized. In
addition, this service model meets the company’s requirements of allowing deployment and
control of multiple operating systems, virtual machines, and custom applications that can be
supported by compute, storage, and network resources on demand.
Applicable regulatory compliance directives include the following:
- Federal Information Security Modernization Act (FISMA): As a U.S. government
contractor, SWBTL LLC needs to comply with information security standards and
, guidelines required by FISMA, including those standards developed by the National
Institute of Standards and Technology (NIST) (NIST, 2016). The Federal Risk and
Authorization Management Program (FedRAMP) leverages NIST standards to provide
standardized security requirements for cloud services (FedRAMP, n.d.). The Microsoft
Azure Government cloud solution maps their controls to NIST SP 800-53 Rev. 5 controls
to maintain compliance and authorization by FedRAMP (Microsoft, 2024). In addition to
the FedRAMP security controls, the Department of Defense’s (DoD) Defense
Information Systems Agency (DISA) develops and maintains the DoD Cloud Computing
Security Requirements Guide (SRG). Compliance with these SRG and DoD FedRAMP+
controls award cloud solutions a DoD provisional authorization status. In the case of the
Microsoft Azure Government solution, it is designated as DoD IL 5 (Microsoft, 2023).
- Payment Card Industry and Data Security Standard (PCI DSS): PCI DSS is applicable to
any entity that stores, processes, and/or transmits cardholder data. As noted in the
Company Overview and Requirements document, SWBTL LLC processes card
transactions on a daily basis. With that said, PCI DSS applies to SWBTL LLC. The
company must implement security best practices that cover technical and operational
system components pertaining to the processed transactions (PCI Security Standards
Council, 2018).
Security Benefits of Microsoft Azure Government IaaS:
There is a significant amount of security benefits included with the Microsoft Azure Government
IaaS solution. The following outlines those benefits that are required by SWBTL LLC:
- Azure Resource Manager: This solution enables the creation of resource groups and the
ability to manage resources within said resource groups. Azure Resource Manager also
provides a tagging feature to identify resources belonging to resource groups.
, - Azure RBAC: This service factors in access management to resources. The
implementation of Azure RBAC restricts access to resources based on need to know
(NTK) and can help ensure the principle of least principle is taken into account.
- Encryption in Transit: With Azure Storage, you can encrypt data in transit using
transport-level encryption, wire encryption, and/or client-side encryption.
- Encryption at Rest: With Azure Storage you can also encrypt data at rest using storage
service encryption, client-side encryption, Azure SQL Database TDE, and/or Azure Disk
Encryption.
- Azure Backup: This solution provides backup services where authorized users can
backup and restore virtual machines, files, folders, SQL databases, etc. This service is
essential to ensure any lost data can be restored securely after any accidental
destruction (Microsoft, 2022).
Security Challenges of Microsoft Azure Government IaaS:
Although there are numerous security benefits pertaining to the Microsoft Azure Government
IaaS solution, one major security challenge includes the misconfiguration of security controls in
the cloud environment. There is a shared responsibility between the cloud service provider
(CSP) and the customer when it comes to the implementation of security controls (Sisodia &
Khan, 2022). This raises the importance for the customer to properly implement security
controls to industry best practices and ensure those controls are tested for quality assurance. If
the security controls are not properly implemented, this could potentially lead to detrimental
effects regarding the confidentiality, integrity, and availability of the cloud environment.
C. Role-Based Access Control
