Cloud Security · Preparation Kit

Chuẩn bị Cloud Security Controls

Bộ tài liệu chuẩn bị cloud security controls, từ IAM best practices, encryption, network security, đến logging & monitoring. Áp dụng cho AWS, GCP, Azure. Yêu cầu trong ISO 27001 (A.5.23, A.8.9-8.11), SOC 2 (CC6), PCI-DSS (nếu xử lý card data trên cloud).

Nhận hỗ trợ từ pTrackly →

1. Identity & Access Management (IAM)

□ Principle of least privilege: user chỉ có quyền tối thiểu cần thiết
□ MFA bắt buộc cho console access và privileged accounts
□ No root account usage: disable root keys, chỉ dùng cho emergency
□ IAM roles thay vì hardcoded credentials trong code
□ Regular access review: quarterly review ai có quyền gì

2. Data Encryption

□ Encryption at rest: enable cho tất cả storage (S3, EBS, RDS, GCS, Cloud SQL)
□ Encryption in transit: TLS 1.2+ cho mọi communication
□ Key management: sử dụng KMS (AWS KMS, GCP Cloud KMS, Azure Key Vault)
□ Key rotation: enable automatic key rotation (annually hoặc theo policy)

3. Network Security

□ VPC/VNet segmentation: tách production / staging / development
□ Security Groups / Firewall rules: restrict inbound traffic (whitelist approach)
□ No public access: RDS, Redis, Elasticsearch không expose public internet
□ Bastion host / VPN cho admin access thay vì public SSH
□ WAF: bật AWS WAF / Cloud Armor / Azure WAF cho web applications

4. Logging & Monitoring

□ CloudTrail / Cloud Audit Logs: enable cho tất cả regions, log mọi API calls
□ VPC Flow Logs: track network traffic patterns, detect anomalies
□ Centralized logging: ship logs sang SIEM hoặc log aggregation tool
□ Alerting: alert khi có suspicious activity (root login, security group changes, IAM changes)
□ Log retention: ít nhất 90 ngày (PCI-DSS yêu cầu 90 days, SOC 2/ISO 27001 recommend 1 year)

5. Backup & Disaster Recovery

□ Automated backups: enable cho databases, critical data
□ Backup frequency: daily minimum, hourly nếu RTO/RPO yêu cầu
□ Cross-region backup: store backups ở region khác để tránh regional outage
□ Backup testing: test restore quarterly để verify backups hoạt động
□ Disaster Recovery Plan: document RTO/RPO, failover procedure

6. Compliance & Posture Management

□ Cloud Security Posture Management (CSPM): AWS Security Hub, GCP Security Command Center, Azure Defender
□ CIS Benchmarks: follow CIS benchmarks cho cloud provider
□ Config drift detection: alert khi có changes ngoài IaC pipeline
□ Regular security assessments: quarterly cloud security review