# A Framework for Security Transparency in Cloud Computing
## 6 Example
### Implementation of the Security Transparency Framework
#### 6.2.8 Monitoring
\begin{table}
\begin{tabular}{c c c} \hline \hline
**CSC Requirements** & **CSP Controls** & **CSP Eridenes** \\ \hline \multirow{6}{*}{Req1} & Data encryption and integrity checks & Assets are stored using Advanced Encryption Standard (AES), Customers are supported to use preferred encryption mechanisms to encrypt data before moving assets to _TransparentCloud_’s environment. Data integrity checks can be performed by CSCs to protect data using Hashed Message Authentication Codes (IMAGE), digital signatures, and Authentication Encryption (AES-GCM). \\ \cline{2-3}  & Secure access controls & Advanced data access control provided to ensure limited access to assets. A multi-factor authentication that uses a combination of name and password credentials for access is provided as an additional layer of security using a device that generates single-use authentication code. \\ \cline{2-3}  & Vulnerability scans & Regular vulnerability scans are performed on the host operating system, web applications and databases using a variety of tools. Vulnerability patches are regularly fed from applicable vendors, The environment is regularly assessed for new and existing vulnerabilities and attack vectors by external and internal penetration testsets. \\ \hline \multirow{6}{*}{Req2} & Access logs & Systems are configured to log access to data assets. The access log contains details about each access request type, the requested source, the request 3: fine-time and date of the request. \\ \cline{2-3}  & Notification & Event modifications stating instances are sent to customers. An email notification service is provided to notify customers when an application status changes or application servers are removed or added. \\ \cline{2-3}  & Req2 & An audit logs service features maintained that provide valuable insight into who has accessed which asset. The features enable customers to directly view logs in order to verify who has accessed what data and what was done with it. Contracts are put in place to support customers access to the audit logs for dealing with security incidents and investigations. \\ \hline \multirow{6}{*}{Req3} & \multirow{6}{*}{Scalability} & Load balances are used to distribute workloads between cloud servers with identical configuration and data, in addition, horizontal and vertical scalability are adopted to support scalability. Horizontal (out) and vertical (pull) scaling are used depending on the nature of customer needs as well as resource constraints. More resources are added to the same computing pool that host customer asset through vertical scaling, such as adding more virtual CPU, RAM or disk to handle increased application workload. Also, in some cases, horizontal scaling is used to add more machines or devices to the computing platform in order to accommodate increased customer demand. \\ \cline{2-3}  & \multirow{6}{*}{Dissster recovery plan} & Various techniques are used for disaster recovery. One of such involves the continuous replication of assets in order to maintain a second version of it. These replicas are transparently hosted up of-site in the form of suspicious on multiple devices across multiple facilities. Availability zones are created and dispersed across multiple geographical regions and, in case of failure, automated processes divert traffic away from the affected place to another availability zone. \\ \cline{2-3}  & Business continuity management & Data redundancy techniques such as image and file-based behaviors, and automated system failover are implemented at multiple levels. It also includes redundant disks that guard against local disk failure to fall at replication across geographically dispersed data centres. \\ \cline{2-3}  & Data backup & Customers are allowed to perform new backup using there own backup service provider, and they can also specify which physical region their data will be located in. \\ \hline \multirow{2}{*}{Req5} & FCI DSS & Certified compliance to the standard. \\ \cline{2-3}  & EU / UK Privacy Laws & Received broad validation from the European and UK data protection authorities. \\ \cline{2-3}  & ISO27001 & Certified compliance to the standard. \\ \hline \hline \end{tabular}
\end{table}