# An Analysis of Cloud Security Frameworks, Problems and Proposed Solutions
## 3 Cloud Security Frameworks
### NIST SP 800-144  
The National Institute of Standards and Technology (NIST) has created a framework to help businesses defend their cloud infrastructure. This framework offers a complete collection of concepts, rules, and best for cloud-based environment security. Organizations may improve the security of their cloud infrastructure and efficiently manage risks by adopting the NIST methodology [29, 30]. However, it is critical to recognize both the NIST framework's strengths and limits. However, the parent framework of NIST SP 800-144 consists of five core functions [31].  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Process** & **Tools and Technique** \\ \hline Define Objectives and Scope & Document management tools (e.g., Microsoft Word, Google Docs) \\ \hline Assess the Current State & Risk assessment tools (e.g., Qualys, Nessus) \\ \hline Define Governance Framework & GRC (Governance, Risk, and Compliance) platforms (e.g., RSA Archer, MetricStream) \\ \hline Identify Risk & Risk assessment tools and methodologies (e.g., FAIR, OCTAVE) \\ \hline Define Control Objectives & COBIT 5 framework documentation and guidance materials \\ \hline Design Security Controls & Cloud security management platforms (e.g., AWS Security Hub, Azure Security Center) \\ \hline Implement Security Controls & Cloud-native security services (e.g., AWS IAM, Azure AD) \\ \hline Monitor and Measure & Security information and event management (SIEM) tools (e.g., Splunk, IBM QRadar) \\ \hline Perform Audits and Reviews & Audit management tools (e.g., ACL, TeamMate) \\ \hline Continual Improvement & IT service management (ITSM) tools (e.g., ServiceNow, Jira Service Management) \\ \hline \hline \end{tabular}
\end{table}
Table 5: Tools for COBIT5.  
Identify: Understanding the organization's systems, assets, data, and capabilities is part of this role. It entails identifying and recording the resources that must be safeguarded, as well as the hazards connected with them. This role serves as the foundation for creating successful cybersecurity policies and procedures.  
Protect: The Protect function is responsible for putting protections in place to assure the delivery of key services and the security of data. Access control, data encryption, training and awareness programs, and adopting security measures to reduce identified risks are all part of it.  
Detect: The Detect function is responsible for designing and deploying tools to quickly identify cybersecurity occurrences. It contains methods for continuous monitoring, anomaly detection, and incident response to detect and respond to cybersecurity events in real-time.  
Respond: The Respond function is responsible for developing and implementing a response strategy to reduce the effects of cybersecurity events. It includes creating an incident response strategy, doing incident analysis, and taking the necessary steps to contain and recover from cybersecurity problems.  
Recover: The Recover function's goal is to restore services and capabilities that have been impacted by cybersecurity events while also preventing future occurrences. It comprises tasks such as system recovery, stakeholder communication, and using lessons gained to enhance future incident response.