Cloud Security Challenges (and Solutions) for Internal Audit

Cloud computing has become an essential component of most organizations’ IT infrastructure, with the global cloud computing market expanding at a 17.9% compound annual growth rate through 2027, more than doubling its current size. The cloud offers numerous benefits, including scalability, flexibility, and cost-effectiveness, making it an integral lever for modern firms.

However, the cloud also presents unique security challenges that organizations must address to protect their data and systems. These challenges present significant obstacles to internal audit teams tasked with providing assurance that their organization’s cloud environment is secure, compliant, and resilient to cyberattacks.

So what cloud security challenges do internal audit teams face daily, and what can they do about them? Explore five expert problems and solutions below:

Challenge 1: Lack of Visibility

As organizations move toward the cloud, the lack of visibility into cloud infrastructure becomes incredibly debilitating. It can be difficult for internal audit teams to monitor the security of cloud-based applications and services, as organizations often have limited control over them due to the shared responsibility model (see Challenge 3 below). This can lead to security gaps cybercriminals can exploit to gain unauthorized access to the organization’s sensitive data being stored or processed in the cloud.

Recommendation: Implement Cloud Security Monitoring

To address this challenge, internal audit teams can leverage cloud security monitoring tools to gain visibility into their organization’s cloud infrastructure. Native tools such as AWS CloudTrail and CloudWatch or Azure Monitor are readily available, optimal solutions. Alternatively, some organizations implement a Cloud Security Posture Management (CSPM) tool for automated cloud risk identification and remediation.

These tools provide real-time alerts for security events, including unauthorized access attempts, data breaches, and other security incidents. Internal audit teams can inspect data from these tools during an audit or develop continuous monitoring capabilities by connecting to the monitoring tools through an application programming interface (API) and aggregating the data into dashboards for more real-time monitoring. However, internal audit should first inspect the relevant configurations of these tools before placing reliance on the data.

Challenge 2: Compliance

Large organizations are subject to various regulatory requirements, and ensuring compliance with these regulations can be a daunting task when dealing with multiple cloud service providers. In fact, 90% of enterprise organizations have a multi-cloud environment and use between two or three private or public clouds. Internal audit teams need to validate that all cloud services used by the organization comply with regulatory requirements such as GDPR, HIPAA, or SOX.

Recommendation: Develop a Cloud Compliance Framework

Internal audit teams should develop a cloud compliance framework that outlines the regulatory requirements for the organization’s cloud environment. The framework should include the necessary controls to ensure compliance as well as the procedures to validate the effectiveness of these controls. The internal audit team can then use this framework to assess the compliance of all cloud service providers used by the organization and recommend remediation steps as necessary.

There are several resources readily available to help guide the development of a cloud compliance framework.  One example is the Cloud Controls Matrix (CCM) developed by the Cloud Security Alliance (CSA). The CCM is a framework of cloud-specific security controls mapped to leading standards, best practices, and regulations such as ISO/IEC 27001/27002/27017/27018, CCM V3.0.1, AICPA TSC (2017), CIS Controls V8, NIST 800-53r5, PCI DSSv3.2.1, and ISF SOGP 2022.

Note: CSPM tools and cloud-native services can also be utilized to monitor and enforce compliance patterns.

Challenge 3: Shared Responsibility

Cloud service providers follow a shared responsibility model in which they are responsible for the security of the cloud infrastructure, and each organization/customer is responsible for securing their data in the cloud. Validating the security of data in the cloud can be problematic for internal audit teams, as they need to obtain assurance that both parties are fulfilling their responsibilities. Additional challenges arise when responsibility for remediating control gaps is not clearly established.

Below is an example of Azure’s responsibility model.

(Source)

Recommendation: Understand the Shared Responsibility Model

Internal audit teams need to understand the shared responsibility model and their organization’s role in securing data in the cloud. The internal audit team can work with the cloud service provider to understand their security controls and assess effectiveness. This can often be limited to reviewing control attestation reports such as Service Organization Control (SOC) reports.

Additionally, the internal audit team can review the organization’s security controls to validate that they are aligned with the shared responsibility model. Both parties should have a clear understanding of responsibilities, and these should be documented and available for internal audit review. Clear and open communication should be encouraged between internal audit and the organization’s security team (e.g., DevSecOps) to work collaboratively on improving the control environment.

Challenge 4: Identity and Access Management

Managing user identities and access to cloud services is arduous work for many organizations. Without a defined Identity and Access Management (IAM) strategy, IAM is often implemented in a variety of disjointed ways without visibility across the overall IAM landscape. Many public data breaches involving cloud services have been due to poorly configured IAM controls (e.g., publicly facing S3 buckets).

Recommendation: Understand IAM Risk and Controls

A good understanding of the risks and controls associated with IAM across the organization’s cloud environment is a must-have for internal audit. Internal audit teams need to validate that their organization has appropriately configured IAM controls across all applicable domains so that only authorized users have access to cloud services and data and that there are no unauthorized access attempts.

Areas such as root account credentials, multi-factor authentication (MFA), key management services, federated access, and the principle of least privilege should all be thoroughly inspected by internal audit.

“Internal audit teams can work closely with IT and security teams to build a shared understanding of cloud security risks and controls. This can help auditors gain a deeper understanding of the cloud environment and provide more effective recommendations to improve security.”

Simon Burton, IT Risk Associate Director

Challenge 5: Lack of Technical Expertise

Unfortunately, internal audit teams often lack cloud security technical expertise. Internal auditors may not have the necessary skills or knowledge to audit cloud-based applications and services effectively, resulting in issues such as:

1. Inability to identify security risks,
2. Inability to assess the effectiveness of cloud security controls,
3. Inability to provide meaningful assurance, and
4. Inability to maintain regulatory compliance.

Additionally, many organizations’ internal security teams struggle to hire and retain staff to manage their cloud environments due to a shortage of qualified cloud security architects and engineers.

Recommendation: Collaborate and Invest in Training and Development

Internal audit teams can consider the following solutions:

1. Invest in training and development: Internal audit teams can invest in training and development programs to help build technical expertise in cloud security. This can help auditors understand the unique challenges of auditing cloud-based applications and services and provide more effective recommendations to improve security.
2. Leverage external experts: Internal audit teams can collaborate with external experts in cloud security to provide technical expertise and support. This can help augment internal audit teams’ capabilities and support a more effective and meaningful audit.
3. Increase security awareness: Internal audit teams can work closely with IT and security teams to build a shared understanding of cloud security risks and controls. This can help auditors gain a deeper understanding of the cloud environment and provide more effective recommendations to improve security. Investment in security awareness would also benefit the architects, developers, engineers, and product owners by reducing future compliance issues.

For expert internal audit support to solve these problems and more, contact CrossCountry Consulting.