In-Cluster Audit Evidence Collection for Secure Cloud Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud service auditing methods rely on manual evidence collection, which is repetitive, error-prone, and requires manual access to productive clusters, posing security and stability risks, while automated external solutions are not thoroughly tested.
Innovation Solution
Deploy a trusted component within the cloud service to continuously collect audit evidence, using Kubernetes for orchestration, and store filtered data in an encrypted object store accessible only to the provider, ensuring secure and reliable compliance data transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual evidence collection is used, then flexibility in accessing cloud resources is maintained, but the process becomes repetitive, error-prone, and poses security risks
Solution Approach 1:
The system enables self-service evidence collection by deploying an automated evidence collector that continuously gathers compliance data without human intervention. The collector autonomously accesses cloud resources, filters evidence according to compliance rules, and stores it in encrypted object stores, eliminating the need for manual auditing operations.
Solution Approach 2:
The patent replaces manual mechanical evidence collection processes with an automated electronic system. The evidence collector uses programmatic access to retrieve data from cloud resources, automatically processes the data against compliance rules, and stores it securely, substituting human operators with an automated computational system.
2Extent of automation
If automated external evidence collection is implemented, then manual operations are eliminated, but the solutions are not thoroughly tested and may introduce new risks
Solution Approach 1:
The system performs preliminary action by deploying the evidence collector within the cloud environment before actual auditing occurs. The collector is pre-configured with compliance rules and continuously monitors cloud resources, ensuring that automated collection is thoroughly tested and validated within the actual production environment before use.
Solution Approach 2:
The patent introduces an intermediary evidence collector component that acts as a mediator between cloud resources and external auditors. This intermediary is deployed within the cloud environment, allowing it to access resources directly while maintaining security boundaries, and it communicates filtered evidence to external systems through controlled interfaces.
3Loss of information
If external access to cloud resources is granted for auditing, then evidence can be collected, but security and stability of productive clusters are compromised
Solution Approach 1:
The evidence collector serves as an intermediary component deployed within the cloud environment. It acts as a mediator that collects evidence on behalf of external auditors without requiring direct external access to cloud resources. The collector retrieves data from cloud resources internally and stores it in encrypted object stores, preventing direct external access while maintaining evidence accessibility.
Solution Approach 2:
The system creates a copy of the evidence by having the evidence collector retrieve and store compliance data in encrypted object stores within the cloud environment. This copying mechanism allows external auditors to access evidence through the cloud provider's interface without directly accessing the productive cloud resources, thereby maintaining security while enabling auditing.
4Reliability
If continuous evidence collection is implemented, then compliance verification quality improves, but system complexity increases
Solution Approach 1:
The evidence collector is designed as a universal component that can operate across multiple cloud environments and compliance frameworks. It performs multiple functions including data collection, filtering, encryption, and storage, reducing the need for separate specialized components and simplifying the overall system architecture while maintaining high verification quality.
Data Source
AI summary
A trusted component can be deployed to a computing cluster that collects audit evidence inside the cluster continuously. Performing the evidence collection within the cloud service avoids extending access to cloud resources, since the cloud service already has access to the cloud resources being audited. Additionally, since the evidence collection component is deployed to production servers, existing processes for testing and verifying standards compliance will be applied to the evidence collection component, increasing the quality of the component as compared to less thoroughly vetted external solutions. The evidence collection component may run on a regular schedule and collect evidence regularly (e.g., daily). The relevant information is retrieved from logs generated by the services being audited. The retrieved data is stored in an object store. Thus, only the information published by the evidence collection component is made accessible to external tools, enhancing the security of the services.