Contents

1   Introduction

This document enumerates the various hardening steps that must be performed in order to make the Cloud Execution Environment (CEE) secure during its whole lifecycle.

This document provides two checklists, one to assess, and one to perform the hardening activities described in System Hardening Guideline. For more information, see Section 2.

1.1   Target Audience

This document is primarily intended to be used by staff responsible for CEE. This includes operational personnel performing installing, upgrading/updating, or maintaining activities. Furthermore, security administrators managing security and IT, and Telecom (security) operational managers responsible for Information Security Management System (ISMS) according to ISO 27011, Reference [1] and ISO 27002, Reference [2]. More specifically, in Section 6.1.1 in ISO 27011, Reference [1] and in Section 6.1.1 b) in ISO 27002, Reference [2].

1.2   Required Competence

The following sections describe the required competence for operational personnel and decision makers.

1.2.1   Operational Personnel

It is required for operational personnel, performing the installing, upgrading/updating, or maintaining activities to understand the security concepts before handling security. For that reason, the intended audience of the document must be skilled in security and have at least CISSP or equivalent certificates. Furthermore deep domain knowledge on cloud and security is required, especially on those components on which the hardening steps are to be performed. The security topics are, for example, cryptography, secure protocols (IPSec, TLS, SSH, and so on), security architecture, security operations management, firewall configuration, key management, security log analysis, user management, web server security, certificate management, OpenStack, Linux, Lightweight Directory Access Protocol (LDAP) and Simple Network Management Protocol (SNMP).

1.2.2   Decision Makers

It is required for the decision makers, who identify operational risks and decide required controls, such as security administrators managing security and IT, and Telecom (security) operational managers responsible for ISMSs, that they understand the security concepts before taking responsibility and making decisions. At least CISSP, CISM, and ISO27001 lead auditor or equivalent certificates are required. Furthermore, deep domain knowledge on cloud and security is required, especially on those components on which the hardening steps are to be performed. The security topics are, for example, cryptography, secure protocols (IPSec, TLS, SSH, and so on), security architecture, security operations management, firewall configuration, key management, security log analysis, user management, web server security, certificate management, OpenStack, Linux, LDAP and SNMP protocols.

2   Hardening Checklists

This section includes the checklists and provides information on their use.

2.1   Assess Hardening Activities

Table 1 is an assessment template for each hardening item described in section Hardening Activities in the System Hardening Guideline. During the assessment of each hardening activity, the following must be explained in the comment section of Table 1:

• The reason why the activity is needed, or detailed explanation why it is not needed.
• Who made the decision, especially when the activity is deemed unneeded.
• How to manage the risks of not applying the hardening activity, for example, to whom the risk is transferred to, who accepted the risk, or how to mitigate the risk, if needed.

Provide the date when the assessment of the hardening activities were completed:

Provide the name of the personnel who performed the assessment:

2.2   Perform Hardening Activities

Table 2 lists the hardening activities as described in section Hardening Activities in the System Hardening Guideline, that must be performed during installation, based on the result of the assessment. If no assessment was performed, it is expected that all items are mandatory to be performed. If some items are assessed as not required in the assessment, and the why it is not needed, how to manage the risk, and who made the decision fields are filled, the activity may not need to be performed.

Fill the table for each activity that is already performed.

If there are comments, for example, "it was only possible to perform partially", or "there is an error in the process and a Trouble Report (TR) is raised to cover the issue", provide this information there.

(1)  The corresponding section from the System Hardening Guideline

Provide the date when the listed hardening activities were completed:

Hardening performed by:

Reference List