Implementación de un modelo de seguridad para mitigación de vulnerabilidades en ambientes de almacenamiento en la nube con base en las normas ISO 27017 y 27018.

Abstract

This research proposes the implementation of a security model to mitigate vulnerabilities in the cloud storage environments, based on the ISO 27017 and 27018 standards. International institutions framed in information security that made essential contributions in exposing the most known vulnerabilities today were analyzed. The controls presented in the ISO 27017 (Security Controls for Cloud Services) and 27018 (Requirements for the protection of personally identifiable information (PII) in Cloud systems) were analyzed. With those as mentioned above, a security model was developed based on three general objectives, such as Environment Security, Know & Access Limit, Detection, and Response. The security model includes a structure being general control information, control definition, implementation guide, the same that was implemented in a prototype of cloud storage previously selected among others of its kind. It was evaluated in two scenarios, the first one with the prototype having the security model implemented, and the second one not considering it where the risks to be presented were established and weighed focused on the confidentiality, integrity, and availability of the information, determining the most critical threats. From the study carried out, a model was established with security strategies from the perspective of construction, operation, and response to security incidents to alleviate common cloud storage problems. Also, the average weighting of the probability that the risks occur was substantially reduced by 75% compared to the situation that does not consider it.