• Section 2.3 – Using cloud services

• Workload descriptions and management.
• Procurement and contract management.
• Virtualisation and the separation of resources using hyperscale technologies and strict control-plane/data-plane, tenant/tenant and tenant/provider segregation.
• Key information security services used to control the information boundary: using identity, directories and authorisation, instead of networks, gateways and firewalls.
• The approach to and selection of critical security services such as intrusion detection, key management, encryption, endpoint controls, privileged and user access management and authentication (including MFA).

• Private cloud, hosted on third party public cloud infrastructure.
• Multi cloud, combining elements of different vendors’ public cloud services.
• Hybrid cloud, combining elements of private and public cloud services.

• The infrastructure used to deliver the public cloud services is not owned by the agency (i.e., server hardware, network devices).
• The cloud infrastructure is shared between many customers (‘multi-tenanted’) and is accessible from the internet.
• Service provisioning is automated and customer managed.
• There is strict isolation between customer instances, and between customer instances and the service provider’s management plane.
• Customer data is isolated and controls are in place that strictly manage access by the service provider.
• There is a defined shared responsibility matrix for ensuring the services meet customer security requirements.  It should be noted that regardless of the model, agencies will retain ultimate accountability for the security of their information.
• There is limited flexibility in how the services are configured, and in at least some aspects there may be no flexibility to customise the service.

• Pervasive identity and authorisation model.
• Consistent, software-orchestrated environments running immutable workloads.
• Automated response to security incidents or misconfigurations.
• Fine-grained access control.
• Scalable logging, monitoring and audit.
• Improved levels of baseline security.
• Enhanced visibility of security state.

• Traditional barriers limiting the movement of agency data across legal jurisdictions can be significantly reduced through the use of cloud services.
• Cloud service provider self-service tools can be subject to manipulation impacting agency infrastructure.
• Agency systems delivered using cloud services are typically accessible from the internet, including management interfaces, unless controls are put in place.
• Agency data is stored on shared platforms, in multiple locations, with agencies ultimately being accountable for ensuring information is secured.
• Cloud environments present large, high value targets, where single exploits can impact large numbers of customers.
• Cloud services are easier to consume without needing to involve common governance processes, such as change control, increasing the risk of using shadow services without adequate information security controls in place.
• On-demand services, coupled with rapid-elasticity, can lead to inappropriate use of agency cloud environments.  Agencies are responsible for tracking billing and usage metrics and ensuring appropriate controls are in place to manage fiscal constraints.

1. Agents used to manage configuration or collect system telemetry may not be able to be deployed across public cloud services.
2. Log messages may not be able to be centrally collected, or log information tailored to agency requirements, from public cloud services.
3. Network information, such as packet captures, may not be feasible to collect.
4. Traditional security devices, such as firewalls and proxy servers, may not be able to be deployed.

• Protecting environments by providing control enforcement points to manage information flows between internal systems and externally to the environment.
• Providing containment points where the impact of incidents can be limited in scope, which also aids in recovery.

• The highest classification the system is accredited to operate at, AND
• The lowest clearance level authorised users of the system hold.

The highest classification of information a classified system in public cloud can be accredited to operate with is RESTRICTED.

• Minimum security control requirements from the PSR and NZISM, determined by the classification.
• Security control requirements to manage the unique threat environment presented by the use of the public cloud services.
• Additional security control requirements to manage specific risks identified through risk assessments.

• Access to the underlying infrastructure by the public cloud service provider systems and staff.
• Differing relative importance of security controls, such as identity, and the addition of different types of privileged access such as for managing service subscriptions and billing (including terminating services) that can have immediate effect.
• Geographic locations where the public cloud services are being delivered from.
• Security controls being defined and implemented by the public cloud service provider.
• The ease of extending access to third parties, including third party applications, through in-built federation and directory integration services in public cloud.
• The ease of shifting data between services and geographic locations in public cloud environments compared to on-premise systems.
• The control and visibility of the security state of the underlying infrastructure platforms, including the physical hosting environment.

1. Zero touch configuration of infrastructure using well defined infrastructure as code pipelines.
2. Separation of the cloud provider platform’s administrative control interfaces from customer accessible tenant management services.
3. An inability for cloud provider staff to access customer data except through customer authorised access channels (i.e., the platform does not provide ‘back door’ access to customer data).