The 14 NSCS cloud security principles - what do they mean?
The NCSC (National Cyber Security Centre) published 14 cloud security principles in 2016. These principles are designed to give guidance to cloud service providers in order to protect their customers.
In addition, all 14 NCSC cloud security principles have been made to align with ISO 27017, an internationally recognised cloud security accreditation. In addition, many cloud service providers also adhere to the Cloud Security Alliance’s Cloud Controls Matrix (CCM), which is also consistent with the principles. For cloud service solutions operating in the UK, it is considered good practice to adhere to these principles and the relevant accreditations. We have listed the cloud security principles below, as outlined by the NCSC. For more information, visit their website.
The 14 NCSC cloud security principles
1. Data in transit protection
User data which is transitioning between networks should be protected against any interference. This principle is primarily achieved through the use of encryption. By implementing strong encryption protocols, it ensures that even if data is intercepted, it remains unreadable to unauthorised parties.
2. Asset protection and resilience
User data, and the assets storing or processing it, should be protected against physical tampering, loss, damage or seizure. This principle requires collaboration through a combination of physical and digital safeguards. For physical assets, this includes secure data centres, access controls, and environmental monitoring. Digitally, this involves using resilient infrastructure, regular data backups, and redundancy to ensure services and data remain available even in the event of hardware failure or a cyberattack.
3. Separation between users
If a user of a service is compromised by malicious software, this should not affect the service or data of another user. This is a fundamental concept and is achieved through virtualisation and robust isolation technologies. By segmenting user environments and data at the network, storage, and application layers, a compromise in one user's account is prevented from spreading to others.
4. Governance framework
A Security Governance Framework should be followed by the service provider in order to internally coordinate its management of the service. An effective framework involves regular audits, risk assessments, and executive-level oversight to ensure that security is an ongoing, coordinated effort and not just a one-time project.
5. Operational security
To prevent and detect attacks, the service must be operated securely. Adequate security shouldn’t require complex or expensive processes. This is ensured through continuous monitoring, threat detection, and incident response planning.
6. Personnel security
Service provider personnel should be thoroughly screened, followed by in-depth training to reduce the likelihood of accidental or malicious compromise. Personnel security can be achieved through comprehensive background checks, ongoing security awareness training for all staff, and strict access controls. In addition, regular training helps ensure that personnel are aware of the latest threats and their role in preventing them.
7. Secure development
Services should be designed with security in mind. Nexor is proud to follow a Secure by Design approach. Secure development is achieved by embedding security considerations into every phase of the software development lifecycle, including threat modelling.
8. Supply chain security
The service provider should ensure that their supply chain adheres to all of the same security principles - read more about this in our supply chain blog. Supply chain security must follow a set of rigorous standards, such as conduct due diligence on all suppliers and partners, involving formal risk assessments, contractual obligations for security compliance, and continuous monitoring to ensure that security practices meet your standards.
9. Secure user management
Your service provider should ensure that you have the relevant tools to securely manage the use of their services. Management interfaces prevent unauthorised access to your data, making them a vital part of the security barrier. This is accomplished by providing user-friendly, secure management portals that offer granular access controls.
10. Identity and authentication
Access to the service interfaces should only be granted to specific individuals and should all be guarded by adequate authentication measures - two-party authentication if possible. Strong identity and authentication are achieved through the use of multi-factor authentication (MFA). Implementing robust authentication protocols and managing user identities centrally helps ensure that only verified and authorised individuals can access service interfaces.
11. External interface protection
Any external or less trustworthy service interfaces must be identified and defended appropriately.
12. Secure service administration
If a cloud service is compromised through its administration system, important company data could be stolen or manipulated. It is vital that these services are secure.
13. Audit information for users
A service provider should supply their customers with the audit record needed to monitor the service and who has access to your data. This is vital as it gives you a means to identify inappropriate or malicious activity.
14. Secure use of service
You have a responsibility to ensure the service is used properly, to ensure your data is kept safe and protected. This is a shared responsibility and can be achieved by establishing clear internal policies and high-quality training.
The responsibility of cloud users to maximise security
While the 14 NCSC cloud security principles are primarily guidelines for cloud service providers, they do not completely ignore the role of the user. Indeed, the 14th principle is a reminder that a fully secure system requires the active efforts of its users as well as its provider.
Here is a more complete description of the 14th principle, secure use of service, as taken from the NCSC website:
“The security of cloud services and the data held within them can be undermined if you use the service poorly. Consequently, you will have certain responsibilities when using the service in order for your data to be adequately protected.”
The 13th principle, 'audit information for users', indicates one of the ways that users can maintain the security of their cloud solution: regularly auditing who is using the service and how. However, this is not the extent of what customers can do to protect themselves.
Security will be strengthened by keeping to three guidelines:
Choose a secure, trusted cloud service provider.
Audit and regulate access to the cloud within your organisation or business.
Ensure that the cloud solution is fully integrated with any existing information architectures.
1. Choosing a secure provider
The existing cloud security principles and accreditations can help you keep to the first guideline. You should always check that a cloud service provider is fully compliant with the NCSC’s principles and has an accreditation like ISO 27017 before you use their services.
There are a number of well-regarded cloud service providers out there, including Amazon Web Services (AWS) and Microsoft Azure. When Nexor is looking to recommend a trustworthy solution, we consider how open a provider is about its security measures and whether or not it submits itself to third-party audits.
2. Auditing and regulating user access
Any service provider that is aligned with the NCSC’s cloud security principles must be able to provide you “with the audit records needed to monitor access to your service and the data held within it.” This principle carries the implicit recommendation that users be active in monitoring their use of a cloud service.
Using data given by the provider, you can monitor your organisation’s use of the cloud and spot any issues. By taking ownership of the response to any potential threats, an organisation can uphold the 14th cloud security principle and ensure that its use of the solution promotes and supports its security. Regular monitoring will also allow you to respond quickly to any activity that warrants further investigation or action.
3. Robust integration with existing information architecture
This final point is most pertinent for larger organisations that have not yet switched to a cloud service provider. Larger organisations need to ensure that their information exchange remains secure throughout and after the implementation of cloud-based solutions.
How Nexor can help
Nexor’s cross-domain cloud service is one way of ensuring a smooth transition. Our approach includes deploying the cloud solution robustly, layering additional security controls as needed, strong access controls, selecting a trusted provider and ongoing close monitoring of the system’s use. Find out more on our Guardiode solution page.
For a more in-depth look at cloud security and Nexor’s cyber security services, download our whitepaper on Enabling Secure Information Exchange in Cloud Environments. If you have any further questions or concerns, get in touch. We can advise you on your situation and suggest the next steps that you should take.
Be the first to know about developments in secure information exchange.