What are the best network security standards for cloud computing and mobile devices?

1 ISO/IEC 27017

ISO/IEC 27017 is an international standard that provides guidance and best practices for cloud service providers and customers on how to implement information security controls for cloud computing. It is based on the ISO/IEC 27002 standard, which covers the general principles of information security management, but it also adds specific recommendations and requirements for cloud-related aspects, such as roles and responsibilities, data ownership, encryption, portability, incident management, and audits. ISO/IEC 27017 can help you establish a clear and consistent security policy and framework for your cloud services, as well as evaluate and monitor the performance and compliance of your cloud providers.

2 NIST SP 800-53

NIST SP 800-53 is a publication by the National Institute of Standards and Technology (NIST) that defines a set of security and privacy controls for federal information systems and organizations. It also applies to non-federal entities that handle sensitive or classified information, such as contractors, vendors, or partners. NIST SP 800-53 covers a wide range of security domains, such as access control, risk assessment, contingency planning, configuration management, identity and authentication, incident response, and system integrity. It also provides guidance on how to tailor the controls to different types of systems and environments, including cloud computing and mobile devices. NIST SP 800-53 can help you implement a robust and comprehensive security framework that meets the federal standards and regulations, as well as your own business objectives and needs.

3 CIS Controls

CIS Controls are a set of prioritized and actionable security measures that are developed and maintained by the Center for Internet Security (CIS), a non-profit organization that aims to improve the cybersecurity posture of organizations and individuals. CIS Controls are based on the consensus and expertise of a global community of security practitioners, researchers, and vendors, who identify and validate the most effective and essential security practices for different types of systems and environments. CIS Controls cover 20 security domains, such as inventory and control of hardware and software assets, secure configuration of systems and devices, continuous vulnerability management, email and web browser protection, data protection, and security awareness and training. CIS Controls can help you implement a practical and scalable security framework that aligns with the best practices and standards in the industry.

4 OWASP Mobile Security Testing Guide

OWASP Mobile Security Testing Guide is a comprehensive manual that provides detailed instructions and methodologies for testing the security of mobile applications and platforms. It is developed and maintained by the Open Web Application Security Project (OWASP), a non-profit organization that promotes the awareness and education of web application security. OWASP Mobile Security Testing Guide covers both the technical and business aspects of mobile security, such as threat modeling, risk analysis, architecture review, code review, penetration testing, reverse engineering, and compliance verification. It also provides guidance on how to use various tools and techniques to identify and exploit common vulnerabilities and weaknesses in mobile applications and platforms, such as insecure data storage, weak encryption, broken authentication, insufficient authorization, and insecure communication. OWASP Mobile Security Testing Guide can help you improve the quality and security of your mobile applications and platforms, as well as comply with the relevant laws and regulations.

5 Cloud Security Alliance Cloud Controls Matrix

Cloud Security Alliance Cloud Controls Matrix is a framework that provides a list of security controls and requirements for cloud computing. It is developed and maintained by the Cloud Security Alliance (CSA), a non-profit organization that promotes the best practices and standards for cloud security. Cloud Security Alliance Cloud Controls Matrix covers 16 security domains, such as application security, business continuity, change management, data security, encryption and key management, governance and risk management, identity and access management, mobile security, and threat and vulnerability management. It also maps the controls and requirements to various industry standards and regulations, such as ISO/IEC 27001, NIST SP 800-53, PCI DSS, HIPAA, and GDPR. Cloud Security Alliance Cloud Controls Matrix can help you assess and improve the security and compliance of your cloud services, as well as compare and select the best cloud providers for your needs.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?