Compliance aggregation
A method includes receiving, by a computing device, security definitions from an owner of a cloud deployment; receiving, by the computing device, a customer profile having intents to use the cloud deployment; assessing, by the computing device and using automated assessment tools, compliance of the cloud deployment with the security definitions in view of the intents; generating, by the computing device, a compliance posture using the assessment; and providing, by the computing device, the compliance posture to a reviewer.
1. A method, comprising:
receiving, by a computing device, security definitions from an owner of a cloud deployment;
receiving, by the computing device, a customer profile having intents to use the cloud deployment;
assessing, by the computing device and using automated assessment tools, compliance of the cloud deployment with the security definitions in view of the intents;
generating, by the computing device, a compliance posture using the assessment; and
providing, by the computing device, the compliance posture to a reviewer.
2. The method of claim 1 , wherein the security definitions include security standards.
3. The method of claim 2 , wherein the security standards are selected from the group consisting of National Institute of Standards and Technology (NIST), Payment Card Industry (PCI), and International Organization for Standardization (ISO).
4. The method of claim 1 , further comprising translating syntax in the compliance posture to a native language of the reviewer.
5. The method of claim 1 , wherein the compliance posture includes syntax indicating a resource ID, a test performed, and a result of the compliance check along with metadata of the assessment tool.
6. The method of claim 1 , wherein the compliance posture includes syntax selected from the group consisting of JavaScript Object Notation (JSON), Yet Another Markup Language (YAML), and Extensible Markup Language (XML).
7. The method of claim 1 , wherein the customer profile is in the form of Open Security Controls Assessment Language (OSCAL).
8. The method of claim 1 , further comprising receiving a remediation recommendation from the reviewer.
9. The method of claim 8 , further comprising causing an assessment tool of the assessment tools to perform the recommended remediation.
10. The method of claim 9 , further comprising using metadata from the compliance posture to determine the assessment tool to perform the recommended remediation.
11. The method of claim 9 , wherein the metadata includes a validation date and time of the compliance check.
12. The method of claim 1 , wherein the computing device includes software provided as a service in a cloud environment.
13. A computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to:
receive security definitions from an owner of a cloud deployment;
receive a customer profile having intents to use the cloud deployment;
use assessment tools to assess compliance of the cloud deployment with the security definitions in view of the intents;
generate a compliance posture using the assessment;
provide the compliance posture to a reviewer; and
receive a remediation recommendation from the reviewer.
14. The computer program product of claim 13 , wherein the intent includes payment information.
15. The computer program product of claim 13 , wherein the compliance posture includes metadata to determine an assessment tool to perform the recommended remediation.
16. The computer program product of claim 13 , wherein the compliance posture indicates whether the cloud deployment complies with the security definitions.
17. A system comprising:
a processor, a computer readable memory, one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to:
receive security definitions from an owner of a cloud deployment;
receive a customer profile having intents to use the cloud deployment;
use assessment tools to assess compliance of the cloud deployment with the security definitions in view of the intents;
generate a compliance posture using the assessment;
provide the compliance posture to a reviewer;
receive a remediation recommendation from the reviewer; and
cause an assessment tool to perform the recommended remediation.
18. The system of claim 17 , wherein the security definitions are selected from the group consisting of National Institute of Standards and Technology (NIST), Payment Card Industry (PCI), and International Organization for Standardization (ISO).
19. The system of claim 17 , wherein the customer profile is in the form of Open Security Controls Assessment Language (OSCAL).
20. The system of claim 17 , wherein the compliance posture indicates whether the cloud deployment complies with the security definitions.