Network security: who owns it on each service model
The boundary, the segments inside it and the rules that let traffic through. On infrastructure you draw the network; on software services the provider does.
The split by service model
| Service model | Owner | Why, and the clause |
|---|---|---|
| Infrastructure as a service | yours | You draw the virtual network, its segments and its rules; the provider keeps tenants apart underneath and runs the physical network. ISO/IEC 27017 CLD.9.5.1 |
| Platform as a service | shared | The provider runs the platform's network and keeps tenants apart; the endpoints you expose, private connections and the rules on them are yours. ISO/IEC 27017 CLD.13.1.4 |
| Software as a service | the provider's | The provider runs the application's network end to end; you control only which addresses and devices may sign in, where the service offers it. ISO/IEC 27017 CLD.9.5.1 |
| Serverless functions and event services | shared | The provider runs the platform's network and keeps tenants apart; the endpoints you expose, private connections and the rules on them are yours. ISO/IEC 27017 CLD.9.5.1 |
| Hosted AI models and AI platforms | shared | The provider runs the platform's network and keeps tenants apart; the endpoints you expose, private connections and the rules on them are yours. ISO/IEC 27017 CLD.9.5.1 |
Services that move the line
- Object storage: shared The provider runs the storage network; whether a bucket can be reached from the internet, and from where, is a setting that is yours.
The clauses each framework attaches
8 quoted| Framework | Clause |
|---|---|
| Cloud Controls Matrix v4.0.1 | CCM-IVS-03 Network Security |
| ISO/IEC 27017:2015 | ISO/IEC 27017 CLD.9.5.1 Segregation in virtual computing environments ยท ISO/IEC 27017 CLD.13.1.4 Alignment of security management for virtual and physical networks |
| SOC 2 Trust Services Criteria | SOC 2 CC6.6 Measures against threats outside system boundaries are implemented |
| ISO/IEC 27001:2022 Annex A | ISO/IEC 27001 8.22 Segregation of networks |
| CMMC 2.0 | CMMC SC.L2-3.13.1 Boundary Protection |
| FedRAMP Moderate | FedRAMP SC-7 Boundary Protection |
| C5 cloud criteria catalogue | C5-COS-06 Segregation of data traffic in jointly used network environments |
CCM-IVS-03 Network SecurityRestrict traffic between environments to authenticated and authorised connections, encrypt and monitor it, and review the configuration at least annually with a written justification for every allowed service, protocol, port and compensating control.
- Firewall and network policy rule sets between environments
- The written business justification for each allowed service, protocol and port
- Annual review record of the rule set
- Evidence of encryption and monitoring on inter-environment traffic
- Rules accumulated over years with no justification recorded
- Any to any rules left in place from a migration
- Annual review performed on the perimeter only, not between internal environments
ISO/IEC 27017 CLD.9.5.1 Segregation in virtual computing environmentsA customer's virtual environment running on a cloud service is to be protected from other customers of the service and from unauthorised persons. The provider should enforce logical segregation between tenants across compute, storage and network, should segregate its own management environment from customer environments, and should describe the segregation to customers; the customer relies on that segregation and should verify the description before placing sensitive information in the service.
- Provider description of tenant segregation across compute, storage and network
- Independent assurance covering tenant isolation
- Customer review of the segregation before onboarding
- Isolation claimed at the hypervisor with shared storage that is not segregated
- Provider management plane reachable from a customer network
ISO/IEC 27017 CLD.13.1.4 Alignment of security management for virtual and physical networksWhen virtual networks are configured, the consistency of configurations between virtual and physical networks is to be verified against the provider's network security policy. The provider should apply the same network security policy to the virtual networks it provides as to its physical networks, should verify the two stay consistent when virtual networks are created or changed, and should describe the arrangement to customers; the customer should confirm the description meets its requirements for the virtual networks it uses.
- Provider network security policy covering virtual and physical networks
- Verification records when virtual networks are configured
- Customer review of the provider's virtual network security statement
- Virtual network rules that permit traffic the physical firewall policy forbids
- Virtual networks created by automation with no policy check
SOC 2 CC6.6 Measures against threats outside system boundaries are implementedImplements logical access security measures to protect against threats from sources outside its system boundaries
- Identification of the system boundaries and of the points at which external access is possible
- Configuration of boundary protections, such as firewalls, intrusion prevention, denial of service protection and web application firewalls
- Evidence of controls over remote access, including multi factor authentication and restriction of the routes available
- Evidence of encryption or other protection of credentials and data crossing the boundary
- Evidence of monitoring for and response to external attack attempts
- Multi factor authentication enforced on the main access route while legacy access paths and application programming interfaces bypass it
- Boundary defined by network only, missing identity based access from anywhere as the actual boundary
- Rules permitting broad external access retained from an earlier configuration with no review
- Attack attempts logged with no monitoring and no response defined
ISO/IEC 27001 8.22 Segregation of networksSegregate groups of services, users and systems in the network.
- Network segmentation policy
- Network topology diagrams
- Firewall rule set documents
- Segregation testing reports
- Informal or outdated network maps used instead of documented diagrams
- Inconsistent VLAN tagging and naming across locations
- Exceptions to segmentation not recorded or approved
- Segregation controls rarely tested after changes
CMMC SC.L2-3.13.1 Boundary Protection Level 1 and 2Monitor, control and protect communications at the external boundary of the system and at key internal boundaries.
- Network architecture identifying external and key internal boundaries
- Boundary device configuration such as firewall and gateway rulesets
- Monitoring evidence at those boundaries
- External boundary protected while internal boundaries are flat
- Boundary devices configured but traffic not monitored
- Cloud and remote boundaries omitted from the architecture
FedRAMP SC-7 Boundary ProtectionMonitor/control communications at external boundary and key internal boundaries; implement subnetworks for publicly accessible components.
- Control implementation statement for SC-7 citing the system mission and inheritance from common controls
- Network segmentation diagrams with VLAN and zone mapping
- Denial of service protection configuration and capacity test results
- Boundary protection architecture with firewall and proxy rule documentation
- Cryptographic standards specifying approved algorithms and key lengths
- Firewall rule base contains stale allow any entries
- Internal traffic between services unencrypted within trusted zones
- Legacy TLS versions remain enabled on external services
C5-COS-06 Segregation of data traffic in jointly used network environmentsSegregate the traffic of different cloud customers in shared network environments at network level following a documented segregation concept, so transmitted data retains its confidentiality and integrity between tenants.
- Documented tenant segregation concept for shared network environments
- Network configuration listing the per-tenant identifiers currently in use
- Test results demonstrating traffic cannot pass between two tenant segments
- Controls preventing a retired tenant identifier from being handed to another customer
- Separation depends on application logic rather than measures taken at network level
- Identifiers recycled after decommissioning, allowing traffic to surface in the wrong tenant
- A shared services segment lets tenants observe one another's traffic