Analysis of Methods for Conducting Cloud Security Audits According to International Standards

Abstract

Purpose: Comparison of cloud security audit methods (manual, automated, embedded) to determine their effectiveness in accordance with international standards, in particular, taking into account the specifics of cloud platforms and risk minimization.

Method: The empirical study used three methods: manual auditing against security standards, automated tools for rapid configuration verification, and built-in real-time monitoring. The sample for analysis was a test environment with minimal configurations, including a few users and basic resources.

Findings: Automated tools provide speed and cost-effectiveness, but manual auditing, while laborious, reveals the depth of analysis of non-standard configurations. Built-in tools provide an instant security overview but have limited flexibility, while standards integration, while increasing the overall level of security, reveals gaps in adapting requirements to the specific needs of organizations.

Theoretical implications (if applicable): The study confirms the relevance of existing theoretical frameworks, namely international standards for security assessment, but points to the need to adapt them to dynamic cloud environments. The results highlight the role of adaptive models in improving compliance with standards.

Practical implications (if applicable): System administrators and security engineers can combine automated tools, manual auditing, and built-in tools to optimize costs and improve the accuracy of security assessments. Integrating machine learning for risk prediction and standards adaptation will allow for proactive cloud security strategies, including filtering false positives and prioritizing vulnerabilities.

Originality/Value: A comparative analysis of three methods, taking into account their interaction, cost, and compliance with standards. Practical criteria for choosing security strategies under limited resources are provided.

Research limitations/Future research: The test environment may not fully replicate the complexity of real infrastructures. Adaptive algorithms that take into account the specific requirements of organizations are needed to improve analysis. Further research may include integrating artificial intelligence to automate anomaly detection, predict risks, and increase audit scalability.

Paper type: Empirical research with elements of theoretical analysis.