Cloud Security Audit & Compliance

Why Compliance Matters for Cloud Hosting

Security audits and regulatory compliance are no longer optional for businesses operating online. Indian companies must now contend with the Digital Personal Data Protection (DPDP) Act 2023, which mandates strict data handling practices and significant penalties for violations. International customers increasingly require ISO 27001 certification or SOC 2 reports before signing contracts.

Your hosting provider (like ServerRaja) secures the physical datacenter, network infrastructure, and hypervisor layer. You are responsible for securing your operating systems, applications, data, and access controls.

Key Compliance Frameworks

**ISO 27001**: International standard for Information Security Management Systems (ISMS). Requires systematic risk management through policies, procedures, and technical controls.
**SOC 2 Type II**: Evaluates controls against Security, Availability, Processing Integrity, Confidentiality, and Privacy criteria over 6-12 months.
**DPDP Act 2023**: India's data protection law governing digital personal data processing. Requires consent management, data minimization, security safeguards, and breach notification.
**PCI DSS**: Mandatory for payment card processing. Covers network segmentation, encryption, access control, and monitoring.

Step 1: Asset Inventory and Classification

You cannot protect what you do not know exists. Start every audit with a comprehensive asset inventory:

# List all running instances
openstack server list --all-projects

# Inventory installed packages dpkg --list > /root/audit/package-inventory.txt

# List all listening services ss -tlnp > /root/audit/listening-ports.txt

# List all user accounts awk -F: '{if ($3 >= 1000 || $3 == 0) print $1, $3, $7}' /etc/passwd > /root/audit/users.txt ```

Classify each asset as **Critical** (production databases, payment systems), **Sensitive** (customer data, internal apps), or **Standard** (dev servers, staging).

Step 2: Access Control Audit

Auditors scrutinize who has access to what. Document and verify:

# Find users with empty passwords
sudo awk -F: '($2 == "") {print $1}' /etc/shadow

# Find root-equivalent users awk -F: '($3 == 0) {print $1}' /etc/passwd

# Check sudo access grep -E '^[^#]' /etc/sudoers /etc/sudoers.d/*

# Review SSH authorized keys for dir in /home/*/.ssh /root/.ssh; do echo "=== $dir ===" && cat $dir/authorized_keys 2>/dev/null done

# Check last login times lastlog | grep -v "Never" ```

Implement least privilege: unique accounts per user, SSH keys tied to individuals, sudo limited to specific commands, quarterly access reviews.

Step 3: Encryption Audit

Verify encryption at rest and in transit:

# Check disk encryption status
sudo cryptsetup status /dev/mapper/cryptroot

# Verify TLS versions nmap --script ssl-enum-ciphers -p 443 your-server-ip

# PostgreSQL SSL status sudo -u postgres psql -c "SHOW ssl;" ```

Requirements: TLS 1.2+ for all data in transit, LUKS or database-level encryption at rest, encrypted backups, SSH keys of at least 2048-bit RSA or Ed25519.

Step 4: Vulnerability Management

# System vulnerability scan
sudo lynis audit system --quiet --report-file /root/audit/lynis-report.txt

# Web application scanning nikto -h https://your-website.com -output /root/audit/nikto-report.txt

# Check for outdated packages sudo apt list --upgradable 2>/dev/null ```

Establish a policy: scan weekly, remediate critical vulnerabilities (CVSS 9+) within 24 hours, high (7-8.9) within 7 days, medium (4-6.9) within 30 days.

Step 5: Logging and Monitoring

Auditors expect centralized, tamper-resistant logging:

# Configure remote syslog
echo '*.* @@logserver.yourdomain.com:514' | sudo tee /etc/rsyslog.d/remote.conf

# Configure log retention (minimum 1 year) cat > /etc/logrotate.d/app-logs << 'EOF' /var/log/app/*.log { daily rotate 365 compress delaycompress missingok notifempty } EOF ```

Key requirements: log all authentication and administrative events, ship logs to a separate secured server, protect log integrity, retain for 1-7 years per regulation.

Step 6: Backup and Disaster Recovery

# Encrypted database backups
pg_dump -U postgres mydb | gzip | \
  gpg --symmetric --cipher-algo AES256 --passphrase-file /root/.backup-key \
  > /backups/db-$(date +%Y%m%d).sql.gz.gpg

# Upload to off-site storage rclone copy /backups/ remote:backup-bucket/ --encrypted ```

Document RTO and RPO for each system. Test restores quarterly and document the results.

Step 7: Incident Response and Documentation

Maintain these documents for auditors:

Information Security Policy and Acceptable Use Policy
Access Control and Data Classification Policies
Incident Response Plan
Business Continuity and Disaster Recovery Plan
Risk Assessment Report and Vendor Security Assessment
Training Records and Change Management Logs

Implement automated compliance checking:

#!/bin/bash
PASS=0; FAIL=0
if grep -q "minlen = 14" /etc/security/pwquality.conf; then
  echo "PASS: Password minimum length"; ((PASS++))
else
  echo "FAIL: Password minimum length"; ((FAIL++))
fi
if grep -q "PasswordAuthentication no" /etc/ssh/sshd_config; then
  echo "PASS: SSH password auth disabled"; ((PASS++))
else
  echo "FAIL: SSH password auth disabled"; ((FAIL++))
fi
echo "Results: $PASS passed, $FAIL failed"

Conclusion

Achieving and maintaining compliance requires systematic effort across access control, encryption, vulnerability management, logging, backup, and incident response. Start with a gap analysis, address findings in priority order, and establish continuous monitoring. At ServerRaja, our datacenters maintain ISO 27001 certification, and we provide compliance documentation to support your own audit processes.

Security Audit and Compliance Guide for Cloud Hosting Environments