Knowledge Graph to Facilitate Cloud SecurityCompliance with NIST Cybersecurity Framework

Abstract In efforts to match the ever-growing cyber threats, which have become more sophisticated and more challenging to detect, governments and organizations worldwide have developed many standards and regulations. However, various standards and requirements across different industries often overlap, causing confusion about which standards to adopt to match specific requirements. Moreover, compliance requirements related to cybersecurity are constantly being changed. New requirements are also being developed to meet emerging technology use cases as well as threats, such as artificial intelligence. Individuals and organizations put in significant efforts to comprehend each standard and maintain compliance. It is beneficial to have a solution that tackles the problem of the amount of time and effort required to quickly map compliance requirements with security controls. This paper aims to tackle this problem in the cloud industry by systemically demonstrating deployment of a knowledge graph or ontology that maps cloud security controls in the security control level implementation level with the NIST Cybersecurity Framework. Past efforts were focused on mapping at the security category level and not the implementation level of security controls that facilitates actual granular level compliance. The ontology deployed could expediate the implementation of security controls and compliances by facilitating the incorporation of common software languages like HTTP and Java. The methodology described in this paper could also be extended to other compliance standards.