Scribd Logo
Unggah

Selamat datang di Scribd!

  • Cloud Computing IT Controls

    Diunggah oleh

    sbudaa
    56 tayangan6 halaman
    This document outlines numerous IT security concerns regarding the use of cloud computing and questions for a cloud computing provider to address. The concerns cover issues such as data protection, identity management, physical security, availability, incident response, privacy, compliance with standards, and business continuity planning. The document seeks responses from a cloud provider to assure the customer that their security requirements and audit needs would be met.

    Deskripsi Asli:

    Hak Cipta

    © Attribution Non-Commercial (BY-NC)

    Format Tersedia

    XLSX, PDF, TXT atau baca online dari Scribd

    Apakah menurut Anda dokumen ini bermanfaat?

    Apakah konten ini tidak pantas?

    Laporkan Dokumen Ini
    This document outlines numerous IT security concerns regarding the use of cloud computing and questions for a cloud computing provider to address. The concerns cover issues such as data protection, identity management, physical security, availability, incident response, privacy, compliance with standards, and business continuity planning. The document seeks responses from a cloud provider to assure the customer that their security requirements and audit needs would be met.

    Hak Cipta:

    Attribution Non-Commercial (BY-NC)
    Unduh sebagai XLSX, PDF, TXT atau baca online dari Scribd
    Tandai sebagai konten tidak pantas
    56 tayangan6 halaman

    Cloud Computing IT Controls

    Diunggah oleh

    sbudaa
    This document outlines numerous IT security concerns regarding the use of cloud computing and questions for a cloud computing provider to address. The concerns cover issues such as data protection, identity management, physical security, availability, incident response, privacy, compliance with standards, and business continuity planning. The document seeks responses from a cloud provider to assure the customer that their security requirements and audit needs would be met.

    Hak Cipta:

    Attribution Non-Commercial (BY-NC)
    Unduh sebagai XLSX, PDF, TXT atau baca online dari Scribd
    Tandai sebagai konten tidak pantas
    dari 6

    IT Security Assessment of using Cloud Comput Control Area

    Data Protection

    Data on the Network

    Vulnerability

    Identity Management

    Physical and personnel security

    Availability

    Incident response

    Privacy

    Business Continuity

    Logs and audit trails

    Compliance

    Liability

    Intellectual property End-of-service support

    IT Security Assessment of using Cloud Computing Security Concerns


    How do you separate my data from other customers' data? Where do you store my data? How strong is your encryption and data integrity? What kind of authentication and access control procedures are in place? Documentation for auditors specifying how you protect our data? What are your data leak prevention capabilities? (if applicable) Can you ensure that all my data is erased at the end of service? Can any third party (your service providers) access my data, and if so, how? Can you show evidence of your vulnerability management program? How often do you scan for vulnerabilities on your network and applications? Can I conduct an external vulnerability assessment on your network, and if so, how? What is your vulnerability remediation process? Can you integrate directly with my Development AD, and if so, how? How do you secure user IDs and access credentials? How do you handle user provisioning and deprovisioning Can you support SSO, and if so, which standards? Can you support federation, and if so, which standards? Is there restricted and monitored access to assets hosting my applications 24x7? If dedicated infrastructure is desired, can you ensure it is isolated? Do you perform background checks on all relevant personnel? How extensive? Do you document employee access to customer data? Have you gone through a SAS 70 audit, and if so, type I or type II? Can you share the audit result? Can you provide availability historical data? What is your downtime plan (e.g., service upgrade, patch, etc.)? What is your peak load, and do you have enough capacity for such a load? What is your procedure for handling a data breach? Can notification occur within a specified time period? In what format do notifications go out, and what info do they contain? How do you ensure that the vendors incident response procedures do not violate our own incident response requirements. Show me how you protect digital identities and credentials and use them in cloud applications. What data do you collect about me (logs, etc.)? How is it stored? How is the data used? How long will it be stored? Under what conditions might third parties, including government agencies, have access to my data? Can you guarantee that third-party access to shared logs and resources wont reveal critical information about my organization? Do you have any DR and BC planning documents, and if so, can we review them? Where are your recovery data centers located? What service-level guarantee can you offer under DR conditions? Can you accommodate timely forensic investigation Can we agree on provisions in the SLA for investigation? How long do you keep logs and audit trails? Can you keep them as long as we desire? Show evidence of tamper-proofing for logs and audit trails Are you SAS-70 compliant Are you ISO-27001 compliant

    Are you PCI Compliant Are you Basil II Compliant What recourse actions (e.g., financial compensation, early exit of contracts, etc.) can we agree on in the event of a security incident or failure to meet Under what conditions . . . ? Can we stipulate in the SLA that all my data (or applications), including all replicated and redundant copies, are owned by me? Ensure that your service agreement does not lead you to relinquish any IP rights. Specify what the Amazon cloud will deliver at the end-of-service period.

    Cloud Computing Response to Security Concerns

    Anda mungkin juga menyukai