Cloud Due Diligence Overview

Question 1

Cloud Due Diligence

Answer 1

-Cloud security for third parties is often the most important for executive leadership to understand for cyber professionals to review.

-You are trusting your data and processes to run outside your systems and environment.

-Reviewing cloud security controls can include a bit more than what is provided to you on an information security questionnaire (as your organization has a role to play within a shared responsibility model).

-Therefore, it is important to specially discuss cloud due diligence.

Question 2

Cloud Due Diligence Overview

Answer 2

-Define Cloud
-Shared Responsibility Model
-Security Reporting
-Patterns
-Cloud Software

Question 3

Cloud

Answer 3

Definition
-Your data stored by a third party and accessible over the internet.
-Anything that is no in your data center, not in your network. Could be in a Co-Lo facility CSP

CSP - Cloud Service Provider

Question 4

Types of Cloud

Answer 4

-Concentration Risk
-Shared Responsibility Model

Question 5

Types of Cloud:
-Concentration Risk

Answer 5

-Large number of SaaS products running in the US east

Question 6

Types of Cloud:
-Shared Responsibility Model

Answer 6

-Cloud service provider is essentially a 4th party