Week 12: Security Criteria - Selecting an External Cloud Provider

Question 1

Simply stating that a CSP is compliant only amounts to ___

Answer 1

self-certification

Question 2

___are organizational programs whose scope covers every aspect of policy through specific security controls and procedures

Answer 2

Information Security Management Systems (ISMS)

Question 3

ISO 27001 identifies several categories of security control objectives

Answer 3

Security Policy
Organization of Information Security 
Asset Management 
Human Resources 
Physical and Environmental Security 
Communications and Operations Management 
Access Control 
Systems Development and Maintenance 
Information Security Incident Management 
Business Continuity Management 
Compliance

Question 4

Information Security Management Systems (ISMS) - Security Policy

Answer 4

The policy should be consistent with business objectives and meet business requirements, and it should comply with laws and regulations

Question 5

Information Security Management Systems (ISMS) - Organization of Information Security

Answer 5

A management framework to implement security, assign security roles, and coordinate implementations across the organization

Question 6

Information Security Management Systems (ISMS) - Asset Management

Answer 6

Establishes responsibility for and protect an organization’s assets

Question 7

Information Security Management Systems (ISMS) - Human Resources

Answer 7

This includes all aspects of personnel, including contractors and third party users, as well as all phases of employment

Question 8

Information Security Management Systems (ISMS) - Physical and Environmental Security

Answer 8

This involves every aspect of ensuring a controlled and protected environment for information facilities and equipment

Question 9

Information Security Management Systems (ISMS) - Communications and Operations Management

Answer 9

Defines responsibilities for information processing facilities and establishes procedures for their operation and control

Question 10

Information Security Management Systems (ISMS) - Access Control

Answer 10

Controls access to information and ensures that controls meet organizational requirements

Question 11

Information Security Management Systems (ISMS) - Systems Development and Maintenance

Answer 11

Identifies security requirements before starting the development process or any other aspect of implementation or acquisition
Verifies that applications and controls operate correctly and are appropriate

Question 12

Information Security Management Systems (ISMS) - Information Security Incident Management

Answer 12

Reports security events, incidents, and weaknesses

Establishes formal processes and procedures for managing incidents

Question 13

Information Security Management Systems (ISMS) - Business Continuity Management

Answer 13

Establishes and use a business continuity management process to counteract interruptions and protect critical processes

Question 14

Information Security Management Systems (ISMS) - Compliance

Answer 14

Ensures compliance with legal and regulatory requirements

Question 15

Obtaining accreditation is both time ___and ___

Answer 15

consuming

expensive

Question 16

SAS70 (Statement on Auditing Standards No. 70), Type II

Answer 16

This certification focuses on a CSPs infrastructure, policies, and procedures to assure that it follows best practices in minimizing the risk of service disruption and to ensure security of data

Question 17

ISO 27001/2

Answer 17

More comprehensive than SAS70

Question 18

Cloud Security Alliance (CSA)

Answer 18

In 2010, CSA revealed an initial program for accreditation / certification oriented toward certifying competency in cloud security practices

Question 19

FISMA, FedRAMP, and NIST 800-53

Answer 19

U.S. federal government programs to measure security for federal IT systems

Question 20

Uptime Institute

Answer 20

“Provides education, publications, consulting, certifications, conferences and seminars, independent research, and thought leadership for the enterprise data center industry and for data center professionals”

Question 21

transparency

Answer 21

degree of visibility into security policy and operations that a CSP offers to its customers

Although customers should not expect a CSP to provided details on how security is implemented, they expect a CSP to be open and accountable about security practices

Question 22

What should be kept secret in CSP security includes

Answer 22

specific implementation details that could be exploited by a hacker

Question 23

Overall, risk can be broadly classified into three categories

Answer 23

Technical Risks
Policy and Legal Risks
Operational Risks

Question 24

Technical Risks

Answer 24

isolation failure, data interception, data leakage, and malicious probes

Question 25

Policy and Legal Risks

Answer 25

loss of governance, compliance failures, jurisdictional issues, subpoenas, and licensing issues

Question 26

Operational Risks

Answer 26

malicious insiders, errors and misconfigurations, bandwidth problems, social engineering, loss of backup data, physical security compromise, loss of encryption keys

Question 27

Disaster recovery not only includes natural events like earthquakes, fires, or tornadoes - It also includes how you recover from disasters caused by ___

Answer 27

human error

Question 28

Security Criteria

Answer 28

Security Policies
Security Staff Independence
Change Management
Upgrades and Patch Management 
Scans
Forensics
Incident Management 
Business Continuity

Question 29

It is easier to patch ___ and then copy customer components to a copy of that image

Answer 29

a golden image

Question 30

Security engineers need to have a primary responsibility of security, but not of ___, as the two roles can conflict

Answer 30

operations

This team is often called a Security Operations Center (SOC)

Question 31

The kind of ___ that are deployed along with the ___that comprises the cloud can be valuable information for customers

Answer 31

servers

foundational software

Question 32

The act of backing up the cloud might ___

Answer 32

compromise security

Is encryption used as backups are created?
When the backups are physically being moved to another location is there a chain of custody?
Are there any measures in place to insure that the data has not been tampered with during the move?

Question 33

Service Level Agreements (SLA) are a critical component of a public cloud’s ___

Answer 33

availability guarantees

Question 34

Elasticity

Answer 34

Make sure you understand how the cloud provider scales their cloud and balances load

How do they accommodate customer growth?
How load is shared among nodes, and how does that affect your adoption of the cloud with your particular application?

Question 35

In terms of security, it is important to understand the ___ of the public cloud provider for key personnel involved in the development and management of the cloud

Answer 35

hiring policies and procedures