INTRO

As we’ve delved into cloud architecture and the predominant cloud environments in recent months, it’s become clear that most of us, while we understand the basic *gist* of the cloud value proposition (along with the notion that we’re not supposed to worry about how the cloud works because that’s the point of throwing things into the cloud), well, we could stand with a more thorough technical understanding of what’s going on in cloud environments. By way of comparison, most security managers have a fairly good technical understanding of what’s going on when packets traverse a network router. They have a sense of what it looks like onscreen if you examine one of these packets as it enters the router, a sense of what the header on the packet does in terms of addressing the packet, and understand how the router interprets that data. More often than not, they’ve proven to be considerably less on board when it comes to questions like “what’s the difference between using REST and query interfaces to control AWS services.

Member Resources:

• "Assuring Third-Party Provider System Security Metric Availability," March 2010 Alert, by Charles Cresson Wood
• "Will the Common Assurance Metric Break New Ground?" March 2010 Alert, by Sara Peters
• "Can Businesses Prove Compliance in the Cloud? Without access to logs, cloud users may struggle to satisfy auditors. Still, though cloud security is not ready for PCI, it may be acceptable for SOX." December 2008 Alert, by Sara Peters
  • "Sidebar: Could a battle between law enforcement and cloud criminals jeopardize your cloud’s availability?" December 2008 Alert, by Sara Peters
• Privacy Rules Get Cloudy in the Cloud: Examine cloud providers’ privacy practices like third-party contractors,’" December 2008 Alert, by Rebecca Herold, CIPP, CISSP, CISA, CISM, FLMI
• "POLICY: Cloud Computing for Production Applications," December 2008 Alert, by Charles Cresson Wood
• "Third Brigade Offers Perimeter Defense, Logging, for Virtual Machines in the Cloud," December 2008 Alert, by Kristen Romonovich
• "Microsoft's Azure Will Bridge Cloud and Client," December 2008 Alert, by Kristen Romonovich
• Is Cloud Computing Really a Green Technology?" September 2008 Alert, by Sara Peters