{"id":1201,"date":"2010-05-21T07:00:12","date_gmt":"2010-05-21T15:00:12","guid":{"rendered":"http:\/\/www.formtek.com\/blog\/?p=1201"},"modified":"2010-05-21T07:00:12","modified_gmt":"2010-05-21T15:00:12","slug":"cloud-computing-how-complete-is-your-cloud-vendors-security-checklist","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/cloud-computing-how-complete-is-your-cloud-vendors-security-checklist\/","title":{"rendered":"Cloud Computing: How Complete is Your Cloud Vendor's Security Checklist?"},"content":{"rendered":"

Run a query on “SAS-70 certification” and you’ll get a page full of SaaS\/Cloud Computing\/On-Demand services that\u00a0have achieved certification for their services. \u00a0Many of these articles and press releases contain language like this\u00a0one: \u00a0“This SAS 70 Type II showcases to other stakeholders that their internal controls are above market standards.”<\/p>\n

Well, it certainly sounds good, but should a SAS-70 certification be sufficient to ease your worries of any problems that\u00a0might crop up with your Cloud computing vendor? \u00a0Unfortunately, the answer is no.\u00a0Not all SAS-70 certification reports are equal. \u00a0In fact, it’s not really possible to compare vendors based\u00a0on their SAS-70 results. \u00a0Not unless, of course, there is actually something bad that is contained in the report.\u00a0But that’s not usually the case because vendors have a lot of control over determining which aspects of their\u00a0cloud business will be reviewed for the report. \u00a0And things they feel less comfortable about can simply be omitted.<\/p>\n

Grep Shipley wrote<\/a> in an InformationWeek article:\u00a0There is certainly value to a SAS 70 Type II audit, but the relevance of that value heavily depends on the controls being investigated–the what. As any IT professional who has undergone a SAS 70 will attest, you can simply remove controls that you don’t want audited. Don’t have desktop patching? Strike it. No security integrated into the software development life cycle? Don’t have your auditor look at that. Don’t run vulnerability scanners? Keep it off the objectives list… Aggravating the situation, we’ve seen cloud providers that will provide a letter of attestation but refuse to list the SAS 70 control objectives. This is akin to saying, “Yes, we were audited, but no, we won’t tell you what the auditors looked at.”<\/p>\n

And then there is also the question of who made the audit? \u00a0That’s something that you need to dig a bit deeper to find out. \u00a0What is their reputation and their credentials? \u00a0Their methodology? \u00a0There are a lot of questions and very little uniformity currently in how the information is reported.<\/p>\n

This is clearly one area that needs to be addressed before more companies will be able to feel comfortable about\u00a0cloud computing.<\/p>\n

\"Digg<\/a><\/div>
\"Reddit<\/a><\/div>
\"Stumble<\/a><\/div>
\"Buzz<\/a><\/div>
\"Vote<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Kick<\/a><\/div>
\"Shout<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Post<\/a><\/div>
\"Google<\/a><\/div><\/div>","protected":false},"excerpt":{"rendered":"

Run a query on “SAS-70 certification” and you’ll get a page full of SaaS\/Cloud Computing\/On-Demand services that\u00a0have achieved certification for their services. \u00a0Many of these articles and press releases contain language like this\u00a0one: \u00a0“This SAS 70 Type II showcases to…<\/span><\/p>\n

Read more ›<\/a><\/div>\n

<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-1201","post","type-post","status-publish","format-standard","hentry","category-cloud-computing"],"_links":{"self":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/1201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/comments?post=1201"}],"version-history":[{"count":0,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/1201\/revisions"}],"wp:attachment":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/media?parent=1201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/categories?post=1201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/tags?post=1201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}