Auditing Cloud Computing : A Security and Privacy Guide

The auditor's guide to ensuring correct security and privacy practices in a cloud computing environment Many organizations are reporting or projecting a significant cost savings through the use of cloud computing—utilizing shared computing resources to provide ubiquitous access for organizations and end users. Just as many organizations, however, are expressing concern with security and privacy issues for their organization's data in the "cloud." Auditing Cloud Computing provides necessary guidance to build a proper audit to ensure operational integrity and customer data protection, among other aspects, are addressed for cloud based resources. Provides necessary guidance to ensure auditors address security and privacy aspects that through a proper audit can provide a specified level of assurance for an organization's resources Reveals effective methods for evaluating the security and privacy practices of cloud services A cloud computing reference for auditors and IT security professionals, as well as those preparing for certification credentials, such as Certified Information Systems Auditor (CISA) Timely and practical, Auditing Cloud Computing expertly provides information to assist in preparing for an audit addressing cloud computing security and privacy for both businesses and cloud based service providers. "The auditor's guide to ensuring correct security and privacy practices in a cloud computing environment. Many organizations are reporting or projecting a significant cost savings through the use of cloud computing--utilizing shared computing resources to provide ubiquitous access for organizations and end users. Just as many organizations, however, are expressing concern with security and privacy issues for their organization's data in the "cloud." Auditing Cloud Computing provides necessary guidance to build a proper audit to ensure operational integrity and customer data protection, among other aspects, are addressed for cloud based resources. Provides necessary guidance to ensure auditors address security and privacy aspects that through a proper audit can provide a specified level of assurance for an organization's resources. Reveals effective methods for evaluating the security and privacy practices of cloud services. A cloud computing reference for auditors and IT security professionals, as well as those preparing for certification credentials, such as Certified Information Systems Auditor (CISA). Timely and practical, Auditing Cloud Computing expertly provides information to assist in preparing for an audit addressing cloud computing security and privacy for both businesses and cloud based service providers"-- Provided by publisher The auditor's guide to ensuring correct security and privacy practices in a cloud computing environment Many organizations are reporting or projecting a significant cost savings through the use of cloud computing & mdash;utilizing shared computing resources to provide ubiquitous access for organizations and end users. Just as many organizations, however, are expressing concern with security and privacy issues for their organization's data in the "cloud." Auditing Cloud Computing provides necessary guidance to build a proper audit to ensure operational integrity and customer data protection, amon AUDITING CLOUD COMPUTING: A Security and Privacy Guide; Contents; Preface; Chapter 1: Introduction to Cloud Computing; History; Defining Cloud Computing; Elasticity; Multitenancy; Economics; Abstraction; Cloud Computing Services Layers; Infrastructure as a Service; Platform as a Service; Software as a Service; Roles in Cloud Computing; Consumer; Provider; Integrator; Cloud Computing Deployment Models; Private; Community; Public; Hybrid; Challenges; Availability; Data Residency; Multitenancy; Performance; Data Evacuation; Supervisory Access; In Summary; Chapter 2: Cloud-Based IT Audit Process The Audit ProcessControl Frameworks for the Cloud; ENISA Cloud Risk Assessment; FedRAMP; Entities Using COBIT; CSA Guidance; CloudAudit/A6-The Automated Audit, Assertion, Assessment, and Assurance API; Recommended Controls; Risk Management and Risk Assessment; Risk Management; Risk Assessment; Legal; In Summary; Chapter 3: Cloud-Based IT Governance; Governance in the Cloud; Understanding the Cloud; Security Issues in the Cloud; Abuse and Nefarious Use of Cloud Computing; Insecure Application Programming Interfaces; Malicious Insiders; Shared Technology Vulnerabilities; Data Loss/Leakage Account, Service, and Traffic HijackingUnknown Risk Profile; Other Security Issues in the Cloud; Governance; IT Governance in the Cloud; Managing Service Agreements; Implementing and Maintaining Governance for Cloud Computing; Implementing Governance as a New Concept; Preliminary Tasks; Adopt a Governance Implementation Methodology; Extending IT Governance to the Cloud; In Summary; Chapter 4: System and Infrastructure Lifecycle Management for the Cloud; Every Decision Involves Making a Tradeoff; Example: Business Continuity/Disaster Recovery; What about Policy and Process Collisions? The System and Management Lifecycle OnionMapping Control Methodologies onto the Cloud; Information Technology Infrastructure Library; Control Objectives for Information and Related Technology; National Institute of Standards and Technology; Cloud Security Alliance; Verifying Your Lifecycle Management; Always Start with Compliance Governance; Verification Method; Illustrative Example; Risk Tolerance; Special Considerations for Cross-Cloud Deployments; The Cloud Provider's Perspective; Questions That Matter; In Summary; Chapter 5: Cloud-Based IT Service Delivery and Support Beyond Mere MigrationArchitected to Share, Securely; Single-Tenant Offsite Operations (Managed Service Providers); Isolated-Tenant Application Services (Application Service Providers); Multitenant (Cloud) Applications and Platforms; Granular Privilege Assignment; Inherent Transaction Visibility; Centralized Community Creation; Coherent Customization; The Question of Location; Designed and Delivered for Trust; Fewer Points of Failure; Visibility and Transparency; In Summary; Chapter 6: Protection and Privacy of Information Assets in the Cloud; The Three Usage Scenarios What Is a Cloud? Establishing the Context-Defining Cloud Solutions and their Characteristics