<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on Ask potential cloud vendors these 10 security questions ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-402450]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-402450/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-06-18T20:27:49-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[AUDIT RESULTS VS. PRACTICE]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-402450-3752224]]></link>
        <description><![CDATA[I remember evaluating a secured data center (complete with then current SAS 70 I and II audits), finding an open door, walking past all of the main power controls and continuing to walk through one-way (push to open) doors to the front office where a security guard sat (ostensibly) reviewing monitors. He said nothing as I signed-in as Mickey Mouse and flashed my driver's license with a thumb over the picture. There were other flaws that eliminated this installation from being chosen as a co-lo for our financial data. Bottom line -- audits are only snap-shots in time, prepared by well-paid auditors who tend to pre-flag problem areas for management correction before writing a final report -- investigate before you invest (hat tip to the Better Business Bureau).]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-402450-3752224]]></guid>
        <dc:creator><![CDATA[120529-000107]]></dc:creator>
        <pubDate>Fri, 15 Mar 2013 16:52:46 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Audit value]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-402450-3751960]]></link>
        <description><![CDATA[The point made on third party audit is a valid one, some audit mechanisms will provide value to third parties and others won't.  If you rely on a audit report or process which doesn't provide you (as the reliant party) any form of redress then it might give you a picture that doesn't give you any legal protection... The question you have to ask is what legal liability does the auditor have to you (on the basis you didn't commission the audit) if you rely on their findings]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-402450-3751960]]></guid>
        <dc:creator><![CDATA[only1weasel]]></dc:creator>
        <pubDate>Thu, 14 Mar 2013 05:17:45 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[agree with 1 exception]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-402450-3751786]]></link>
        <description><![CDATA[Good list and nice additions. I can't say I wholeheartedly agree with #9 though. A recent financial audit is certainly better than no audit but external audits have a narrow focus/purpose with limited if any verification in the area of security controls and only report internal control issues if they are material to the bottom line, which takes an awful lot. A SSAE16 report is what you really want.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-402450-3751786]]></guid>
        <dc:creator><![CDATA[spartanovich]]></dc:creator>
        <pubDate>Wed, 13 Mar 2013 06:41:14 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[What would the next ten be...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-402450-3751563]]></link>
        <description><![CDATA[There are a few obvious other ones... off the top of my head my next few (let's not argue over the ordering) would be:11) What controls have they got in place to detect attacks and breaches12) What circumstances/criteria would they follow in notifying their customers of a breach13) Where is the data actually stored14) How do they prevent a breach or attack on one client affecting other clients services (i.e. service segregation, rather than data segregation)15) what access to the audit logs, security event logs, traffic details will they provide (e.g. if you are trying to get to the bottom of misuse by a legitimate user) 16) What is the process mechanism to extract your data/virtual servers from the cloud in the event of service/contract termination - what format will the data/systems arrive back in17) Do they have any high profile/high threat/high risk customers - what criteria would they use to determine whether a new customer poses a significant risk to their existing customers]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-402450-3751563]]></guid>
        <dc:creator><![CDATA[only1weasel]]></dc:creator>
        <pubDate>Tue, 12 Mar 2013 07:29:01 -0700</pubDate>
    </item>
    </channel>
</rss>

