Many of the same security risks that companies face when dealing with their own computer systems are found in the cloud, but there are some important twists. With the cloud, you no longer have well-defined boundaries regarding what’s internal and what’s external to your systems. You must assess whether holes or vulnerabilities exist across servers, networks, infrastructure components, and endpoints and then continuously monitor them. 

According to the Cloud Security Alliance (CSA), an organization dedicated to ensuring security best practices in the cloud, significant areas of operational risk in the cloud include the following: 

✓ Physical security:  Covers security of IT equipment, network assets, and telecommunications infrastructure 

✓ Human resource security: Deals with the people side of the equation — ensuring background checks, confidentiality, and segregation of duties (for example, those who develop applications don’t operate them) 

✓ Business continuity:  Ensures that the provider meets its service level agreement for operation with you 

✓ Disaster recovery:  Ensures that your assets (your data and applications) are protected 

 If, for example, you’re using a public Infrastructure as a Service (IaaS) to run an application, find out what happens if there’s some sort of disaster (natural or otherwise). 

✓ Incident handling changes in a cloud:  Working with your service provider to control at least part of the infrastructure 

 The multi-tenant nature of the cloud often makes investigating an incident more complicated. For example, because information may be commingled, log analysis can be difficult because your service provider is trying to maintain privacy. 

✓ Application security changes in the cloud:  Uncovering exposed security threats (in a public cloud) 

 The CSA divides application security into different areas including securing the software development lifecycle, authentication, authorization, identity management, application authorization management, application 

