CloudEXPO 2019

Is Everything in the Cloud?

Having to undergo an onsite assessment for a cloud environment sounds like an oxymoron, right? Many organizations tell their auditor that because they are a cloud-based organization, they do not want or need an onsite assessment. A new, dangerous trend that we’ve seen is auditors complying with that request. Audit firms advertise that they can effectively conduct an audit 100% remotely. This disregards physical controls that are in place to safeguard sensitive data and the frameworks that require testing of physical controls.

Not everything is in the cloud, and it’s irresponsible to claim that everything is in the cloud. Offices, employees, weather patterns, heating and cooling systems, power regulation, device management, physical security controls — these things don’t exist in the cloud. Physical security and onsite assessments must be a major component of cloud security and the shared responsibility model.

As more organizations migrate massive amounts of data to the cloud, it drives both cloud service providers and customers to consider how the cloud will change their privacy, security, and compliance efforts. Lack of security in the cloud can be detrimental to both providers and customers. In this session, Shannon Lane will educate the audience through lessons learned from recent breaches, his own experiences as an information security auditor, and best practices for cloud security.