Episode Summary

11:11 Systems Director of Cloud Market Intelligence Brian Knudtson is joined by guests Liron Amitzi, Lauren Malhoit, and David Klee for a conversation about the security implications of managing service providers. They discuss their experiences with security, compliance, and overall functionality considerations when embarking on using 3rd parties to augment I.T. staff. When it comes to using service providers for critical IT tasks, it’s important that you trust but verify.

Panel

Cloud Conversations

Topic 1

[03:28] How important are compliance attestations in determining how well a provider’s security controls will protect the business and the data they entrust with that provider?

Topic 2

[11:26] What should customers be looking for to evaluate the providers on this particular front?

Topic 3

[19:18] Is there any advantage to using those built in tools that the cloud providers provide? Or should customers always plan on bringing their own security tools?

Cloud Bites

[02:50] “I think the TL;DR there is basically just not to assume that just because you don’t own the equipment that your cloud provider will take care of things for you”  — Lauren Malhoit 

[11:34] “It’s not only important to understand, but to document roles and responsibilities for both internal teams” — Lauren Malhoit 

[14:52] “Documentation is absolutely critical.” — David Klee

[23:00] “The fact that the cloud provider has all these abilities, it doesn’t mean that they are configured correctly.” — Liron Amitzi

[32:19] “So the auditor itself needs to be an expert as well in this specific the specific topic they are auditing” — Liron Amitzi

[32:59] “Instead of asking, do you do regular backups, you should ask the question, how recently did you test yesterday’s backup?” — David Klee

[35:52] “The shared responsibility model, particularly with cloud providers, is huge and is the number one thing you should make sure you understand before you sign on the dotted line with them.” — BK