FFIEC Statement on Outsourced Cloud Computing
The Federal Financial Institutions Examination Council (FFIEC) has issued a statement on outsourced cloud computing activities.
The statement discusses key risk considerations associated with outsourced cloud computing activities and identifies applicable risk mitigation considerations contained in the various booklets that comprise the FFIEC IT Examination Handbook.
The Outsourced Cloud Computing Statement is contained in the Reference Materials Infobase section available online at http://ithandbook.ffiec.gov/.
Risks Associated with Cloud Computing
In reading this, we located a direct link to the FFIEC’s Publication: Outsourced Cloud Computing.
In addition, Appendix D: Managed Security Service Providers of the Outsourcing Technology Services Booklet states:
- Cloud computing is an emerging trend in which some of the IT industry’s biggest players are investing significant resources. Cloud computing in general is a migration from owned resources to shared resources in which client users receive information technology services on demand from third-party service providers via the Internet “cloud.” In cloud environments, a client or customer will relocate their resources such as data, applications, and services to computing facilities outside the corporate firewall, which the end user then accesses via the Internet.
- Cloud-based MSSP services may be implemented as part of Internet access services. Examples of “in-the-cloud” services include carrier-based denial of service protection, virtual firewall services, and carrier-provided URL blocking. When an MSSP offers services that use a cloud computing architecture, the same risks that are specific to non-cloud-based security services apply. However, there are a few additional risk considerations that should be assessed when moving to a cloud computing environment. Areas for FIs to consider when an MSSP uses cloud computing in their managed security services environment include:
- Protecting data in transit to avoid data leakage;
- Securing data at rest so that one data breach within the cloud does not breach the other customer data within the cloud;
- Maintaining compliance with applicable regulatory requirements;
- Complying with foreign government privacy laws when outsourcing is performed offshore;
- Segregating customer data appropriately to comply with audit and legal requirements; and
- Avoiding sharing of authentication credentials to prevent the impersonation of users.”
Stepping back, you should also review Appendix A: Examination Procedures in the same document, as it provides for additional information that examiners may be looking for if you utilize cloud computing in your organization.
According to Dan Hadaway, “This can be seen as a warning that cloud computing sites should be included in your vendor due diligence and business continuity planning even if they are free.”
Another awareness poster for YOUR customers (and users). Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your office.
Intelligence agencies from five nations contributed to the new advisory… An article review. For the first time, the cybersecurity divisions of the nations in the “Five Eyes” alliance (The United States, United Kingdom, Canada, Australia and New Zealand) have released a joint advisory concerning incident response. The report, available here, does not provide a complete […]
PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS NEW EMPLOYEE FOR INFOTEX infotex has just hired Nathan Harrell, to be a new Engagement Coordinator to assist with all communications between both current and prospective Clients. “We’re really excited to have Nate joining the team to help us keep the channels of communication open!” says Bryan […]
A Webinar-Movie Short Back by popular demand! Our Board Awareness Training program continues with this movie, entitled Vulnerability Management for Directors, that can be presented directly to your board of directors.
Nearly half of all companies expect a security issue due to telecommuting… An article review. A few months ago we discussed a warning from the Department of Homeland Security regarding hackers taking advantage of the business disruptions caused by COVID-19, and according to an article shared with us by our friend Wes Pollard it appears […]