FFIEC Statement on Outsourced Cloud Computing

The Federal Financial Institutions Examination Council (FFIEC) has issued a statement on outsourced cloud computing activities.

The statement discusses key risk considerations associated with outsourced cloud computing activities and identifies applicable risk mitigation considerations contained in the various booklets that comprise the FFIEC IT Examination Handbook.

The Outsourced Cloud Computing Statement is contained in the Reference Materials Infobase section available online at http://ithandbook.ffiec.gov/.

Risks Associated with Cloud Computing

In reading this, we located a direct link to the FFIEC’s Publication: Outsourced Cloud Computing.

In addition, Appendix D: Managed Security Service Providers of the Outsourcing Technology Services Booklet states:

“Emerging Risks

Cloud computing is an emerging trend in which some of the IT industry’s biggest players are investing significant resources. Cloud computing in general is a migration from owned resources to shared resources in which client users receive information technology services on demand from third-party service providers via the Internet “cloud.” In cloud environments, a client or customer will relocate their resources such as data, applications, and services to computing facilities outside the corporate firewall, which the end user then accesses via the Internet.

Cloud-based MSSP services may be implemented as part of Internet access services. Examples of “in-the-cloud” services include carrier-based denial of service protection, virtual firewall services, and carrier-provided URL blocking. When an MSSP offers services that use a cloud computing architecture, the same risks that are specific to non-cloud-based security services apply. However, there are a few additional risk considerations that should be assessed when moving to a cloud computing environment. Areas for FIs to consider when an MSSP uses cloud computing in their managed security services environment include:

• Protecting data in transit to avoid data leakage;
• Securing data at rest so that one data breach within the cloud does not breach the other customer data within the cloud;
• Maintaining compliance with applicable regulatory requirements;
• Complying with foreign government privacy laws when outsourcing is performed offshore;
• Segregating customer data appropriately to comply with audit and legal requirements; and
• Avoiding sharing of authentication credentials to prevent the impersonation of users.”

Stepping back, you should also review Appendix A: Examination Procedures in the same document, as it provides for additional information that examiners may be looking for if you utilize cloud computing in your organization.

According to Dan Hadaway, “This can be seen as a warning that cloud computing sites should be included in your vendor due diligence and business continuity planning even if they are free.”