RSA's second security brief has been published here and from a quick skim I liked this section about questions to ask your Cloud Provider.
Organizations outsourcing portions of their IT infrastructure must be able to trust the companies providing them with cloud-based services. Trust cannot be granted on the cloud provider’s reputation alone; it should be validated through thorough assessments to determine if the cloud provider needs to take additional steps to comply with the organization’s information security requirements and policies. Furthermore, performance conditions and standards must be written into SLAs and managed services agreements.
Here are some basic questions that organizations building private clouds should ask prospective cloud infrastructure providers:• May we see a sample of your logs to gain a better understanding of what types of data can and will be reported?
• How is data protected within your various systems and networks? For instance, what data is encrypted and under what circumstances (in transit, at rest)?• What practices do you employ to ensure safe multi-tenancy, authentication, authorization and activity monitoring? Have these practices been verified by a third-party auditor? If not, would you be willing to participate in an audit by either our staff or an independent auditor?
• Do you support federated identity management? If you cannot support our assertions and will be providing user identities to us, how are those accounts created and validated? How are user identities provisioned, managed and deprovisioned?
• What specific audit rights, as well as liability controls and protections, do you typically offer in your managed services agreements?• Are your data centers open for physical inspection? May we visit them if desired to assess physical environmental security?
If you're going to hand over a valuable corporate asset to a third party you'd better be sure you're not increasing any potential attack surface or putting holes in your Data Loss Prevention strategy.
Throwing your data into a public or private cloud and hoping it'll work out for the best isn't a security strategy. It's a career limiting move.
