An important part of any security program is to ensure that
roles and responsibilities have been assigned.
If it's nobody's job, then often nobody does it.
In a world of cloud computing,
we have a few roles different from a normal business operation,
but the assignment of a role creates accountability.
It means a person is responsible to do certain tasks,
and therefore, they are accountable to make sure that they are done.
We only have accountability when it's clearly defined whose job it is.
Everyone assigned a role must understand the requirements that what
are they accountable or responsible for doing,
and then they must execute their tasks in a responsible,
thorough manner as well.
This also means they have to have the skills to be
able to execute their tasks as well.
When it comes to cloud‑based roles,
roles and responsibilities become more complex when there's a
relationship between different parties.
When it's all within one company,
a senior manager can assign roles and those are in effect,
but when we're dealing with a cloud service provider,
there is a difference here where roles and responsibilities can be shared,
and in fact they can be shared in different ways depending
on the deployment model or the contract.
The cloud service provider is responsible for providing cloud
services to customers according to the contract terms under
various deployments and service models.
They purchase and maintain hardware, the building; they manage access control,
both physically and logically; they manage the network,
as well as, of course, the various building elements,
such as power, heating, ventilation, and air conditioning.
They also manage the staffing of the cloud service
provider staff help desk operations, and so on.
The cloud consumer, or cloud customer,
is an individual or an organization that consumes or uses cloud services.
Now, they could also be a cloud provider.
We have situations where one company can offer or sell
software as a service to their customers,
but they at the same time are purchasing platform as a
service from another cloud provider.
We see that, for example, in the area of things like streaming media.
Very often you can purchase a streaming media that is a
software as a service type of offering, but being hosted by,
then, a large provider on platform as a service.
Some cloud services are free.
We've seen a lot of different offerings of email,
for example, that's free for people to use,
but in other cases there is a contracted price,
and even the free services quite often have a contracted price
if you go above a certain storage level.
The cloud carrier plays an important role because all of this requires stable,
reliable networks.
And the cloud carrier, could be a telco,
could be satellite, they are the ones providing some form of network access,
and quite often we work with them to ensure we have
redundancy so that if there was a cut cable,
there would still be another alternate route for traffic to take.
Now, that could be, let's say for example, if a fiber was cut.
We could have another fiber that went a different direction,
different path,
or it could be that we have a completely diverse type of routing where,
instead of just having a redundant fiber,
they might have a microwave or some type of satellite
communication in case of a problem with the fiber or
traditional telecommunications network.
One of the things that's important here is to have sufficient
bandwidth to be able to support all the needs of the various
consumers of the cloud services.
In some cases it's best to work with a broker.
A broker manages the relationship between the cloud
consumer and the service provider.
They might, first of all,
try to determine which is the best cloud offering to use.
They would then negotiate the contracts,
and of course they could represent several different cloud service providers.
That's a little different from, of course, another reseller.
A reseller is just someone who sells the services of a
particular cloud service provider.
One of the tools that's been useful for organizations is to use a CASB,
a cloud access security broker.
And the purpose of a CASB is to do exactly as it says,
monitor cloud access and, therefore, give us a glimpse into the security we have.
So it monitors cloud usage and allows the IT department to be able to
see what cloud services are currently being used.
As we talked about earlier in this course,
many organizations don't even know how many
different cloud services they are using.
The CASB can also help us then manage that relationship,
the communications, between the cloud service provider and the cloud consumer.
One of the things that is then brought in through part of that
administrative management is the management of access controls,
that only the correct people are able to access those cloud services and,
hopefully, only in the right way.
One of the things that's been necessary for many organizations when
they're considering a transition to the cloud,
is to have someone who is able to architect,
or plan, the various types of implementations,
and this is the cloud architect.
They are a specialist that designs the cloud
implementations and ensures that the right cloud solution
is chosen to meet business requirements.
We also have cloud auditors and regulators.
A cloud auditor provides independent assessment of cloud providers.
And they are important,
as we'll look at especially in the third part of this course where
we'll look at the evaluation of cloud providers.
We also have, then,
the regulators that can review and make sure that
things are being done correctly.
There are a number of different standards we can use,
such as STAR from the Cloud Security Alliance,
the SSAE 18,
though many organizations have already transitioned to the next version,
the SSAE 20, and the International Standard ISAE 3402.
In the US government, we have FISMA, which,
of course, is the Federal Information Security Management Act,
though, of course,
in some cases today with a revision to it it's called the
Federal Information Security Modernization Act.
One of the things that becomes more complex in a cloud relationship
is where is the division of responsibilities?
The one thing we should remember is that there are certain responsibilities
that are always going to be those of the cloud customer.
There are others that are always going to be the
responsibility of the cloud provider.
But,
there is a gray area in between that varies according
to the type of service we're using.
One of the things that it's good to remember from a security perspective is
that we see that data governance and data rights management,
as well as client endpoints and account and access management,
are always the responsibility of the cloud customer.
The cloud provider always looks after the building,
the physical host, physical network, and physical data center.
But, depending on whether or not we're using software as a service,
platform as a service, or infrastructure as a service,
the responsibilities could be those of the customer or of the cloud provider,
or they could even be shared when we look at things such as,
well, applications, network controls, and,
even we can say here, to identity and set up directory management.
The key point to review.
It's only possible to establish accountability and
responsibility when roles are clearly defined.
I have not gone into, in depth here,
the differentiation between accountability and responsibility.
Accountability is the person who's ultimately
accountable to make sure something's done,
responsibility is the person who actually does the work,
and each person may be, of course,
responsible for certain tasks and accountable for what they did.
Or we could have a situation where a manager delegates
a responsibility to an employee,
but the manager remains accountable for what that employee does.
But that's part of our RACI models and something that we will
look at in more detail later in the course.
As we know, this whole area of, we could say here,
roles, responsibilities, accountability becomes even more important,
but also more complex, when several different organizations are involved.