Cloud computing security risk management
Domain 3 tests risk management applied to cloud relationships. You need to identify cloud-specific threats, analyse likelihood and impact, evaluate against criteria, select treatments, record residual risk and keep the process alive through monitoring and communication.
Core rules and concepts
- Use a repeatable process: context, identification, analysis, evaluation, treatment, acceptance, communication and consultation, monitoring and review.
- Cloud risks include multi-tenancy, provider and subprocessor dependency, data location and jurisdiction, identity and API compromise, misconfiguration, lock-in and exit, availability, supply chain and loss of visibility.
- Assess the provider and the service, not just the logo: certifications, audit reports, control evidence, incident history, subcontractors, SLA and breach notification.
- Treatment options are avoid, reduce, transfer or share, and accept. Contracts transfer some liability, not accountability.
- Keep a risk register with owner, scenario, cause, impact, existing controls, rating, treatment, residual risk and review date.
Worked example
A CRM migration places PII with a SaaS provider using a subprocessor outside the customer's region. Likelihood is medium and impact is high because of regulator and reputation exposure. Treatment: contractual notification and approval for subprocessors, encryption with customer-managed keys, data minimisation, monitoring and an exit plan. The business owner accepts the residual risk with a review date.
Traps
Treating cloud as outsourced risk; assuming certifications eliminate risk; ignoring subcontractor chains and exit; recording no residual risk owner; assessing only the provider and not the customer's configuration.