Controlling Clouds: Beyond Safety
summary
Claims that risk is manageable by mapping 11 domains, 98 controls from the Cloud Controls Matrix to regulations and responsibilities, and that shared responsibility shifts certain chores to providers. Practical measures include SE Linux labeling for tenant isolation on OpenShift, virtual private clouds and VPNs for isolation, SOC2/SOC3 and FedRAMP for assurance, and automation (drift detection, Red Hat Satellite) for scale. Notes that multifactor authentication mandated for remote access and that encryption is feasible but key management remains the hard part.
AI-written summary · about
chapters (12)
- 0:00Start
- 6:11SHARED RESPONSIBILITY: CLOUD PROVIDER VIEW
- 8:08ABSTRACTIONS HIDE (BY DESIGN)
- 10:08BROADLY: CLOUD IS SHIFT TO DELIVERY OF SERVICES RATHER THAN INFRASTRUCTURE
- 12:26ITIL BEST PRACTICES HIGHLY RELEVANT TO SERVICE DELIVERY THROUGH CLOUD
- 14:06COST/BENEFIT STILL APPLIES RISK = LIKELIHOOD IMPACT
- 14:56EXAMPLE: COMPLIANCE CHALLENGES
- 16:38THE NICE THING ABOUT CERTIFICATIONS IS THAT THERE ARE SO MANY OF THEM
- 21:26BIG HONKING SPREADSHEET
- 27:41INFORMATION SECURITY
- 30:33SECURITY ARCHITECTURE
- 36:11APPLY ACROSS ENTIRE INFRASTRUCTURE (AND IT AS A WHOLE)
related talks
31mA Comprehensive Approach to Cloud Security Posture Management
09mCloud Security and how to leverage the shared responsibility model to your advantage
25mSecurity, Identity - Back to the Drawing Board?
58mCloud Attack Surface Management
45mExploring and managing risks in cloud: a practical journey to cloud security
52mThe Hacker's Guide to Cloud Governance
01h 09mCloud Safeguarding: View from Cloud Providers
43mWalking on Broken Clouds