PCI And Cloud Computing: It’s All About Scope
Written by Walter ConwayMarch 18th, 2010
If you missed the recent RSA Conference--that annual Woodstock for security professionals worldwide--all you need to do is put the words cloud, security and compliance in a sentence with just about any verb and you can pretend you were there. The cloud is all the rage in corporate computing, and with good reason: It promises to significantly reduce your IT infrastructure investment and operating costs while improving availability. The issue for merchants is how to maintain security and validate PCI compliance in this brave new world of cloud computing. PCI Columnist Walter Conway asks, “Are PCI and the cloud incompatible?”
And he answers: Once your scope is addressed, you can tackle the other PCI questions--like separation of duties, encryption, key management, governance and the ability to conduct forensic investigation. You also will need to include due diligence of your cloud provider in your procedures for engaging a new service provider (Requirement 12.8). Personally, I’d like to know who else is sharing “my” cloud.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
2 Comments | Read PCI And Cloud Computing: It’s All About Scope
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
March 19th, 2010 at 6:53 pm
Thank you, Walt! It is refreshing to read an article (and a good one at that!) that discusses cloud computing and security which doesn’t get caught up in the industry hype.
March 26th, 2010 at 5:53 pm
One thing you didn’t cover here, but is crucial…
Will the Cloud provider *allow* audits?
There are cases where you cannot be compliant because they will not let you audit them – as a mater of policy. Layer 8+
Several of the “newer” challenges are Legal/Contract/Audit issues. Hosting and CoLo give us glimpses into these challenges, but this is still a big reason why many are not yet willing to put regulated data into clouds.