Business leaders want to move a customer-facing application to a cloud provider and state that the move will transfer all security risk for the application to the provider. How should the information security manager respond?
Select an answer to reveal the explanation.
Short Explanation
Renting an apartment doesn't make the landlord responsible for leaving your front door unlocked. In the cloud, the provider secures its part, you secure yours, and the accountability for your data stays with you. The trap is believing a contract or a certificate moves that accountability.
Full Explanation
Cloud services operate under a shared responsibility model: the provider secures the components it manages, such as physical facilities and underlying infrastructure, while the customer remains responsible for elements such as data classification, identity and access management, configuration of the services it uses and, depending on the service model, application security. Above all, the organization retains accountability to its customers and regulators for the data, so the security manager should make clear that risk is shared and that the organization must manage its part and oversee the provider. Contractual liability can shift some financial consequences, but a provider will rarely accept liability for every incident, and accountability cannot be contracted away. An independent certification provides assurance about the provider's controls within its scope; it says nothing about how the organization configures and uses the service. Encryption is an important control, but encrypting data does not transfer risk; key management, access and configuration remain the organization's responsibility. Exam caveat: the division of responsibilities differs between infrastructure, platform and software services, so it must be mapped for each. Operational check: confirm a responsibility matrix exists for the service and that each customer-side control has a named owner.