“There is no minimum bar that the data center operator has to achieve and no benchmark to hold data center operators accountable to.”

While I agree that SAS70 was and SSAE16 continues to be misused for testing IT and business process controls, the Service Auditor is required per the audit standard to ensure ‘The description fairly presents the information technology system that was designed and implemented throughout the period’ and ‘The controls related to the control objectives stated in the description were suitably designed.’ If the Service Auditor determines that either the description of the system or the type or number of controls proposed by the Service Organization to be within scope is insufficient, and the Service Organization is unwilling to bring the scope up to a mutually agreed level, the Service Auditor is bound by the audit standard as to whether the engagement can be performed and what must be reflected in the final report.

Rgds,
Richard

I did leave the URL/permalink as the old title though, since I’ve already linked out and don’t want to deal with redirects! Thanks for your $.02.

I think the best line in the article is “…your PCI compliant hosting provider should provide evidence…”. So true, for anything you cannot control, you need to get some level of attestation from the provider as to how they are protecting. As a matter of fact, that is a requirement of PCI. If you don’t have “proof” that your provider is doing what they need to protect CHD for the THINGS THEY CONTROL!

I agree that these breaches highlight PCI, but I don’t see the breaches “affecting PCI compliance”. Just my $.02.

Sutter Health has established a toll-free helpline to answer questions and assist patients in determining whether their data was included. Any concerned patients can call toll-free at 1-855-770-0003, Monday through Friday from 8 a.m. to 5 p.m. PST. When prompted, patients should enter this 10-digit reference code: 7637111511.

And you can find more information about the stolen computer notice here:
http://www.sutterhealth.org/noticeforpatients

Best of luck!

When it comes to vulnerability monitoring and protection, however, there are ways to mitigate the costs. Automation is the key and cloud-based services also are a great help in this area. What you want to look for are systems and products which are easy to set up, need little intervention from IT and automatically – but accurately – detect and prevent threats.

Bottom line – almost anything is cheaper than a breach when you take into account legal fees, fines, lost brand reputation etc. Indeed, if you are a level four merchant for example and you get breached, you need to meet the PCI DSS requiremenst of a level 1 merchant for an entire year – not such a good thing for the smaller retailer.

The risk assessment part of the process should be nothing new to organizations, and is hopefully a well understod process for them. If not, then this may require a bit of “heavy lifting” to get to the point where they can articulate proper controls that will be needed.

As a side note, I am (almost daily) working with clients to design solutions that will met PCI compliance requirements while running in a public cloud. It is not a trivial task, but it can and is being done currently.

A few things (excerpts you can find in the blog post above and info on the Spot Instances page):

1. You have your instance only for as long as your price is higher than the current spot price, and this is measured much more frequently than the bid interval of 1 hour. So you could launch an instance for up to $.15/hr it could run for 30 minutes, and then be terminated unexpectedly when the spot price is over $.15/hr

“The Spot Price changes periodically based on supply and demand, and customers whose bids meet or exceed it gain access to the available Spot Instances.”

2. People can, and do, bid HIGHER than the on-demand price for spot instances to get priority machine allocation. This means they get priority OVER all other spot prices, AND over “normal” on demand users.

“One major risk attached to this purchasing method is that you can be outbid by another person willing to pay more for the computers hosting your services. Meaning, at any moment, you could be kicked off and forced to rebuild your servers.”

3. Spot instances are terminated without a safety net, all data/jobs/processes on them need to be designed to be re-entrant, and fail-able. The mentality for typical spot instance usage is, there is a need, a spot instance is launched, it checks out a job from a queue (like SQS, but frequently a custom setup), it runs, *IF* it finishes, it returns success, *IF* it does not finish, another instance picks up the job.

“…as stated on Amazon’s site, ‘If you’re running Spot Instances and your maximum price no longer exceeds the current Spot Price, your instances will be terminated.’”

The better your application and plan meet the functionality of spot instances the more you can work the system and save a lot.

- It’s more of a question of why is SEOmoz investing their PRO member dollars in an inherently flawed hosting pricing plan? It’s almost as if they acknowledge they will continue to use a plan that is proven to be unreliable, instead of seeking higher quality hosting to guarantee better uptime. It’s a clear gamble and not the best business strategy to win over the loyalty of clients.

Most people would label backups as something for the techy folks. Well, aside from the super easy steps during installation, there are options tailor-made for every user.

http://www.aicpa.org/InterestAreas/InformationTechnology/Resources/TrustServices/DownloadableDocuments/FINAL_Trust_services_PC_Only_0609.pdf

Thank you,
Mike Kranz

1. You need to consider if you are talking Public or Private clouds. If private, then you may not be getting the benefit discussed here (as you likely have the physical aspects to deal with)
2. When looking at using a Public cloud for DR, you need to look at how “placing” that data an applications in that environment will affect its overall security. There are a number of security aspects of having things in a datacenter that will vanish when placed in a public cloud environment. That loss of controls needs to be expected an architected for. In particular, answer the following:
- Does my datacenter (and systems in it) provide controls around the security of sensitive information in transit? Does my cloud architecture provide similar controls? For example, most people consider the network within the datacenters to be private. Unless specific services are utilized, this is not the case with Public cloud. Think about the protocols used within the application, do they require more protection in a Public cloud environment?

- Does my datacenter (and systems in it) provide controls around the security of sensitive information at rest? Does my cloud architecture provide similar controls? For example, do you need to do anything different for data in the DB? How do you do key management, if applicable?

- Do you have any compliance requirements that would change if you go from a private datacenter to public cloud?

I concur that using the cloud for DR is a great thing (IMHO), but you need to make sure that you plan ahead!

Also Thu, I think you meant that using cloud for DR is more cost effective that Hot site DR but stated the opposite in your last bullet

DyanDelaney
IT support
Go Key

I am writing to you because there was one point that I wanted to clarify and see if it was at all possible for you to revise or update the article for clarification.

In the second paragraph you describe SAS 70 as being “First released in 1992, it has been the gold standard for data center users to assure that their data center is secure and operating under proper control systems. According to the American Institute of CPAs (AICPA), SAS 70 was never designed to be used by service organizations. It was focused on internal controls over financial reporting.”

I think the phrase “in this manner” is missing at the end of “designed to be used by service organizations” – which changes the meaning of the sentence.

In actuality, SAS 70 reports were never designed to be used by service organizations to market their systems (which you touch upon in the paragraph about organizations who would claim they are “SAS 70 certified). The primary purpose of these reports was to provide auditors of entities that use a service organization with information about the service organization’s system and assurance about controls over the system that are relevant to the user entities’ internal control over financial reporting. Such information and assurance is needed because certain controls at the service organization affect the quality of the information generated by the service organization, provided to the user entities, and incorporated in the user entities’ financial statements.

Please let me know if it is possible for you to revise the article for clarification – because I think otherwise it does do an excellent job of addressing the marketplace confusion and why the SOC reports are so important.

Thank you,
James Schiavone
Media Relations Specialist, Communications & Media Channels
AICPA

Your Azure link had me looking around Msoft’s cloud case study links. There are some big hitters profiled there and I suspect ‘elasticity’ was a requirement for many.

My company helps our customers meet and exceed the PCI requirements for wireless scanning by concentrating on security and I was glad to see Adam focusing that way as well. I liken the checkmark to putting an ADT sign in the front of your house and hoping that the burglars won’t find out that you don;t have a security system or that you leave the door unlocked most of the time.

Seems like a venture fund thinks so too and wants to make a go at the concept. It may be a great idea but not a company in itself. One of the public clouds will do this (or they know it doesn’t make sense).

Cloud Computing Start-up Creates Secure Tunnel between Data Center and Amazon Cloud
A start-up that moves VMware-based applications to the Amazon cloud and creates a secure tunnel between a customer’s data center and the cloud service launched a public beta trial last Monday. CloudSwitch, recently out of stealth mode, moves existing applications from internal data centers to the cloud without rewriting the app or requiring changes in management tools. CloudSwitch has raised $15 million in venture funding from Matrix Partners, Atlas Venture and Commonwealth Venture Partners. (San Francisco Chronicle – March 1st)

1. SAS 70 was mentioned – but which one Type 1 and/or 2. Big difference (and cost for the DC provider). Is there a history of compliance – if not why not?

2. What Uptime Institute recommendations does the DC provider say they meet? Ask for proof and do a walk through – physical and procedural. Use your judgement. Do the DC staff know their subject matter?

3. Look for carrier neutrality – bandwidth is bandwidth but you should know the physical routing into/out of the DC. Do all carriers use the same physical cable ducts into the DC – what happens if manual works cut through a trench (has been known) and takes out all comms. Whats plan B ?
What happens with cable breaks – varies by country of course but get to know the carrier cable routing plans – it isn’t that complex when you start to really drill down. If a carrier cannot explain this to you go to another one. Grill the carriers about their resilience plans (this goes beyond the DC provider) eg earthquake derived cable cuts – not uncommon in certain regions in the world eg Taiwan/Luzon Strait.

4. Look at other plant issues (power/aircon/physical building/grounding/diesel reserves): – who supplies it, to what levels, growth, backup etc. It may meet external standards but use your judgement – if it was your personal money would you do it? Again varies by country – be pragmatic.

5. Scenario plan “what if disasters” eg flooding, typhoon/hurricane, civil unrest (if there are gas price hikes and rioting at the gas pumps how do staff get to work (happens in the West) – has the DC provider addressed such. If so ask “show me” where appropriate, if not then why not.

6. Ask for reference customers. What’s the word on the street?

7. Draw up a matrix of competing DC providers – how do they really compare quantitatively and qualitatively. Is using multiple DC providers realistic?

8. Seek out those carrier people who went through Y2K. Lots of lessons to be learned from that time that apply to DC practice.

+++

Visiting the data center(s) and getting a good understanding of the facility, people, and the company’s operations is crucial in selecting a SaaS hosting partner.

Understanding the financial strength of your SaaS hosting partner is also critical. The damage that can be done to your business if your SaaS partner is closed down can be significant.

I like to say that “a start-up working with a start-up is nothing but squaring the risk.” It’s important to select a stable SaaS hosting partner with a long history and solid track record. Then you can turn 100% of your focus to your SaaS offering.

One thing I didn’t see (maybe my blindness?) but the financial strength / escrow accounts for used software, configurations, licenses, etc / other business aspects – we learned a long time ago (SaaS is not as new as is commonly thought!) those things can come and bite hard one day. The (possible) compensation doesn’t help much (as promised in SLA or whatever) if the provider is closed down suddenly by financial, legal or other business reasons. Using SaaS is like business partnering, you want to cover all and not all is technical.