Evan Schuman's StorefrontBacktalk

The PCI Council is still addressing virtualization and its role in PCI-compliant approaches. As such, there may be some uncertainty about the ultimate acceptance of cloud computing. That uncertainty should be lifted soon, hopefully no later than the announcement of the revised PCI DSS this fall (or May for Participating Organizations).

Once your scope is addressed, you can tackle the other PCI questions, like separation of duties, encryption, key management, governance and the ability to conduct forensic investigation. You also will need to include due diligence of your cloud provider in your procedures for engaging a new service provider (Requirement 12.8). Personally, I’d like to know who else is sharing “my” cloud.

Again, the PCI compliance questions are the same. It is only the context, and maybe the technology of the answer, that will change.

When you look at the cloud, keep your security expectations realistic. Don’t expect 100 percent security. You don’t have 100 percent security anywhere, so don’t expect it in the cloud. What you want is the same, hopefully very high, level of security you have now or maybe a little higher.

At RSA, I heard one speaker make the argument that cardholder data might actually be more secure in the cloud because all the sensitive data would be in one place, albeit a cloud, and not spread across the enterprise as we often see today. He reasoned that the data would, therefore, be easier to monitor and manage. This is an intriguing argument, and with proper controls and auditability I can see how it might make some sense. Then again, it’s also creating an extremely tempting target.

Going beyond PCI, I would want to have a service level agreement (SLA) that includes notification of any security or data breach of the cloud provider. It may not affect your own data (or network or application or development platform) directly, but the SLA should ensure that you know about any breach promptly. I also suggest you make sure that if the authorities subpoena or even confiscate an entire server to get the records for another company sharing the cloud with you (it has happened!), your business will not be interrupted.

The cloud might be the ultimate form of outsourcing, and outsourcing is a good way to reduce your PCI scope. On one level, cloud computing is an updated, Internet-based version of the old timesharing model. Certainly there are risks.

Regardless of whether the cloud is new or not, the PCI and security questions you have to address remain the same. It is just the context in which you answer these questions that is different and perhaps a bit challenging. In many ways, the users are ready. It is the cloud providers that need to get their security and compliance act together.

Are you “in the cloud” yet? Are you considering it? What data, applications or activities would you put there? I’d like to hear your thoughts. Either leave a comment or E-mail me at wconway@403labs.com.