Cloud Computing
According to NIST, cloud computing has five essential characteristics, three service models, and how many deployment models.
four (deployment models)
This is an independent assessment used to evaluate the presence and effectiveness of IT controls and their compliance with stated policies7...
IT Audit?
According to ISO 9000, this is defined as the "degree to which a set of inherent characteristics fulfills requirements
Quality
This is the process for identifying, minimizing, and monitoring risks for organizations.
Risk Management
This term refers to software specifically designed to disrupt, damage, or gain unauthorized access to computer systems.
Malware
These three cloud service models are abbreviated as IaaS, PaaS, and SaaS.
Infrastructure as a Service, Platform as a Service, and Software as a Service
This document outlines the overall authority, scope, and responsibilities of the audit function.
Audit Charter (or engagement letter)
This quality concept focuses on defect prevention and is process-oriented, involving a planned system of review procedures.
Quality Assurance
These four purposes explain why organizations implement risk management.
ensuring business assets are safe, protecting against competitive disadvantage, compliance with laws/regulations, and maintaining a good public reputation
This type of malware encrypts a victim's files and demands payment for the decryption key, as discussed in the John Oliver video.
Ransomware
This cloud deployment model combines both private and public clouds, with private clouds augmented by resources from public clouds.
Hybrid Cloud
The three main phases of an IT Audit are planning, testing, and this final phase where findings are reported.
the Reporting Phase
This quality concept focuses on defect identification in end products and is a reactive process implementing routine technical activities to measure and control quality.
Quality Control
In this risk control strategy, you shift risks to other areas or outside entities to handle, possibly by purchasing insurance or outsourcing.
Risk Transferal
According to the Cloud Security Alliance, these are the top 9 cloud computing threats, including Data Breaches, Account Hijacking, and Insecure APIs
"The Notorious Nine"
Most security problems in cloud computing stem from these three issues: loss of control, lack of trust mechanisms, and this concept where multiple customers share resources.
Multi-tenancy
In the Planning Phase, this defines the conceptual and physical boundary within which a security audit will focus
Security Parameter
In the Quality Improvement Model, after collecting data and selecting measures, you must determine if the process has this characteristic, meaning it's free from special causes of variation.
Stable (or Process Stability)
This risk control strategy involves properly identifying and acknowledging risks, but choosing not to control them, appropriate when the cost to protect exceeds the cost to replace.
Risk Acceptance
This security approach mentioned in the Lenovo video suggests not automatically trusting anyone or anything, requiring verification before granting access.
"Zero Trust" (or "Trust No One")
In cloud security, this concept refers to the division of security responsibilities between the cloud provider and customer, which varies based on whether using IaaS, PaaS, or SaaS.
Shared Responsibility Model
From an IT auditor's perspective, this type of analysis assists in identifying risks and threats to an IT environment and helps select certain areas to examine.
Risk Analysis
In the example of an IAM process, QC might verify execution within the process, while QA validates the overall process, approvals, and sufficient this
Audit Trails
In risk management, these two approaches are defined as waiting for incidents to happen and then responding (one approach) versus minimizing the possibility of incidents occurring in the first place (the other approach).
Reactive and Proactive approaches
This security threat involves cloud service providers suffering from attacks where criminals register for services using valid credit cards to conduct malicious activities with relative impunity.
Abuse of Cloud Services