- Security requirements are essential.
Never assume that things are secure,
instead, assume the opposite,
and prove them to be secure.
A great way to do this is by creating a custom checklist.
It should be customized because your issues are not the same
as the issues of the company down the street.
So, as you build your requirements,
make sure to centralize the following;
policies so that everyone is on the same page
when it comes to setting up roles.
Access controls, or a consistent use
of access control technology
throughout the cloud deployment.
APIs, Application Programming Interfaces
that ensure that we can programmatically access
the security systems and features.
Repository so that we can keep track of all entities
within the cloud, computing problems,
domain from security, and governance purposes.
Centralized logs to ensure that we have
the central understanding of what's happening.
Integrated monitoring and single pane of glass,
so that we have one place to look
and determine what's going on right now.
Establish consistency across systems,
leverage industry security standards
that benefit the organization,
but keep in mind,
that it's not one size fits all.
Some standards zap productivity,
and thus should not be adopted.
The following are some essential
security properties to consider.
Encryption strategy, or how we're going
to encrypt data in flight and data at rest.
Common tool chain,
meaning that we're using the same tool sets.
Standard OSS and BSS capabilities.
OSS is either operational or Operations Support Systems.
BSS stands for Business Support Systems.
Shared security services are security services
that should be shared with on-premise systems
and cloud-based systems.
Here are some ways to endeavor to eliminate human errors.
Blueprints are how we're going
to implement security services, and who will do it.
Patching or how we're going to patch software issues
that can lead to vulnerabilities.
Scanning, meaning that we proactively scan the environment
to ensure that we're seeing problems.
Event management or that we're able to deal
with hacking events in a pre-planned and orderly way,
using tools to automate the processes.
One touch deploys where we're able
to deploy security solutions with a single push.
Automated metadata tagging,
meaning that we're not only are able
to manage the data better by providing identifiers.
Measuring communicate results, drive continual improvement,
build on existing capabilities.
This means that we're also looking to improve,
and thus there is a sound feedback loop that exists
that allows cloud security admins
to improve security ongoing.
In some instances, this could be moving
to a new level of encryption for data in flight,
and data at rest that's more secure
and easier to manage.
Discovery, understand the security architecture controls
and stakeholder requirements.
Gain an understanding of the needs of the business
by looking at the target architecture,
talking to the business leaders,
identifying domains, et cetera.
This is a good template for you to use,
as you gather your own security requirements,
using all of the concepts presented in this video.
We'll break down the other process components
in the next video, allowing you to continue the journey
to a fully optimized cloud computing security solution.