4 ms·
Does anyone know if CSPs can be managed via supplier agreements? I’ve always assumed it’s a commodity service and as such there are standard T&Cs, TOS etc. Cert
by beermonster 5y ago
Does anyone know if CSPs can be managed via supplier agreements? I’ve always assumed it’s a commodity service and as such there are standard T&Cs, TOS etc. Certainly those in the financial sector wish to manage other types of supplier risk in that way where possible.
- lbriner 5y agoIsn't that the million dollar question (or probably billion now). Theoretically, the Ts & Cs cover everything but clearly you cannot reasonably mitigate risk on the basis that the "supplier told me that it wouldn't happen". You have a (sometimes legal) requirement to do due diligence and at least decide what additional controls you can have to help with compliance and what your BC/DR process is if everything really goes south. Realistically, I don't really see AWS or Azure etc. being able to promise that their systems can never be hacked/broken. On the other hand, the assumption that doing things on-prem removes this risk is naiive since we can make just as many cock-ups even if we work for the company. Anyone ever forgotten to setup a firewall or vpn properly? True story: When I worked at a security company, the sales team wanted to demo a digital camera-over-IP system and the IT Manager told them not to use our internal network. They ignored him and plugged it in, flooding the network with packets that took down the computers and phones for about 30 minutes until we worked out what had happened. That was inconvenient but imagine if they had plugged in something much worse "because sales"