Securosis/The-CISOs-Guide-to-Cloud-Security — pull request #3 by beauwoods (2013-11-26 17:30:07+00:00)
Title: Update CISO_Cloud.md

Very good paper. I'll say I haven't studied cloud as deeply as you have, so my understanding might not be right in some places. In a few cases this will lead to my corrections being wrong, especially when I was unclear what you were trying to say. That unclarity in itself though is an issue since others could be as confused as I am. Where I've missed the point or didn't understand some cloud technology, these will probably be common mistakes made by those who are not intimately familiar with cloud technologies - ie. the target demographic of who would be reading a summary like this.

Consider an executive summary. Busy CISOs they may not take the time to read everything. But if they can hit a few bullets and have a high level understanding of what to bring up as benefits and risks at the next executive meeting he'll be much better prepared to head off mistakes. The technical folks can figure out the details later.
And a glossary. That way where you need to go into technical detail there's a life vest for the non-technical CISO. Also a place where he can go and find those buzz words the vendor keeps touting so he's not lost at the next lunch meeting.

17 Fixed a typo.

24 Reworded to reduce redundant word use

41.2 Parenthetical definition of "hypevisor" taken from https://securosis.com/blog/comments/virtualization-security-are-ptaceklawson-and-joanna-fighting-the-wrong-batt
41.2 Changed "connectivity software" to "software" to reduce complexity of the sentence
41.2 Changed "into the cloud" to "into the other cloud hardware servers" to remove the self-referentiality of the cloud linking to the cloud and to specify that these are hardware servers, not virtual servers
41.2 Added "that form the pool of compute and memory resources" so we can talk about that later.
41.2 Moved the mention of the cloud controller to 41.5.
41.3 Removed - I *think* what you're going for here relates more to building virtual networks in the management software. If I'm wrong consider rewording and putting it back in there.
41.4 Reduced complexity and increased clarity, building off 41.2
41.6 Added "networking" to the list of things that run on top of the virtualized environment.

45 While this statement is undoubtedly true, it's not clear what the impact on security is. (The "so what?" question.)

47 Again - so what? Is this a good thing, bad thing, neither, both? It's true, but does it matter?

50 Recommend clarifying this statement. Do you mean we also get less pervasive visibility as well? I think it would come down to who has the visibility - the vendor clearly has more visibility because there's more stack to be visible. Wouldn't that be the case?

56.1 Changed "cloud" to "cloud management software".

58.1 Clarified and simplified.
58.2-3 Do you mean physical servers? If not the resources you're talking about may be too easily confused with what makes up the resource pools.
58.8 Removed "But" to reduce reuse of the word.

60 Cleaned up language - since we hadn't said that 58 was just for IaaS, clarified that it's for all and called out what they are.

64-66 Does this need to be quoted? Who said it?

75.2 Edited to clarify we are still patching, just eliminating associated downtime.
75.4 Changed "destroy" to "get rid of" to eliminate jargon.
75.5 Added to say clearly why this is a good thing.

76 Added "backups" to the list of good things this enables.

77.1 Changed "or the registry" to "or in the registry" to clarify.
77.2 Accessible to whom and in what circumstances?
77.3 Which commands?
77.4 Again, it's not clear to whom and under what circumstances.

78.3 Added this sentence to say why it's a good thing.
78.4 Modified to make it appropriate to the inserted sentence.

80 Changed "highlights" to "highlight" for grammar.

97.2 This sentence doesn't make sense.

110 Made this italics rather than bullet point.

128-132 Added "so what" information.

144 Did you mean to have "file storage or SaaS" or is that a typo?

203 You state that there are several problems with building security agents into images in a standard environment, but don't say why, or how these tasks differ significantly from the cloud (except for validation). The major reasons why would be good and to show that, as you say, you aren't just making all this up.

250 Clarified that patching is a security task rather than a risk.

254-268 As of about a year ago a very well-known analyst firm was advising instead using more traditional segregation in their reference designs for networks. You may want to address this model and why hypersegregation is better on the cloud. Otherwise you may have some conflict with the analyst firm's customers.