Navigating Cloud Responsibility

Guest:

• Rich Mogull, SVP of Cloud Security at Firemon and CEO at Securosis

Topics:

• Let’s talk about cloud security shared responsibility.  How to separate the blame? Is there a good framework for apportioning blame?
• You've introduced the Cloud Shared Irresponsibilities Model, stating cloud providers will be considered partially responsible for breaches even if due to customer misconfigurations. How do you see this impacting the relationship between cloud providers and their customers? Will it lead to more collaboration or more friction?
• We both know the Jay Heiser 2015 classic “cloud is secure, but you not using it securely.” In your view, what does “use cloud securely” mean for various organizations today?
• Here is a very painful question: how to decide what cloud security should be free with cloud and what security can be paid? 
• You dealt with cloud security for a long time, what is your #1 lesson so far on how to make the cloud more secure or use the cloud more securely?
• What is the best way to learn how to cloud? What is this CloudSLAW thing?

Resources:

• EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff
• The Cloud Shared Irresponsibilities Model
• 2002 Trustworthy computing memo
• Use Cloud Securely? What Does This Even Mean?!
• EP145 Cloud Security: Shared Responsibility, Shared Fate, Shared Faith?
• No Snow, No Flakes: Pondering Cloud Security Shared Responsibility, Again!
• Cloud Security Lab a Week (S.L.A.W)
• Megatrends drive cloud adoption—and improve security for all
• Shared fate main page
• Defining the Journey—the Four Cloud Adoption Patterns
• Celebrating 200 Episodes of Cloud Security Podcast by Google and Thanks for all the Listens!