ACCT340 Chapter 4

Third Party Vendor

A way of sourcing software by getting it from an outside vendor

In House Development

A way of sourcing software by developing it from scratch

Cloud Computing

Access to shared resources over the internet, such as computer processing, software applications, data storage, and other services

Software as a Service (SaaS)

Uses the internet to provide customers with applications managed by the third party provider, which leverages its own data storage and IT infrastructure; the user has little control

Platform as a Service (PaaS)

Gives customers a remotely delivered platform for software development; developers have access to maintained operating systems, servers, storage, and networks and focus on designing and building application software

Infrastructure as a Service (IaaS)

Gives customers fully self service computers, networking, storage, and operating systems through virtualized environments; customers manage their own operating systems, data, and applications; the user has the most control

CSP (Cloud Service Provider)

The party responsible for the layers marked "CSP" in the system layer table (all four layers in SaaS, the database, operating system, and infrastructure in PaaS, and only infrastructure in IaaS)

Multi Tenant Risks

An attack against one is an attack against all

Lack of Transparency

A risk related to not knowing data storage locations

CSP Lock In

New tools only work with that CSP

Cyber Attack Target

A risk because a lot of data is in one place

Data Leakage

Data may be exposed to others

CSP Viability

The risk of a start up CSP that fails

Data Location

The risk of geographic restrictions on data

Shadow IT

Use of IT tools without approval

Cloud Deployment Models

Models that can lower or increase cloud risks; they are typically invisible to end users and must be identified through vendor documentation, contracts, or audit reports

Private Cloud

Exclusive for one business and always maintained on a private network; least risk

Hybrid Cloud

A mixture between private and public cloud with a divider between the two

Public Cloud

Available to the public through a provider; the network is secured BUT the user accesses these services through a web browser; most risk