-: Outsourcing concerns.
So in addition to all the personnel issues
we talked about with our own personnel,
when we outsource we have to think about
a whole 'nother set of personnel concerns.
We have to think about the fact
do we even trust the provider we're gonna be hiring?
What kind of employment practices do they use?
What kind of access control are they using?
Data ownership and control,
and instant response and notification processes.
Let's talk about each of those as we go through,
and what questions you should be asking
your outsource provider.
The first one is their employment practices
and proper vetting of the provider.
What kind of background checks are they doing
on their employees,
and what kind of background checks are you doing
on the service provider itself?
Are you reading reviews?
Are you talking to previous clients?
Are you figuring out how they do business?
These are important things for you to think about.
What kind of internal personnel controls are they using?
Are they doing background checks?
Are they making sure they're using mandatory vacations?
Are they making sure there's two-person integrity
or dual-control on important functions?
All those things are things you need to think about.
How do they treat their employees?
How do they handle issues?
What do they do when the fire somebody?
Now some providers will be upfront with this information.
Others will just tell you, "Hey, you're buying a service.
"Either hire us or don't."
But again, if they tell you that,
you may wanna look elsewhere, right?
So you wanna think about all these things
when you're looking at a outsourcing provider.
The next one is access control.
How is access to the system gonna be controlled?
Let's say that I hire a cloud provider
to run my servers for me.
Are they gonna maintain all the access,
or do I get all the access, or do we have shared access?
Can they access the servers,
but not the information on them?
This is all information we have to ask.
What about data logical and physical separation?
If that provider has 10 other clients,
how do I make sure my data's not being co-mingled
with their data?
How do I make sure that the other company
isn't gonna be able to read my information?
All things you need to think about
as you're architecting it,
and thinking about whether or not you wanna outsource
or you wanna do it in-house.
The next one is data ownership and control,
and some of the questions you wanna ask there is,
who's gonna own the data?
Is the data encrypted when it's stored?
Does the service provider have access to the data
or the encryption keys themself?
This is the kind of information we have to think about
because, again, different legal requirements
and different policy requirements, like PCI DSS,
are gonna look into that during your audits and assessments.
And the final one we wanna talk about
is instant response and notification processes.
Who's gonna be responsible
for conducting the instant response,
because if all your data's on their territory,
are they gonna do it for you,
or are they gonna let you in to do it on your own?
Who's gonna notify you there was a breach?
Are they doing the monitoring?
Are you doing the monitoring?
How would you even know if there was a breach,
because a lot of times with these third-party providers,
they may not tell you, and that's a big issue.
You have to consider these things when you're outsourcing,
because all of these security concerns
are still your responsibility.
You can outsource the task,
you can outsource the software development,
you can outsource the server hosting,
but still, your company is responsible for it,
because I as a customer have hired you to do a job,
and if you turned around
and outsourced that to somebody else,
I'm still gonna blame you.
Now you need to think about that
when you decide to outsource or not.