Assessing your current state  Chapter 5: Improving Security, Governance, and Cloud Reliability 53 In a cloud environment, and especially a hybrid one, security,  accountability, and reliability start with assessing your current  state. Determine if holes or vulnerabilities exist across servers,  networks, infrastructure components, and endpoints to properly assess and monitor your business’s security posture.  You need to be able to trust your own infrastructure as well  as that from a potential cloud provider. Begin by answering  a set of questions that helps you form both your approach to  governance and your security strategy. To get you started,  here are a few top questions: ✓ How do you control access rights to applications and networks — both those within your company and those  that are outside your firewall? Who has the right to access  IT resources? How do you ensure that only the right  people gain access to your applications and information? ✓ Can you identify web application vulnerabilities and risks  and then correct any weaknesses? ✓ Do you have a way of tracking your security risk over  time so you can easily share updated information with  everyone with a need to know? ✓ Are your server environments protected at all times from  external security threats? ✓ Are you able to monitor and quantify security risks in  real time? ✓ How do you adequately monitor, measure, and manage  your IT assets across multiple environments? ✓ Do you have a way to manage assets across your public  and private cloud environments? ✓ Can you implement security policies consistently across  all types of on-premises and cloud architectures? ✓ How do you protect all your data no matter where it’s  stored? ✓ Can you satisfy auditing and reporting requirements for  data in the cloud? ✓ Do you have a process for change and configuration that  ensures that members of the organization have reliable  access to the cloud service configuration information  they need to perform their responsibilities? These materials are the copyright of John Wiley & Sons, Inc. and any  dissemination, distribution, or unauthorized use is strictly prohibited.