Many of the same security risks that companies face when  dealing with their own computer systems are found in the  cloud, but there are some important twists. With the cloud,  you no longer have well-defined boundaries regarding what’s  internal and what’s external to your systems. You must assess whether holes or vulnerabilities exist across servers,  networks, infrastructure components, and endpoints and then  continuously monitor them. According to the Cloud Security Alliance (CSA), an organization  dedicated to ensuring security best practices in the cloud,  significant areas of operational risk in the cloud include the  following: These materials are the copyright of John Wiley & Sons, Inc. and any  dissemination, distribution, or unauthorized use is strictly prohibited.  The CSA divides application security into different areas  including securing the software development lifecycle,  authentication, authorization, identity management,  application authorization management, application ✓ Application security changes in the cloud:  Uncovering  exposed security threats (in a public cloud) ✓ Incident handling changes in a cloud:  Working with  your service provider to control at least part of the infrastructure ✓ Physical security:  Covers security of IT equipment, network assets, and telecommunications infrastructure ✓ Human resource security:  Deals with the people side of the equation — ensuring background checks, confidentiality, and segregation of duties (for example,  those who develop applications don’t operate them) ✓ Business continuity:  Ensures that the provider meets its  service level agreement for operation with you ✓ Disaster recovery:  Ensures that your assets (your data  and applications) are protected  If, for example, you’re using a public Infrastructure as a  Service (IaaS) to run an application, find out what happens  if there’s some sort of disaster (natural or otherwise).  The multi-tenant nature of the cloud often makes investigating an incident more complicated. For example,  because information may be commingled, log analysis  can be difficult because your service provider is trying to  maintain privacy. Cloud Services For Dummies, IBM Limited Edition  46