Cloud: Security - Revision history

Unknown user: /* Masalah hukum dan kontraktual */

2023-04-28T09:58:53Z

Masalah hukum dan kontraktual

← Older revision		Revision as of 09:58, 28 April 2023
Line 100:		Line 100:
	==Masalah hukum dan kontraktual==		==Masalah hukum dan kontraktual==
	Selain masalah keamanan dan kepatuhan yang disebutkan di atas, penyedia cloud dan pelanggan mereka akan menegosiasikan persyaratan seputar tanggung jawab (menetapkan bagaimana insiden yang melibatkan kehilangan atau penyusupan data akan diselesaikan, misalnya), [[kekayaan intelektual]], dan akhir layanan (ketika data dan aplikasi pada akhirnya dikembalikan ke pelanggan). Selain itu, ada pertimbangan untuk memperoleh data dari cloud yang mungkin terlibat dalam litigasi. Masalah ini dibahas dalam [[service-level agreement]] (SLA).		Selain masalah keamanan dan kepatuhan yang disebutkan di atas, penyedia cloud dan pelanggan mereka akan menegosiasikan persyaratan seputar tanggung jawab (menetapkan bagaimana insiden yang melibatkan kehilangan atau penyusupan data akan diselesaikan, misalnya), [[kekayaan intelektual]], dan akhir layanan (ketika data dan aplikasi pada akhirnya dikembalikan ke pelanggan). Selain itu, ada pertimbangan untuk memperoleh data dari cloud yang mungkin terlibat dalam litigasi. Masalah ini dibahas dalam [[service-level agreement]] (SLA).



	~~===Public records===~~

	Legal issues may also include [[Records management\|records-keeping]] requirements in the [[public sector]], where many agencies are required by law to retain and make available [[Records management#Managing electronic records\|electronic records]] in a specific fashion. This may be determined by legislation, or law may require agencies to conform to the rules and practices set by a records-keeping agency. Public agencies using cloud computing and storage must take these concerns into account.


	===Public record===		===Public record===
			Masalah hukum juga dapat mencakup persyaratan [[records-keeping]] di [[sektor publik]], di mana banyak lembaga diwajibkan oleh undang-undang untuk menyimpan dan menyediakan [[electronic record]] dengan cara tertentu. Hal ini dapat ditentukan oleh undang-undang, atau undang-undang dapat mewajibkan lembaga untuk mematuhi aturan dan praktik yang ditetapkan oleh lembaga penyimpanan arsip. Badan publik yang menggunakan cloud computing dan cloud storage harus mempertimbangkan masalah ini.
	Masalah hukum juga dapat mencakup persyaratan [[~~Pengelolaan catatan\|penyimpanan catatan~~]] di [[sektor publik]], di mana banyak lembaga diwajibkan oleh undang-undang untuk menyimpan dan menyediakan [[~~Pengelolaan catatan#Mengelola catatan elektronik\|catatan elektronik~~]] dengan cara tertentu. Hal ini dapat ditentukan oleh undang-undang, atau undang-undang dapat mewajibkan lembaga untuk mematuhi aturan dan praktik yang ditetapkan oleh lembaga penyimpanan arsip. Badan publik yang menggunakan ~~komputasi awan~~ dan ~~penyimpanan~~ harus mempertimbangkan masalah ini.

	== Further reading ==		== Further reading ==

Unknown user: /* Legal and contractual issues */

2023-04-28T09:00:20Z

Legal and contractual issues

← Older revision		Revision as of 09:00, 28 April 2023
Line 98:		Line 98:
	:Peraturan [[General Data Protection Regulation\|GDPR]] Uni Eropa telah memperkenalkan persyaratan kepatuhan baru untuk data pelanggan.		:Peraturan [[General Data Protection Regulation\|GDPR]] Uni Eropa telah memperkenalkan persyaratan kepatuhan baru untuk data pelanggan.

	==~~Legal and contractual issues~~==		==Masalah hukum dan kontraktual==
			Selain masalah keamanan dan kepatuhan yang disebutkan di atas, penyedia cloud dan pelanggan mereka akan menegosiasikan persyaratan seputar tanggung jawab (menetapkan bagaimana insiden yang melibatkan kehilangan atau penyusupan data akan diselesaikan, misalnya), [[kekayaan intelektual]], dan akhir layanan (ketika data dan aplikasi pada akhirnya dikembalikan ke pelanggan). Selain itu, ada pertimbangan untuk memperoleh data dari cloud yang mungkin terlibat dalam litigasi. Masalah ini dibahas dalam [[service-level agreement]] (SLA).


	Aside from the security and compliance issues enumerated above, cloud providers and their customers will negotiate terms around liability (stipulating how incidents involving data loss or compromise will be resolved, for example), [[intellectual property]], and end-of-service (when data and applications are ultimately returned to the customer). In addition, there are considerations for acquiring data from the cloud that may be involved in litigation. These issues are discussed in [[service-level agreement]]s (SLA).

	===Public records===		===Public records===
Line 106:		Line 107:
	Legal issues may also include [[Records management\|records-keeping]] requirements in the [[public sector]], where many agencies are required by law to retain and make available [[Records management#Managing electronic records\|electronic records]] in a specific fashion. This may be determined by legislation, or law may require agencies to conform to the rules and practices set by a records-keeping agency. Public agencies using cloud computing and storage must take these concerns into account.		Legal issues may also include [[Records management\|records-keeping]] requirements in the [[public sector]], where many agencies are required by law to retain and make available [[Records management#Managing electronic records\|electronic records]] in a specific fashion. This may be determined by legislation, or law may require agencies to conform to the rules and practices set by a records-keeping agency. Public agencies using cloud computing and storage must take these concerns into account.


			===Public record===

			Masalah hukum juga dapat mencakup persyaratan [[Pengelolaan catatan\|penyimpanan catatan]] di [[sektor publik]], di mana banyak lembaga diwajibkan oleh undang-undang untuk menyimpan dan menyediakan [[Pengelolaan catatan#Mengelola catatan elektronik\|catatan elektronik]] dengan cara tertentu. Hal ini dapat ditentukan oleh undang-undang, atau undang-undang dapat mewajibkan lembaga untuk mematuhi aturan dan praktik yang ditetapkan oleh lembaga penyimpanan arsip. Badan publik yang menggunakan komputasi awan dan penyimpanan harus mempertimbangkan masalah ini.

	== Further reading ==		== Further reading ==

Unknown user: /* Compliance */

2023-04-28T08:57:59Z

Compliance

← Older revision		Revision as of 08:57, 28 April 2023
Line 94:		Line 94:
	:Selain menghasilkan log dan [[audit trail]], penyedia cloud bekerja dengan pelanggan mereka untuk memastikan bahwa log dan jejak audit ini diamankan dengan benar, dipelihara selama yang dibutuhkan pelanggan, dan dapat diakses untuk tujuan penyelidikan forensik (misalnya, [[eDiscovery]]).		:Selain menghasilkan log dan [[audit trail]], penyedia cloud bekerja dengan pelanggan mereka untuk memastikan bahwa log dan jejak audit ini diamankan dengan benar, dipelihara selama yang dibutuhkan pelanggan, dan dapat diakses untuk tujuan penyelidikan forensik (misalnya, [[eDiscovery]]).

	;Unique compliance ~~requirements~~		;Unique compliance requirement
	:~~In addition to the requirements to which customers are subject~~, ~~the~~ data ~~centers used by~~ cloud ~~providers may also be subject to compliance requirements~~. ~~Using a~~ cloud service provider (CSP) ~~can lead to additional security concerns around~~ data ~~jurisdiction since customer or tenant~~ data ~~may not remain on the same system~~, ~~or in the same~~ data ~~center or even within the same provider's~~ cloud.		:Selain persyaratan yang harus dipenuhi oleh pelanggan, pusat data yang digunakan oleh penyedia cloud juga dapat tunduk pada persyaratan kepatuhan. Menggunakan cloud service provider (CSP) dapat menyebabkan masalah keamanan tambahan seputar yurisdiksi data karena data pelanggan atau penyewa mungkin tidak berada di sistem yang sama, atau di pusat data yang sama atau bahkan di dalam cloud penyedia yang sama.
	:~~The European Union’s~~ [[General Data Protection Regulation\|GDPR]] ~~regulation has introduced new compliance requirements for customer~~ data.		:Peraturan [[General Data Protection Regulation\|GDPR]] Uni Eropa telah memperkenalkan persyaratan kepatuhan baru untuk data pelanggan.

	==Legal and contractual issues==		==Legal and contractual issues==

Unknown user: /* Compliance */

2023-04-28T08:56:07Z

Compliance

← Older revision		Revision as of 08:56, 28 April 2023
Line 89:		Line 89:

	;Business continuity and data recovery		;Business continuity and data recovery
	:~~Cloud providers have~~ [[business continuity planning~~\|business continuity~~]] ~~and~~ [[data recovery]] ~~plans in place to ensure that service can be maintained in case of a disaster or an emergency and that any~~ data ~~loss will be recovered~~. ~~These plans may be shared with and reviewed by their customers~~, ~~ideally dovetailing with the customers' own continuity arrangements~~. ~~Joint continuity exercises may be appropriate~~, ~~simulating a major~~ Internet ~~or electricity supply failure for instance~~.		:Penyedia cloud memiliki [[business continuity planning]] dan [[data recovery planning]] untuk memastikan bahwa layanan dapat dipertahankan jika terjadi bencana atau keadaan darurat dan bahwa setiap kehilangan data akan dipulihkan. Rencana ini dapat dibagikan dan ditinjau oleh pelanggan mereka, idealnya sesuai dengan pengaturan kontinuitas pelanggan sendiri. Latihan kesinambungan bersama mungkin tepat, mensimulasikan Internet utama atau kegagalan pasokan listrik misalnya.

	;Log and audit trail		;Log and audit trail
	:~~In addition to producing logs and~~ [[audit trail]]s, cloud ~~providers work with their customers to ensure that these logs and~~ audit ~~trails are properly secured~~, ~~maintained for as long as the customer requires~~, ~~and are accessible for the purposes of forensic investigation~~ (~~e.g.~~, [[eDiscovery]]).		:Selain menghasilkan log dan [[audit trail]], penyedia cloud bekerja dengan pelanggan mereka untuk memastikan bahwa log dan jejak audit ini diamankan dengan benar, dipelihara selama yang dibutuhkan pelanggan, dan dapat diakses untuk tujuan penyelidikan forensik (misalnya, [[eDiscovery]]).

	;Unique compliance requirements		;Unique compliance requirements

Unknown user: /* Compliance */

2023-04-28T08:53:37Z

Compliance

← Older revision		Revision as of 08:53, 28 April 2023
Line 82:		Line 82:

	==Compliance==		==Compliance==
			Banyak undang-undang dan peraturan yang berkaitan dengan penyimpanan dan penggunaan data. Di AS, ini termasuk undang-undang privasi atau perlindungan data, seperti, [[Payment Card Industry Data Security Standard]] (PCI DSS), the [[Health Insurance Portability and Accountability Act]] (HIPAA), the [[Sarbanes-Oxley Act]], the [[Federal Information Security Management Act of 2002]] (FISMA), dan [[Children's Online Privacy Protection Act of 1998]].

	~~Numerous laws and regulations pertain to the storage and use of data~~. ~~In the US these include privacy or~~ data protection laws, [[Payment Card Industry Data Security Standard]] (PCI DSS), the [[Health Insurance Portability and Accountability Act]] (HIPAA), the [[Sarbanes-Oxley Act]], the [[Federal Information Security Management Act of 2002]] (FISMA), ~~and [[Children's Online Privacy Protection Act of 1998]]~~, ~~among others~~.		Undang-undang serupa mungkin berlaku di yurisdiksi hukum yang berbeda dan mungkin sangat berbeda dari yang diberlakukan di AS. Pengguna layanan cloud mungkin sering perlu menyadari perbedaan hukum dan peraturan antara yurisdiksi. Misalnya, data yang disimpan oleh penyedia layanan cloud mungkin berlokasi di, katakanlah, Singapura dan dimirror di AS.

	Similar laws may apply in different legal jurisdictions and may differ quite markedly from those enforced in the US. Cloud service users may often need to be aware of the legal and regulatory differences between the jurisdictions. For example, data stored by a cloud service provider may be located in, say, Singapore and mirrored in the US.		Banyak dari peraturan ini mengamanatkan kontrol tertentu (seperti kontrol akses yang kuat dan jejak audit) dan memerlukan pelaporan rutin. Pelanggan cloud harus memastikan bahwa penyedia cloud mereka memenuhi persyaratan tersebut secara memadai, memungkinkan mereka untuk memenuhi kewajiban mereka karena, sebagian besar, mereka tetap bertanggung jawab.

	~~Many of these regulations mandate particular controls~~ (~~such as strong access controls and~~ audit ~~trails~~) ~~and require regular reporting~~. ~~Cloud customers must ensure that their~~ cloud ~~providers adequately fulfil such requirements as appropriate~~, ~~enabling them to comply with their obligations since~~, ~~to a large extent~~, ~~they remain accountable~~.

	;Business continuity and data recovery		;Business continuity and data recovery

Unknown user: /* Encryption */

2023-04-28T08:50:42Z

Encryption

← Older revision		Revision as of 08:50, 28 April 2023
Line 60:		Line 60:
	Data integrity demands maintaining and assuring the accuracy and completeness of data. A data owner always expects that her or his data in a cloud can be stored correctly and trustworthily. It means that the data should not be illegally tampered, improperly modified, deliberately deleted, or maliciously fabricated. If any undesirable operations corrupt or delete the data, the owner should be able to detect the corruption or loss. Further, when a portion of the outsourced data is corrupted or lost, it can still be retrieved by the data users.		Data integrity demands maintaining and assuring the accuracy and completeness of data. A data owner always expects that her or his data in a cloud can be stored correctly and trustworthily. It means that the data should not be illegally tampered, improperly modified, deliberately deleted, or maliciously fabricated. If any undesirable operations corrupt or delete the data, the owner should be able to detect the corruption or loss. Further, when a portion of the outsourced data is corrupted or lost, it can still be retrieved by the data users.

	== ~~Encryption~~ ==		== Enkripsi ==
	~~Some advanced~~ [[~~encryption~~]] ~~algorithms which have been applied into cloud computing increase the protection of privacy~~. ~~In a practice called~~ [[crypto-shredding]], ~~the keys can simply be deleted when there is no more use of the~~ data.		Beberapa algoritme [[enkripsi]] canggih yang telah diterapkan ke dalam komputasi awan meningkatkan perlindungan privasi. Dalam praktik yang disebut [[crypto-shredding]], kunci dapat dihapus begitu saja ketika tidak ada lagi penggunaan data.

	=== Attribute-based encryption (ABE) ===		=== Attribute-based encryption (ABE) ===
	[[Attribute-based encryption]] ~~is a type of~~ [[public-key encryption]] ~~in which the~~ [[~~secret key~~]] ~~of a user and the ciphertext are dependent upon attributes~~ (e.~~g. the country in which he lives, or the kind of subscription he has~~). ~~In such a system~~, ~~the decryption of a~~ ciphertext ~~is possible only if the set of attributes of the user key matches the attributes of the~~ ciphertext.		[[Attribute-based encryption]] adalah jenis [[public-key encryption]] di mana [[kunci rahasia]] pengguna dan teks sandi bergantung pada atribut (mis. jenis langganan yang dimilikinya). Dalam sistem seperti itu, dekripsi ciphertext hanya mungkin jika kumpulan atribut kunci pengguna cocok dengan atribut ciphertext.

	==== Ciphertext-policy ABE (CP-ABE) ====		==== Ciphertext-policy ABE (CP-ABE) ====
			Di CP-ABE, encryptor mengontrol strategi akses. Pekerjaan penelitian utama CP-ABE difokuskan pada desain struktur akses.
	~~In the~~ CP-ABE, ~~the~~ encryptor ~~controls access strategy~~. ~~The main research work of~~ CP-ABE ~~is focused on the design of the access structure~~.

	==== Key-policy ABE (KP-ABE) ====		==== Key-policy ABE (KP-ABE) ====
			Dalam KP-ABE, kumpulan atribut digunakan untuk mendeskripsikan teks terenkripsi dan kunci privat dikaitkan dengan kebijakan tertentu yang akan dimiliki pengguna.
	~~In the~~ KP-ABE, ~~attribute sets are used to describe the encrypted texts and the private keys are associated to specified policy that users will have~~.


	=== Fully homomorphic encryption (FHE) ===		=== Fully homomorphic encryption (FHE) ===
	Fully [[homomorphic encryption]] ~~allows computations on encrypted~~ data, ~~and also allows computing sum and product for the encrypted~~ data ~~without decryption~~.		Fully [[homomorphic encryption]] memungkinkan komputasi pada data terenkripsi, dan juga memungkinkan komputasi jumlah dan produk untuk data terenkripsi tanpa dekripsi.

	=== Searchable encryption (SE) ===		=== Searchable encryption (SE) ===
	Searchable encryption ~~is a cryptographic system which offer secure search functions over encrypted~~ data.		Searchable encryption adalah sistem kriptografi yang menawarkan fungsi pencarian aman atas data terenkripsi.
	SE ~~schemes can be classified into two categories~~: SE ~~based on secret-key~~ (~~or symmetric-key~~) ~~cryptography~~,		Skema SE dapat diklasifikasikan ke dalam dua kategori: SE berdasarkan kriptografi kunci rahasia (atau kunci simetris),
	~~and~~ SE ~~based on public-key cryptography~~.		dan SE berdasarkan kriptografi kunci publik.
	~~In order to improve search efficiency~~, symmetric-key SE ~~generally builds keyword indexes to answer user queries~~.		Untuk meningkatkan efisiensi pencarian, symmetric-key SE umumnya membuat indeks kata kunci untuk menjawab pertanyaan pengguna.

	==Compliance==		==Compliance==

Unknown user: /* Cloud Vulnerability and Penetration Testing */

2023-04-28T08:13:14Z

Cloud Vulnerability and Penetration Testing

← Older revision		Revision as of 08:13, 28 April 2023
Line 43:		Line 43:


	==== Cloud ~~Vulnerability and Penetration Testing~~ ====		==== Pengujian Kerentanan dan Penetrasi Cloud ====
	Scanning ~~could from outside and inside using free or commercial products is very important because without a hardened environment your service is considered as a soft target~~. ~~Virtual servers should be hardened like a physical~~ server ~~against~~ [[~~Data leakage prevention\|~~data ~~leakage~~]], malware, ~~and exploited vulnerabilities~~. "~~Data loss or leakage represents~~ 24.6% ~~and~~ cloud ~~related malware~~ 3.4% ~~of threats causing~~ cloud ~~outages”~~		Scanning dapat dari luar dan dalam menggunakan produk gratis atau komersial sangat penting karena tanpa lingkungan yang keras, layanan Anda dianggap sebagai sasaran empuk. Server virtual harus diperkuat seperti server fisik terhadap [[kebocoran data]], malware, dan kerentanan yang dieksploitasi. "Kehilangan atau kebocoran data mewakili 24,6% dan malware terkait cloud 3,4% dari ancaman yang menyebabkan pemadaman cloud"

	Scanning ~~and~~ penetration testing ~~from inside or outside the~~ cloud ~~require to be authorized by the~~ cloud ~~provider~~. ~~Since the~~ cloud ~~is a shared environment with other tenants following penetration testing rules of engagement step-by-step is a mandatory requirement~~. ~~Violation of~~ [https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement ~~acceptable use policy~~] ~~which can lead to termination of the service~~.		Scanning dan penetration testing dari dalam atau luar cloud perlu diotorisasi oleh penyedia cloud. Karena cloud adalah lingkungan bersama dengan penyewa lain, mengikuti aturan pengujian penetrasi langkah demi langkah adalah persyaratan wajib. Pelanggaran [https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement kebijakan penggunaan yang dapat diterima] yang dapat menyebabkan penghentian layanan.

	== Data security ==		== Data security ==

Unknown user: /* Security and privacy */

2023-04-28T08:10:36Z

Security and privacy

← Older revision		Revision as of 08:10, 28 April 2023
Line 34:		Line 34:
	==Security and privacy==		==Security and privacy==

	;Identity management :~~Every enterprise will have its own~~ [[identity management system]] ~~to control access to information and computing resources~~. ~~Cloud providers either integrate the customer’s identity management system into their own infrastructure~~, ~~using~~ [[Federated identity management~~\|federation~~]] or [[Single sign-on~~\|SSO~~]] ~~technology~~, ~~or a biometric-based identification system~~, ~~or provide an identity management system of their own~~. CloudID, ~~for instance~~, ~~provides privacy-preserving~~ cloud~~-based and cross-enterprise biometric identification~~. ~~It links the confidential information of the users to their biometrics and stores it in an encrypted fashion~~. ~~Making use of a searchable encryption technique~~, ~~biometric identification is performed in encrypted~~ domain ~~to make sure that the~~ cloud ~~provider or potential attackers do not gain access to any sensitive~~ data ~~or even the contents of the~~ individual ~~queries~~.		;Identity management :Setiap perusahaan akan memiliki [[identity management system]] sendiri untuk mengontrol akses ke informasi dan sumber daya komputasi. Penyedia cloud mengintegrasikan sistem manajemen identitas pelanggan ke infrastruktur mereka sendiri, menggunakan teknologi [[Federated identity management]] atau [[Single sign-on]], atau sistem identifikasi berbasis biometrik, atau menyediakan manajemen identitas sistem mereka sendiri. CloudID, misalnya, menyediakan identifikasi biometrik berbasis cloud dan lintas perusahaan yang menjaga privasi. Ini menghubungkan informasi rahasia pengguna ke biometrik mereka dan menyimpannya dengan cara terenkripsi. Memanfaatkan teknik enkripsi yang dapat dicari, identifikasi biometrik dilakukan dalam domain terenkripsi untuk memastikan bahwa penyedia cloud atau penyerang potensial tidak mendapatkan akses ke data sensitif apa pun atau bahkan konten dari query individual.

	;Physical security :~~Cloud service providers physically secure the IT~~ [[~~Computer hardware\|hardware~~]] (~~servers~~, ~~routers~~, ~~cables etc~~.) ~~against unauthorized access~~, ~~interference~~, ~~theft~~, ~~fires~~, ~~floods etc~~. ~~and ensure that essential supplies~~ (~~such as electricity~~) ~~are sufficiently robust to minimize the possibility of disruption~~. ~~This is normally achieved by serving~~ cloud ~~applications from~~ 'world-class' (i.~~e. professionally specified~~, ~~designed~~, ~~constructed~~, ~~managed~~, ~~monitored and maintained~~) data ~~centers~~.		;Physical security :Penyedia layanan cloud secara fisik mengamankan TI [[perangkat keras]] (server, router, kabel, dll.) dari akses tidak sah, gangguan, pencurian, kebakaran, banjir, dll. dan memastikan bahwa persediaan penting (seperti listrik) cukup kuat untuk meminimalkan kemungkinan gangguan. Hal ini biasanya dicapai dengan melayani aplikasi cloud dari data center 'world-class' (yaitu yang ditentukan secara profesional, dirancang, dibangun, dikelola, dipantau, dan dipelihara).

			;Personnel security :Berbagai masalah keamanan informasi yang berkaitan dengan TI dan profesional lain yang terkait dengan layanan cloud biasanya ditangani melalui aktivitas pra, para, dan pasca kerja seperti penyaringan keamanan calon karyawan, kesadaran keamanan, dan program pelatihan, proaktif.

			;Privacy :Penyedia memastikan bahwa semua data penting (nomor kartu kredit, misalnya) [[data masking]] atau dienkripsi dan hanya pengguna yang berwenang yang memiliki akses ke data secara keseluruhan. Selain itu, identitas dan kredensial digital harus dilindungi seperti halnya data apa pun yang dikumpulkan atau dihasilkan oleh penyedia terkait aktivitas pelanggan di cloud.

	;Personnel security :Various information security concerns relating to the IT and other professionals associated with cloud services are typically handled through pre-, para- and post-employment activities such as security screening potential recruits, security awareness and training programs, proactive.
	;Privacy :Providers ensure that all critical data (credit card numbers, for example) are [[data masking\|masked]] or encrypted and that only authorized users have access to data in its entirety. Moreover, digital identities and credentials must be protected as should any data that the provider collects or produces about customer activity in the cloud.

	==== Cloud Vulnerability and Penetration Testing ====		==== Cloud Vulnerability and Penetration Testing ====

Unknown user: /* Dimensions of cloud security */

2023-04-28T08:05:20Z

Dimensions of cloud security

← Older revision		Revision as of 08:05, 28 April 2023
Line 29:		Line 29:
	:Kontrol korektif mengurangi konsekuensi dari suatu insiden, biasanya dengan membatasi kerusakan. Mereka mulai berlaku selama atau setelah insiden. Memulihkan cadangan sistem untuk membangun kembali sistem yang disusupi adalah contoh kontrol korektif.		:Kontrol korektif mengurangi konsekuensi dari suatu insiden, biasanya dengan membatasi kerusakan. Mereka mulai berlaku selama atau setelah insiden. Memulihkan cadangan sistem untuk membangun kembali sistem yang disusupi adalah contoh kontrol korektif.

	==~~Dimensions of~~ cloud security==		==Dimensi dari cloud security==
			Umumnya direkomendasikan bahwa kontrol keamanan informasi dipilih dan diterapkan sesuai dan sebanding dengan risiko, biasanya dengan menilai ancaman, kerentanan, dan dampaknya. Masalah keamanan cloud dapat dikelompokkan dalam berbagai cara; Gartner menamai tujuh [[Cloud access security broker]] (CASB) adalah perangkat lunak yang berada di antara pengguna cloud dan aplikasi cloud untuk memberikan visibilitas ke dalam penggunaan aplikasi cloud, perlindungan data, dan tata kelola untuk memantau semua aktivitas dan menegakkan kebijakan keamanan.
	~~It is generally recommended that information security controls be selected and implemented according and in proportion to the risks~~, ~~typically by assessing the threats~~, ~~vulnerabilities and impacts~~. ~~Cloud security concerns can be grouped in various ways~~; Gartner ~~named seven~~ [[Cloud access security broker]]s (~~CASBs~~) ~~are software that sits between~~ cloud ~~users and~~ cloud ~~applications to provide visibility into~~ cloud ~~application usage~~, data ~~protection and governance to monitor all activity and enforce security policies~~.

	==Security and privacy==		==Security and privacy==

Unknown user: /* Further reading */

2023-04-28T08:04:15Z

← Older revision		Revision as of 08:04, 28 April 2023
Line 111:		Line 111:

	== Further reading ==		== Further reading ==
	*{{cite journal\|ref=harv\|title=The Fog over the Grimpen Mire: Cloud Computing and the Law\|first=Miranda\|last=Mowbray\|year=2009\|volume=6\|issue=1\|journal=SCRIPTed\|page=129\|url=http://www.law.ed.ac.uk/ahrc/script-ed/vol6-1/mowbray.asp}}
	*{{cite book\|ref=harv\|title=Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance\|first1=Tim\|last1=Mather\|first2=Subra\|last2=Kumaraswamy\|first3=Shahed\|last3=Latif\|publisher=O'Reilly Media, Inc.\|year=2009\|isbn=9780596802769}}
	*{{cite book\|ref=harv\|title=Securing the Cloud: Cloud Computer Security Techniques and Tactics\|first1=Vic\|last1=Winkler\|publisher=Elsevier\|year=2011\|isbn=9781597495929}}
	*{{cite book\|ref=harv\|title=Securing the Virtual Environment: How to Defend the Enterprise Against Attack\|first1=Davi\|last1=Ottenheimer\|publisher=Wiley\|year=2012\|isbn=9781118155486}}
	*{{cite journal\|title=CloudID: Trustworthy Cloud-based and Cross-Enterprise Biometric Identification\|first=Mohammad\|last=Haghighat\|year=2015\|volume=42\|issue=21\|journal=Expert Systems with Applications\|pages=7905–7916\|doi=10.1016/j.eswa.2015.06.025}}
	* [http://www.iso.org/iso/catalogue_detail?csnumber=43757 BS ISO/IEC 27017]: "Information technology. Security techniques. Code of practice for information security controls based on ISO/IEC 27002 for cloud services." (2015)		* [http://www.iso.org/iso/catalogue_detail?csnumber=43757 BS ISO/IEC 27017]: "Information technology. Security techniques. Code of practice for information security controls based on ISO/IEC 27002 for cloud services." (2015)
	* [http://www.iso.org/iso/catalogue_detail.htm?csnumber=61498 BS ISO/IEC 27018]: "Information technology. Security techniques. Code of practice for protection of [[personally identifiable information]] (PII) in public clouds acting as PII processors." (2014)		* [http://www.iso.org/iso/catalogue_detail.htm?csnumber=61498 BS ISO/IEC 27018]: "Information technology. Security techniques. Code of practice for protection of [[personally identifiable information]] (PII) in public clouds acting as PII processors." (2014)