[VIDEO] Forget about SAS-70 You Want a SOC 2 Report for Cloud Security

certainly there's uh public and private vendors and some of them may be proprietary and some may have open source whether it's open stack or otherwise is there um any kind of direct involvement that the CSA can have in an open source organization say open stack so you can influence the development perhaps of a cloud platform so that from the ground up from the code up it can be compliant uh with the policies and the Matrix and it's built from the ground up to be uh everything it should be we don't take a position on whether open source or commercial software is better for building clouds we just say that we believe that there's a representative set of controls that every cloud provider should run that's a cloud controls metrix and it's up to them to demonstrate their ability to do so regardless of the technology that they use under the hood even so-called open source clouds will use commercial technology VI it firewalls routers switches balancers whatever uh even micro codee in the the computers themselves there there's no such thing as a truly open Cloud with commercial products in there somewhere uh and the open stack initiative is largely geared towards infrastructure of service anyway so it's not truly applicable as a platform and soft service and at the end of the day anyway uh it's not so much about how you actually build or constructive cloud and reviewing the source code and convincing yourself as a consumer that it's a secure Cloud it's about taking thep dependent certification and testation from your uh Auditors that you trust that that cloud provider is doing the right thing got it

This transcript was generated automatically from the video's captions and may contain errors.