Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Emerging Technology Risk: Cloud, IoT and OT
Technologies and their risks
Cloud shared responsibility
Assessing before adoption
- What business need does it serve?
- What data and processes will it touch?
- What new threats and dependencies does it bring?
- Do we have the skills to run it securely?
- Is the risk within appetite, and who owns it?
Example. A manufacturer planned to connect plant controllers to the cloud for analytics. The risk assessment showed a compromise could stop production lines. The design was changed to a one-way data flow from OT to the cloud.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| MOST common cause of cloud breaches | Customer misconfiguration |
| Main concern when connecting OT to IT | Physical and safety impact |
| BEST control for IoT devices | Inventory and network segmentation |
| FIRST step with a new technology | Assess the risk before adoption |
In short
- Every new technology brings opportunity and characteristic risks; assess them before adoption.
- Cloud risk centres on shared responsibility, misconfiguration and concentration.
- IoT devices are often weak, hard to patch and numerous; inventory and segment them.
- Operational technology failures can cause physical and safety harm; changes need special care.
- Quantum computing is a future threat to public-key cryptography; planning starts with a crypto inventory.
Exam traps
- Assuming the cloud provider handles all security.
- Connecting OT systems to corporate networks without assessing safety impact.
- Letting IoT devices onto the network without inventory or segmentation.
- Ignoring long-term risks such as quantum because they seem distant.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Technologies and their risks
Cloud shared responsibility
1 / 7