Company XYZ provides hosting services for hundreds of companies across multiple industries including healthcare, education, and manufacturing. The security architect for company XYZ is reviewing a vendor proposal to reduce company XYZ's hardware costs by combining multiple physical hosts through the use of virtualization technologies. The security architect notes concerns about data separation, confidentiality, regulatory requirements concerning PII, and administrative complexity on the proposal. Which of the following BEST describes the core concerns of the security architect?

Question

Accepted Answer

C. Company XYZ could be liable for disclosure of sensitive data from one hosted customer When customers from healthcare, manufacturing, and education share the same physical hosts through virtualization, a hypervisor vulnerability, misconfigured VLAN, or storage misconfiguration could allow one tenant's sensitive data to be accessed by another. This exposes Company XYZ to direct legal liability, particularly because healthcare customers are subject to HIPAA requirements for PHI/PII protection that the hosting provider must contractually and technically enforce. The core concern is that the provider becomes accountable for data separation failures that violate each customer's specific regulatory obligations.

Answer

A. Most of company XYZ's customers are willing to accept the risks of unauthorized disclosure Regulated customers such as healthcare organizations cannot simply accept unauthorized disclosure risks; legal frameworks like HIPAA impose mandatory protections regardless of a customer's stated risk tolerance.

Answer

B. The availability requirements in SLAs with each hosted customer would have to be re-written SLA availability requirements may need updating, but this is a secondary operational concern compared to the immediate confidentiality and regulatory liability risk posed by cross-tenant data exposure.

Answer

D. Not all of company XYZ's customers require the same level of security and the administrative Differing security requirements and administrative complexity are real operational challenges but are secondary to the core concern of legal liability from cross-customer data disclosure in a regulated multi-tenant environment.

Company XYZ provides hosting services for hundreds of companies across multiple industries including healthcare, education, and manufacturing. The security architect for company XYZ is reviewing a…

Question

Options

How the community answered

Why each option

Topics

Community Discussion