Which of the following would be considered an example of insufficient due diligence leading to security or operational problems when moving to a…

Insufficient due diligence involves a failure to adequately investigate and understand the operational and security paradigm of the cloud before migration. Relying on physical, on-premises network controls for a cloud environment demonstrates a fundamental misunderstanding of the cloud's shared responsibility model and its reliance on virtualized, software-defined security controls. This oversight can lead to significant security gaps, as traditional perimeter defenses are ineffective for protecting workloads in a public cloud infrastructure, which is a direct result of poor pre-migration analysis.

A. Monitoring: Monitoring is an operational activity, not a failure of pre-migration investigation. A lack of a monitoring plan could be a due diligence failure, but monitoring itself is not.

B. Use of a remote key management system: This is often a security best practice and a result of good due diligence, demonstrating a conscious decision to maintain control over encryption keys.

C. Programming languages used: The choice of a programming language is a development decision, not a direct indicator of a failure in the security and operational due diligence process for cloud adoption.

1. National Institute of Standards and Technology (NIST). (2011). Special Publication 800-144: Guidelines on Security and Privacy in Public Cloud Computing. Section 5.2.2, "Network Security," discusses the shift from physical network controls to logical, virtualized controls in the cloud, stating organizations must "rely on the cloud provider for the physical network infrastructure security" (p. 17).

2. Cloud Security Alliance (CSA). (2017). Security Guidance for Critical Areas of Focus in Cloud Computing v4.0. Domain 1, "Cloud Computing Concepts and Architectures," emphasizes the abstraction of physical infrastructure and the need to adapt security controls accordingly (p. 20-21).