MVision Cloud Multi-tenancy Risk Rating

[clath13]

Hello,

When determining a Risk Rating for a site in MVision Cloud one of the criteria is Multitenancy - specifically "does the cloud service provider support a multi-tenant offering?"  The ranking algorithm gives a Yes answer 10 and a No answer 70.  I'm trying to figure out several things from this.

1.  What is the alternative to multi-tenancy in the McAfee world?  I'm assuming it is single tenancy.

2.  If it is single tenancy, why would a "No" answer to whether a provider supports multi-tenancy contribute to a higher risk rating - I would think it would be the opposite.

3.  Is the risk rating just flat out wrong and they have it backwards?  Should it really be a Yes answer = 70 and a No answer = 10?

Thanks

[clath13 · Accepted solution]

Spoke to a PM at McAfee and the logic is correct.  They feel that single tenancy has more inherent risk than multi-tenancy because the multi-tenant vendor has a vested interest in properly configuring and securing their multi-tenant environment.  Whereas a single tenant offering is controlled and secured by the end-user (?)

I did not say their argument was sound - I'm just saying they feel their logic is correct.  So in McAfee world Multi-tenant gets 10 risk points in their algorithm and single tenant gets 70.