Demystifying cloud computing security
by Mirko Zorz - Monday, 10 October 2011.
What tips would you give to an organization considering migrating to a cloud computing solution for mission-critical IT services? Furthermore, to what degree will they have to reorganize their overall approach to risk management?

Treat the use of public clouds like any other outsourced activity: check cloud provider references, review their policies, and make sure that all of your key requirements (such as SLAs, backup and disaster recovery, encryption, change and configuration processes, privileged user monitoring and auditing, etc.) are specified in your contract with them.

You should also audit your cloud provider periodically, but this may be more difficult with larger and well-established cloud providers, in which case youíll need to rely on 3rd-party audits such as SAS70. The SAS 70 audit verifies the functionality of a service organizationís control activities and processes, but keep in mind that SAS 70 itself does not specify a pre-determined set of control objectives that service organizations must achieve -- so make sure their documented controls meet all of your organizationís specific requirements.

Based on your experience, how long and potentially burdensome is the adaptation period for a company that switched its entire IT services to the cloud?

Most organizations are taking a phased approach. For example, they might migrate to SaaS offerings for CRM, email or blogging while retaining other business-critical applications in-house, such as ERP and financials. Many organizations are also using public clouds for less-critical test and development functions.

Migrating to an in-house virtualized infrastructure is also a good initial step, for both large and small organizations, because virtualization is now a relatively mature technology that delivers the many of the flexibility and resource utilization benefits of cloud while still allowing a large degree of control over security. Many larger enterprises are also moving beyond virtualization to offer private cloud services to their business users, in which automated self-service and metering technologies are layered over their virtualized infrastructures for added agility and convenience.

For start-up organizations with limited capital and people resources to build their own IT infrastructures, especially those in high-tech domains such as social media or mobility, it may make more sense to use public clouds exclusively from Day 1. If you choose this path, you still might want to adopt a hybrid approach in which your most sensitive data Ė high value assets such as intellectual property, proprietary plans or product designs, that, if compromised by cyber-criminals or insiders in the cloud provider organization, would significantly impact the firm Ė are retained in-house.

Spotlight

How to talk infosec with kids

Posted on 17 September 2014.  |  It's never too early to talk infosec with kids: you simply need the right story. In fact, as cyber professionals itís our duty to teach ALL the kids in our life about technology. If we are to make an impact, we must remember that children needed to be taught about technology on their terms.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Sep 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //