As enterprise data no longer rests solely within the enterprise data center and the transition to cloud is inevitable, organizations are addressing Cloud computing from a Security and Privacy perspective. Security is often perceived as one of the largest inhibitors for moving to the cloud. During the Innovate IT Conference 2012 I had the opportunity to give a keynote presentation in which I addressed the security challenges of the cloud by highlighting 5 principles for crafting a security strategy for the cloud.
Besides personal data, organizations often deal with Intellectual Property material. This information should not be accessible for competitors and therefore moving this kind of data outside the organization – to the “open” and “accessible” Cloud – many organizations rank Cloud computing as the highest level risk implementations in terms of Security and Privacy.
Security craftsmanship
The main concerns for many organizations who are on a journey of implementing Cloud computing are related to the high level risk implementations in terms of Security and Privacy. So, is it safe to use the Cloud when it comes to the security of your corporate data? Despite the perception of Security, Privacy and Audit departments, Cloud may be the best thing that ever happened for security. I personally believe that the majority of organizations can improve the security of their data by moving to the Cloud.
Most companies and institutions are not particularly specialized in information security. To secure the data entrusted to the Cloud and properly address secure cloud solutions, organizations need five principles for crafting a security strategy for the cloud:
- Know your appetite for privacy and security risk: in the end security is all about Risk Management. Does your organization understand the risks and are they willing to take risks? Do you have a Risk Management Framework? And what applications do you entrust to the Cloud?
- Expect to share responsibility: the Cloud market is rapidly maturing and it is moving away from a one-size fits all approach. Service providers are willing to discuss and share the risk and data owners must bear the legal obligations. Therefore organizations must choose a cloud model that works for them: Iaas, Paas or Saas.
- Demand transparency and accountability from cloud providers: depending on the cloud model you choose, sharing responsibilities requires reasonable transparency and accountability from providers. But organizations can benefit from a good Cloud service provider, who has an extensive worked out security policy and specialized security employees most organizations don’t have.
- Use the cloud to solve identity and access management issues: if you want to reap the benefits of the cloud, you need to move your access management to the cloud. Authenticate people, but tie privileges to roles, not applications.
- Architect solutions that address the risk: most organizations use a form of Hybrid models. But implementing security can be done through a blend of methods incl. considering multiple cloud vendors and data encryption.
Encrypt your data
The encryption of data will play a big role around Cloud and will be part of the cloud offering in the nearby future. To secure the data entrusted to the Cloud and properly address secure cloud solutions, organizations must encrypt all their critical information sources. When only people who have been granted access can decipher the encryption, data can safely be stored anywhere.
An upcoming trend is that organizations are using security services from the Cloud to secure not only data in the cloud but also the data located on their servers. For example, some anti virus and malware detection providers are no longer using client based databases of virus signatures but rather use a cloud based service to ensure the latest information is available at all times. So rather than see cloud as a threat for security, security professionals should embrace the cloud and in some cases even look for the cloud to assist in securing their on-premise data.
