The tabloids are abuzz with tales of hackers stealing salacious celebrity selfies stored on the Cloud, and of course the furor dies with next week’s issue of People Magazine.
The thought of Cloud based business data being compromised is a different matter, and you’re right to be concerned about ubiquitous computing resulting in ubiquitous hacking attempts. Fortunately, efforts to secure the cloud are maintaining the pace of the unprecedented growth of the cloud itself.
Now for the good news
The need to modify infrastructure to meet the alphabet soup of compliance regulations (SOX, GLB, HIPPA, FISMA) is already a reality to the vast majority of enterprises, and valuable time and resources are used that take away from their core business efforts. The good news is that security is one more IT function outsourced to your Cloud Service Provider, and that the provider has more resources to deal with security than your business. The learning curve that comes with the design, implementation, and maintenance of data security (which most enterprises already are involved in) are the responsibility of the service provider, who deals with them on a daily basis.
The benefit of delegating this responsibility to the Cloud Service Provider will increase in value as regulation becomes more exacting in implementation and scope. According to a survey by the nonprofit Cloud Security Alliance, 73 percent of respondents call for a Global Consumer Bill of Rights concerning Data privacy. Anyone who has dealt with modifying their infrastructure for data privacy knows the value of outsourcing the details of this effort!
Who’s setting the standards?
As cloud technology matures, so do best practices and standards. The Cloud Security Alliance promotes "the use of best practices for providing security assurance within Cloud Computing". The Board of Directors includes CXOs of Microsoft, Coca Cola, Sallie Mae and Zynga. The CSA’s Cloud Controls Matrix contains 269 standards covering every aspect of Cold Security implementation, operation and maintenance, including Data Security, Audit Assurance, Business Continuity, and Access, Threat & Vulnerability Management. The standards document is available here.
What Questions should I ask of a Cloud Service Provider?
In short, your expectations for a Cloud Provider are the same as those you are expected to implement in the traditional IT space. The Financial Times of London recommends asking the following:
- Where is the Physical location of the data?
- Who has access the data?
- How is data encrypted and authenticated?
- What policies are in place to handle security breaches?
- What are your procedures for transferring service to another provider should that be necessary?
In Conclusion
The evidence of the benefits of Cloud Computing are overwhelming, and the marketplace has responded. According to iCorps Technologies, 2014 is the first year the majority of computing workloads take place in the cloud (51 percent versus 49 percent in the traditional IT Space).
If you are working in the tradition IT space, you are already dealing with security issues, and with the pain of a learning curve. As Cloud computing becomes the rule and not the exception, security issues will migrate to providers with resources and expertise beyond that of most organizations -- and give you one less thing to worry about.
Kirill Bensonoff is a founding partner at ComputerSupport.com. He is responsible for delivering technology solutions, driving customer satisfaction, maintaining the culture of innovation as well as overseeing the strategic direction of the company and building business relationships. Kirill has utilized his unique blend of skills and expertise in IT, business strategy and customer service to drive ComputerSupport’s growth.