subject: Security In The Cloud - Checking Out A Provider [print this page] An increasing number of businesses and organisations are taking to the cloud to store their data and host their applications. With the right provider, the cloud can offer many potential benefits: security, reliability, efficiency and cost reduction. Alternatively, choosing the wrong provider will almost certainly have negative consequences.
To avoid the latter scenario, it's important to choose a provider which adheres to best practice standards in all areas of its business, especially where security is concerned. Specifically, you should check out the people, processes and technology which make up the business.
People
Various investigations into the subject of data breaches suggest that people are by far the weakest point in the security chain. Predominantly errors are caused by carelessness rather than malice, but this doesnt mean deliberate actions should be overlooked. To gain an understanding of the people within a providers business, and ultimately the people responsible for keeping your data secure, you should always ask the following questions:
What vetting processes does the provider employ?
Are the staff well trained and reliable, with specifically assigned roles?
Is internal access restricted appropriately?
Processes
While people make up a business, it cant run efficiently without the right processes in place. Its essential to ask a provider if the processes it employs support the intention to provide a secure environment. You should ask the following questions:
Do they employ the right processes?
What access control is in place - both technical and physical?
How thorough is their security auditing? Do they employ penetration testing, for example?
Do passwords follow best practice? Passwords should be regularly changed, and not based on easy to guess combinations such as birthdays, sequential numbers etc.
Technology
You need to be sure that a provider is implementing a compliance-oriented architecture to minimise the risk of unauthorised data access, data loss and improve data protection and recovery measures. Also important is the level of encryption the provider employs, for offsite backup, data in storage and in transit. Questions to ask are:
Do they have a history of loopholes and bugs?
How resilient are the systems?
Does the infrastructure support security claims?
How is backup implemented? Is data replicated? Is data backed up in multiple, geographically distant locations?
Service
Having considered the areas above, there are also questions to ask in relation to the service itself: data needs to be secure, but it also needs to be available. Where service is concerned, ask a provider the following:
What are the terms and conditions of the contract youre signing up to? Do they provide uptime guarantees?
How easy is to retrieve your data by source, such as legal and financial emails?
Can you retrieve your data by type?
Does the provider allow third party security audits?
What are the retention and recovery policies?
Adopting a hosted solution is more or less inevitable for most organisations nowadays, be it using a fully managed cloud services, or colocating servers. While technological and cost benefits are a major draw, security remains a real concern. Next time you meet with a cloud services provider be sure to ask them about the points raised within this article.
