3 Keys To Keep Enterprise Clouds Secure

3 Keys To Keep Enterprise Clouds Secure

3 Keys To Keep Enterprise Clouds Secure

Outsourcing has won out over ownership, and the rush to the cloud continues to gather pace. Where security is concerned there are two major trends that threaten to expose your company to unnecessary risk. There’s a lack of planning and due diligence when choosing cloud providers, and there’s a murky grey area when it comes to responsibility. They can both be mitigated by building security planning into your system from the start, instead of trying to retro-fit.

enterprise-cloudThere are standards that can be applied to inform your planning, and help you to assess the maturity of your security model. The Cloud Controls Matrix (CCM) by the Cloud Security Alliance seeks to uncover a set of fundamental security principles that you can use to assess your prospective cloud providers, or, if you’re a cloud vendor, to guide your development and enable you to tick all those vital security boxes for customers.

Evaluating cloud provider security

When shopping for a cloud partner there’s a lot to consider and you should use something like the CCM to drill down into the details. Looking at the bigger picture, you need to address a lot of potential security risks.

Before you start to build out a security plan, probably drawing on your existing governance, risk and compliance processes, take time to analyze your data and identify all of your assets. Data classification and discovery is often overlooked and good security is about protecting everything, not just whatever is in your line of sight.

Ask any prospective cloud provider to produce detailed documentation on their setup. A complete set of terms should be hammered out in your Service Level Agreement (SLA) that covers every potential eventuality down the line. This will protect you and establish levels of responsibility. You should be clear on data encryption in transit and storage, compliance and legal exposure, levels of authentication, and what happens in the event of service breakdown.

It’s important to understand exactly what control you are ceding to an external party. Try to avoid the vendor lock-in that typically accompanies proprietary software, there are plenty of good applications and services out there that meet industry standards and deliver the functionality you need. You can also leverage more value from your existing tools and systems by investigating their security capabilities; you may find that you aren’t maximizing the potential of what you already have.

Consider how the system will be managed and how security incidents are handled. Is there a mechanism in place to detect and report security breaches? Without it, you simply don’t know how secure your system is.

Changing roles, who’s responsible for this?

Separate internal security teams are a thing of the past, those responsibilities are typically being infused within infrastructure and network administration roles. There’s a danger when this occurs that too much responsibility is being heaped onto already overburdened shoulders. Is the necessary expertise there? Are roles and responsibilities clearly defined? Do your internal employees have the mechanisms of control in place?

There could be an easy answer to this. If you’re prepared to outsource your data or application delivery and management, then why treat security any differently?  A dedicated external team with the correct expertise can own your security model and ensure that it meets high standards across the board, from compliance and governance, to privacy policy, auditing, data protection, and beyond.

Whether you need to adhere to ISO 27001/27002 or NIST compliance standards, you can bet that a dedicated external cloud security team working with these frameworks daily is going to have a better handle on them than internal staff with divided responsibilities. An external audit can document gaps in your system and give you a realistic snapshot of your risk. Before you can control and mitigate risks, you need to understand what they are.

Building a solid foundation

The shift to the cloud is not a one-off process, it’s a fluid evolution, and so establishing a model for your plan which can inform everything that comes later is important. You’re not looking to find that one perfect solution, you’re trying to adopt an approach and a set of standards that will ensure security beyond the horizon. Achieving a high level of security with your private or public cloud services and applications is easier and cheaper if you start right.

Make sure that boat is seaworthy before you launch, because finding and plugging leaks when you’re out in the middle of the ocean is asking for trouble.

Michelle-Drolet

By Michelle Drolet,

Michelle is the founder of Towerwall (www.towerwall.com) a data security services provider in Framingham, MA with clients such as PerkinElmer, Smith & Wesson, Middlesex Savings Bank, Brown University and SMBs. You may reach her at michelled@towerwall.com.

About CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in connected technology information and services.

We embrace and instill thought leadership insights, relevant and timely news related stories, unbiased benchmark reporting as well as offer green/cleantech learning and consultive services around the world.

Our vision is to create awareness and to help find innovative ways to connect our planet in a positive eco-friendly manner.

In the meantime, you may connect with CloudTweaks by following and sharing our resources.

View All Articles

Sorry, comments are closed for this post.

Ending The Great Enterprise Disconnect

Ending The Great Enterprise Disconnect

Five Requirements for Supporting a Connected Workforce It used to be that enterprises dictated how workers spent their day: stuck in a cubicle, tied to an enterprise-mandated computer, an enterprise-mandated desk phone with mysterious buttons, and perhaps an enterprise-mandated mobile phone if they traveled. All that is history. Today, a modern workforce is dictating how…

Digital Twin And The End Of The Dreaded Product Recall

Digital Twin And The End Of The Dreaded Product Recall

The Digital Twin  How smart factories and connected assets in the emerging Industrial IoT era along with the automation of machine learning and advancement of artificial intelligence can dramatically change the manufacturing process and put an end to the dreaded product recalls in the future. In recent news, Samsung Electronics Co. has initiated a global…

How The CFAA Ruling Affects Individuals And Password-Sharing

How The CFAA Ruling Affects Individuals And Password-Sharing

Individuals and Password-Sharing With the 1980s came the explosion of computing. In 1980, the Commodore ushered in the advent of home computing. Time magazine declared 1982 was “The Year of the Computer.” By 1983, there were an estimated 10 million personal computers in the United States alone. As soon as computers became popular, the federal government…

Why Security Practitioners Need To Apply The 80-20 Rules To Data Security

Why Security Practitioners Need To Apply The 80-20 Rules To Data Security

The 80-20 Rule For Security Practitioners  Everyday we learn about yet another egregious data security breach, exposure of customer data or misuse of data. It begs the question why in this 21st century, as a security industry we cannot seem to secure our most valuable data assets when technology has surpassed our expectations in other regards.…

Cloud Services Providers – Learning To Keep The Lights On

Cloud Services Providers – Learning To Keep The Lights On

The True Meaning of Availability What is real availability? In our line of work, cloud service providers approach availability from the inside out. And in many cases, some never make it past their own front door given how challenging it is to keep the lights on at home let alone factors that are out of…

Protecting Devices From Data Breach: Identity of Things (IDoT)

Protecting Devices From Data Breach: Identity of Things (IDoT)

How to Identify and Authenticate in the Expanding IoT Ecosystem It is a necessity to protect IoT devices and their associated data. As the IoT ecosystem continues to expand, the need to create an identity to newly-connected things is becoming increasingly crucial. These ‘things’ can include anything from basic sensors and gateways to industrial controls…