What Should You Look For In A Cloud Security Vendor?

Cloud Security Vendor

Protecting the security of your cloud data during its transmission, storage, and access is an ongoing, fundamental concern as technology continues to evolve, intrusion possibilities increase, and BYOD becomes more common. Here are the five areas to consider when evaluating how the security of your cloud vendor stacks up.

How is My Data Physically Protected?

Any potential problem or threat to the physical data center should be covered from every angle, with continual and back up protection plans in place. Environmental controls should be systematic through proactive care and maintenance of the data center, including fire detection and suppression systems, climate and temperature controls, and 24/7 electrical power with redundancy and generator backup. It also means consistent identification and problem resolution for electrical, mechanical, and other systems for ongoing equipment operability.

How do I know Transmission Over the Network is Secure?

Encryption for data in transit over the network should be at the most advanced level—such as 256-bit SSL—and include enterprise-grade security measures over networks without WAN or VPN controls (like many companies these days). Additionally, advanced network security protection such as unique key management functionality is recommended.

How is My Data Protected in the Cloud?

Data stored in the cloud should be protected with the strictest authentication and access controls. Stored data should be encrypted, such as with 256-bit AES.

When it comes to file retention and version control, the customers should be able to enforce their own retention policies. They should also be able to remove access for single accounts if desired. This means that if a hacker gains access to the data of one company, they do not gain access to any other companies’ data. Customer access to data should be controlled by 2-factor encryption. Data compartmentalization schemes ideally utilize a multi-pronged segregation approach, with the following types of measures in place: access credentials, customer meta data with the use of S3 buckets and unique 256 AET encryption keys.

How is Data Access Managed?

The need of users to retrieve data must be weighed against the security of data access itself. Access to data should require single sign-on with SAML 2.0, as well as multi-step authentication, such as two-factor encryption-based credentials and use of a different PIN entry each time.

Access controls by the customer should also be available by different and separate admin roles, such as a server or profile administrator, based on their responsibility for data access. The cloud vendor should not have any access to the company’s data unless expressly permitted by the customer.

The customer should be able to set access controls for different roles, such as server or profile administrator, based on their responsibility for data access.

In order to provide transparency and accountability, there should be a complete audit trail of all data access activity available.

What Happens to Data if a Disaster or Failure Occurs?

In case of disaster such as power or other data center failure, service levels and data access should still be maintained. This can be achieved with data redundancy controls, such as having separate data centers clustered in key global regions and multi-zone redundancy in case failure occurs in any one zone.

No matter how cloud technology changes, end-to-end data protection is a must. Find out how your cloud vendor secures its data from all points.

By Srivatsan Srinivasan, Senior Product Marketing Manager at Druva.

Kayla Matthews

40% of Organizations Are Leaving Office 365 Data Vulnerable

Office 365 Data Vulnerable Microsoft Office 365 is a popular platform for individuals and organizations alike. But, recent research shows many organizations are apparently too ...
Bruce Guptill

Resolving IT-Finance Asynchronization on Cloud Improvements

Resolving IT-Finance Asynchronization While CIO-CFO communications and alignment may never seem better, what is considered to be C-level, strategic “alignment” increasingly obscures realities that keep ...
Martin Mendelsohn

New Executive Roles in the Post-Corona Era

Executive Roles in the Post-Corona Era As the global economy shows early signs of reviving from past months of rigormortis, forward-looking companies will be busy ...
Sam Bowman

Medical Data Online: What Are the Risks?

Medical Data in the Cloud Executive-level healthcare leaders must have a thorough understanding of cloud-based security risks. Patient data can vary from simple information such ...
Brian Day

Tips for Developing Apps In a Cloud Environment

DevOps and the Cloud Unless you’ve just started a brand-new organization, your IT environment is currently running a diverse collection of last-generation and older applications ...
Suraj Gupta

The Rise of the “Ecosystem of Ecosystems”

Ecosystems Emergence Even during these uncertain times, once fierce competitors are now collaborating and co-existing to not only survive, but thrive. Salesforce is partnering with ...
Garry Connolly

Data Policy is Fundamental for Trust

Data Policy Trust Consumers once owned and protected their data independent of anyone else. Handwritten letters, paper bank statements, medical records locked up in a ...
Or Lenchner

Destination IPPN: why the travel sector must harness a global IP proxy network

Destination IPPN While massive growth in the travel sector has been predicted, the digital environment has also massively upped competition amongst service providers, keen to ...
Ajay

Explainable Intelligence Part 1 – XAI, the third wave of AI

Explainable Intelligence Artificial Intelligence (AI) is democratized in our everyday life. Tractica forecasts the global artificial intelligence software market revenues will grow from around 9.5 billion US ...
Gilad David Maayan

Leveraging Managed Kubernetes to Improve Your Operations

Leveraging Managed Kubernetes Kubernetes simplifies container orchestration, but sometimes companies are struggling with Kubernetes adoption. Many organizations do not have the required expertise to configure ...