TMCnews Featured Article

For the last year, security professional have been bombarded by questions about cloud security. The recent Google (News - Alert)/ China incident has increased the volume of questions and given articles like “China, Google and the Cloud Wars” by the Wall Street Journal and others, the question of security the cloud is not in the forefront. After the onset of inquiries, the following top 10 list for cloud security recommendations was created.

1. Those exploring cloud solutions should establish their risk appetite and evaluate offerings against it.

2. Companies looking for cloud solutions should establish a cloud provider security risk profile and update it at least annually.

3. Those exploring cloud solutions should use a risk vector analysis matrix to evaluate cloud providers and those served by the same cloud vendor.

4. Make sure you evaluate the security program for cloud computing vendors up front and use it to narrow down potential vendors.

5. Ensure your contract with the cloud provider includes ongoing security reviews and language mandating immediate notification (within 24 hours) of serious security events.

6. Review the cloud provider’s HR and supply chain practices and employee background check process and hardware/software/equipment sourcing security needed to reduce threats.

7. Know the names of all other organizations supported by the cloud so that you can assess any increased risks they may bring.

8. Use common controls reviews based on the ISO 27000 and 28000 standards to reduce the assurance burden.

9. Address in your contract the legal risks like subpoenas, e-discovery and jurisdictional issues as well as technology licensing issues.

10. Finally, conduct a cost/benefit/risk reduction analysis of vendors offering secure cloud solutions with hardened data centers, hardware isolation and other security fortifications.

Each situation is different and a list of security concerns and requirements must be a part of your cloud discussion and decision. At a minimum, organizations must address these 10 issues to properly manage their risks. Failure to do so can result in difficult issues between your organization and the cloud vendor.