Cloud security is not that different from on-premises security. Confidentiality, integrity, and availability remain the main pain points to solve, but the tools and means of assuring them are different. We take a look at cloud security and what it means for both users and providers.
Best practices
Security in a public cloud environment can be tricky. Access control mechanisms for cloud providers are typically separate from internal processes. They sometimes fall outside approved and documented methods to manage access. This is why minimising root account access and group accounts remains the best solution for both cloud and traditional systems administration.
Organisations need to extend their identity services into the cloud for a strategic use of on-demand computing services. They should, however, keep in mind that the creation of a federated Identity and Access Management scheme allows for auditability, traceability, and accountability of actions only as long as you can enforce it.
Cloud security models
The cloud security model is different for each provider. Cloud services providers manage the hardware and hypervisor in an efficient manner based on very large scale. Meanwhile, the clients take care of the specific aspects of their environment, based on their application requirements. For example, the cloud provider manages the patching of the hypervisor and provides a set of allowable operating system versions allowed on their platform; the users are responsible for patching their virtual instances and installing the correct versions of required applications. There is a sliding scale of allowances made when transitioning from IaaS to PaaS and SaaS. The cloud provider takes on increasing responsibilities for managing applications, while the user benefits from the increased abstraction to focus on the activities bringing the most benefits.
What we think
Todd Hildebrant, Cloud and Infrastructure Technology Leader
Certifications ensure that cloud providers adopt best practices and provide third party attestation, guaranteeing their level of compliance. They also give organisations assurance that providers can accept or minimise the risk they transfer as part of the outsourcing during procurement. The challenges for cloud services clients are to determine which work best for their operating environment and to adapt their existing processes to map cloud controls to their own.
Cloud contracts: how to get them right?
Entering into an agreement with a cloud provider is the same as negotiating a contract with any outside vendor. Procurement and legal groups should address specific points based on the potential impact to your business services. The most important is to make sure that any technological solution fully complies with the applicable EU Data Protection legislation (i.e. Regulation (EC) 45/2001, or the upcoming GDPR).
Cloud contracts are often complex and contain many clauses with significant implications on the organisations. To name just a few: service level agreements (SLA), data security, responsibilities, infrastructure availability and ongoing pricing and support.
Cloud deployments provide limited physical control over infrastructure, limited vulnerability assessments, and limited availability of audit logs and activity monitoring. So, it’s critical to have a robust governance process around vendor contracts, terms and conditions.
Data protection and privacy become critical in a public cloud environment because important data now resides outside the organisations’ firewall. Therefore, a breach could result in major ramifications. Cloud security governance must deal with elasticity, multi-tenancy, and abstracted controls. It should also consider data identification, control, confidentiality, integrity and availability.
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
Cookie
Duration
Description
cookielawinfo-checkbox-analytics
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional
11 months
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy
11 months
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.