Standards and Cloud Security Association

 February, 24, 2012. Cloud Connect Conference, Santa Clara, CA—Becky Swain from the Cloud Security Alliance offered five questions people should get answers for when evaluating cloud providers and their security. The responses are based on work the CSA has been doing on standards and governance.

The full guidance document comprises177 pages, and only covers general situations due to the overwhelming number of variables and options within any compute environment. One specific section on trust will be going to accelerated approval process and will be patched distributed later this year. The guidance suggests a model for cloud, security, and compliance, and al three need to be mapped against the others to ensure data safety.

Evaluation of the various models should expose any existing gaps in areas and these gaps should be evaluated against mandated or recommended security practices. The overall security environment should be a part of a full risk assessment framework, which helps to determine the final actions. These models, however, do not assure data security.

First, is the security arrangement transparent to you as a user? Do you understand the vendor’s role and how much responsibility you have? The supplier-user agreement(s) have to specify who is responsible and where the various responsibilities start and end. Make sure that the vendor is not just putting out documentation.

Second, is your vendor security minded? Be aware of the tradeoffs associated with the various security models and make sure your organization is up to the task of managing data security across much wider data perimeters. If the vendor is providing and supporting much of the security, they should have certified staff to address security issues.

Third, what are your vendor’s disaster recovery plans and capabilities? Is there shared risk for outages and recovery efforts? Disaster recovery calls for multiple images of the data and applications in separate locations than the on-line datasets. In the case of a failure in the systems, does the network automatically or manually switch over to a backup and how long does this switch take.

Forth, is all of the data getting encryption before transit? The need for data security is a function of data sensitivity. The high-value proprietary data need as much security as possible, while the low value data only need enough to be considered safe. User policies and permissions have to apply to the cloud-based data for consistency, so users don’t get one version of security in the office and another when mobile. Another issue is what instances does the provider gets access to data, and in what form. The problem is that they cannot help debug a problem if they cannot see the data and applications in a working environment.

Finally, is your provider compliance ready? You need to check and approve all aspects of their operations and evaluate their capabilities against your requirements. If the provider is more than just a infrastructure supplier, they need to show their ability to meet your needs and be willing to have unscheduled audits from your and your security consultants.