Making sure your Cloud provider can protect your data as promised

At the end of my Cloud Expo West presentation last week, I was asked, "How can we verify that a cloud provider actually has all of these infrastructure and security mechanisms in place?" It's a great question, one that deserves a fuller answer than I was able to give in the time available. So here's a more detailed version of my response.

The primary options -- certifications and inspections -- could be added as a requirement in your contract with the cloud provider. Currently, there isn't one formal standard for cloud computing certification, but the following are increasingly being used:

FIPS 200/SP 800-53

As a result of the Federal Information Security Management Act (FISMA), the National Institute of Standards and Technology (NIST) developed the Federal Information Processing Standards 200 (FIPS 200), Minimum Security Requirements for Federal Information and Information Systems, and the Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems and Organizations. (You can see why the acronyms are preferred.)

To continue reading, [[xref:http://reg.idgenterprise.com/insider.html?url=http://www.computerworld.com/s/article/9222057/Making_sure_your_cloud_provider_can_protect_your_data_as_promised to become an Insider|Insider registration page]]. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more [[xref:http://www.computerworld.com/s/insiders|Insider Index - Computerworld]] or [[xref:http://reg.idgenterprise.com/insider.html?url=http://www.computerworld.com/s/article/9222057/Making_sure_your_cloud_provider_can_protect_your_data_as_promised|Insider registration page]].

Tags freemiumsecurityinternetdata protectioncloud computing

Comments

Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Custom Defence against targeted attacks

Deep Discovery is uniquely designed for threat detection, real-time intelligence, adaptive protection, and rapid response to combat targeted attacks and Advanced Persistent Threats (APTs).

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.