Cloud security is a huge, ever evolving subject that is difficult to cover in a short space, especially with so many different cloud service types and architectures (SaaS, IaaS, PaaS, external, internal, and hybrid). However, there are a few cloud security practices that just about any organization should apply when working with the cloud.
Don’t think you can just hand a function over to a cloud provider and forget about it. Like any other IT component, cloud services must be managed and secured using policy, monitoring, and security tools and services.
Before contracting with a cloud service, make sure your internal security is up to date first. Don’t let your corporate network become the weakest link in the chain.
If you don’t use cloud services, your employees most likely do or will. IT should evaluate corporate applications, business processes, and data according to their value to the organization and risk when deployed wholly or partially in the cloud, then create a cloud use policy that spells out what may be allowed in the cloud and what isn’t. For applications that can be deployed in the cloud, spell out precautions and tools that must be employed to use the cloud securely.
Create a list of cloud services that IT has investigated and deemed acceptable in terms of security.
Start cloud use with low-risk, non-core functions until your organization gets a grip on the security landscape.
Make it clear that internal developers cannot test software in the cloud using live or sensitive corporate or customer information.
Investigate cloud provider contracts and SLA’s carefully. Does the provider take responsibility for your data and provide security guarantees? Does the service offer visibility into security events and responses? Is it willing to provide monitoring tools or hooks into your corporate monitoring tools? Does it provide monthly reports on security events and responses? What happens to your data if you terminate the service?
Don’t accept the provider’s standard contracts and SLAs. Evaluate your own compliance and security needs carefully and employ tech and compliance savvy lawyers to negotiate service contracts and SLA’s that fulfill those needs. Get guarantees on data location or use a hybrid model with data stored internally.
Examine the provider’s data protection strategies and multitenant architecture, if relevant.
Look for standard audits and certifications such as SAS 70 Type II or ISO 27001, then examine the audits carefully to understand potential security gaps. Look for ways to fill those gaps. If the provider uses third party providers, examine their certifications and audits as well.
Make sure the provider allows your organization to audit its security periodically as well.
Look for software services that comply with SAML, OpenID or other federation standards that make it possible to extend your corporate identity management tools into the cloud. Consider employing two-factor authentication for very sensitive data.
Encrypt all data BEFORE it goes to the cloud in transit and at rest. Make sure the provider has sufficient strategies for wiping released data from both memory and storage.
Negotiate specific procedures and roles for incident response. Make sure the provider includes you and considers you a partner.
In most cases users access the cloud through their client Web browsers. Make sure you employ strong client security tools and that your browsers are properly updated and protected from browser exploits.
The list is endless and the cloud is still an evolving learning experience, but this is a good start. With the right strategies your cloud deployment can be reasonably secure.
To find out what McAfee’s doing in the cloud space, visit our SaaS solution page, and be sure to follow @McAfeeBusiness on Twitter for future updates.
By: Leon Erlanger
