Achieving security in the cloud
Play
Few now question the benefits that can be realised from the cloud through greater business agility, rapid scalability of services and reduced costs. Security, however, consistently rates as the major concern for enterprises adopting cloud-based services.
Frequent stories of hackers and organised cyber-criminals not only play into these concerns of information loss, but also possible sabotaging in which sophisticated methods are used to target potential victims.
The challenge for those wanting to reap the efficiency and cost benefits of cloud is to find new ways of protecting their physical and virtual assets – and that requires a whole-of-enterprise approach.
Evaluating and managing the security risks must be top of mind for organisations wanting to make a successful transition to cloud. The various deployment models – public, private and hybrid – each have their own security vulnerabilities and risks, and these increase depending on the range of potentially unidentified users.
CIOs and CSIOs must focus on securing their own enterprise’s use of cloud-based services rather than on whether the cloud, in general, is secure. Essentially, the key areas that need to be considered are cloud access devices, the cloud platform, security and compliance management, and cloud stakeholders.
There are four steps to a safe cloud deployment.
Step 1: A risk-based approach
Establishing an approach based on the perceived risks is essential for organisations preparing to move applications and data to the cloud. Any review of the potential risks must be undertaken from a viewpoint of how it affects the entire enterprise.
Organisations need to be proactive in identifying issues and finding the correct balance between securing and enabling business activities.
Step 2: Secure design applications
CIOs must, therefore, ensure that all data and applications are thoroughly reviewed and amended before they are deployed on a cloud platform.
The aim is to make them self-defending, which requires new strategies from developers to application development and data management. They need to focus on protecting information to ensure confidentiality, integrity and availability.
Step 3: Ongoing auditing and management
Continuous compliance monitoring must be in place for the secure delivery of cloud services. To enable forensic examination and analysis in the event of a security breach, there needs to be ongoing monitoring and maintenance of incident records and log files.
Step 4: Infrastructure and network security
When using a cloud-based service, an enterprise has minimal direct control over infrastructure and network security, including operational procedures, network configuration and intrusion prevention.
These are all critical areas, so it is important that the user undertakes a thorough review of the service provider’s policies as part of the due-diligence process during contract negotiation and service sourcing.
Cloud is fast-moving and the opportunities are significant for businesses that plan a secure route. Issues of security should not be a reason for enterprises delaying their entry into cloud.
The security risks can be managed if a whole-of-enterprise programme is adopted. It is not about securing the cloud – it is about securing an enterprise’s use of cloud-based services.
Dhanawat Suthumpun is managing director of Hewlett-Packard (Thailand).
