Three Security Questions to ask Cloud Vendors

Three Security Questions to ask Cloud Vendors

Your company is looking to dramatically change the way they are saving large amounts of data and they are thinking about moving to the “cloud.” There are many concerns when transferring to the cloud and security is one of the biggest, followed closely by concerns about complying with regulations and losing control of data according to a recent study by 451 Research.

While these are valid fears based on the recent news about breaches in data, loss of information and general doubt of cloud security at both the company and government level. Jack Sepple and Daniel Mellen tend to disagree, stating that “most public clouds are infinitely more secure than most companies’ current internal data centers and security functions,” in a column on Forbes.com.

Does this cloud meet my business’s specific needs?

There are major differences among cloud providers in their approach to security and their use of security technologies, processes, and personnel. These differences can have a major impact on the availability, integrity, accessibility, privacy, and compliance of your data. These cloud components can directly impact your company. Figure out exactly what your business needs, ask yourself questions such as: how many people will be using the cloud, how much storage will it need and how much will it cost? First research the needs of your company and then study available vendors to eliminate the ones that don’t work best for you and when you’ve narrowed down the options, dive deeper into questions about data protection, regulations and isolation of databases.

How can you isolate customer data?

“Some cloud providers will promote the fact that they provide data isolation or tenant isolation, but often that isolation mechanism is just one bad keystroke away from potentially comingling customer data,” Ben Nelson, vice president of security and regulatory compliance for Oracle Cloud said in an article on Forbes.com.

It is all too easy for a cloud provider who segregates customer data on one database and relies on application-level tools to accidentally update information for the wrong customer or multiple customers. If there is proper isolation between customers, meaning each cloud database is separate (although on running on the same hardware) and has proper authentication credentials it could dramatically reduce the chance of a data breach. The provider could even have a unique schema associated with your database instance to keep it even more secure. If all these proper tools are applied, it is less likely for data to be changed, manipulated or lost.

Who can access my data?

When trying to avoid a breach in data, it is crucial to know who can access the data in which you’ve stored on the cloud. You’ll want to know how the cloud provider controls and manages access to your database, from cloud vendor employees to your own staff, and which data they can access and any given time.

In the cloud model, data is transmitted between and among connected data centers and a diverse array of clients: mobile phones, desktops, laptops, tablets, etc. While the cloud service provider has no control over the security mechanisms put in place by the vendors of these devices, they can ensure that no client ever opens a hole in your firewall with any externally accessible port, communicates with any non-authenticated source, or stores cached credential information in an unencrypted format. This will stop three of the most common attack vectors and the people who could be behind the potential breach.

When evaluating prospective vendors, be sure to get a detailed description of their use of the cloud, from their customer isolation process to their protection of your data. Don’t be afraid to ask questions and if you’re not conversant in the technology yourself, consider having it appraised by an expert.

Featured

  • New Report Reveals Top Security Risks for U.S. Retail Chains

    Interface Systems, a provider of security, actionable insights, and purpose-built networks for multi-location businesses, has released its 2024 State of Remote Video Monitoring in Retail Chains report. The detailed study analyzed over 2 million monitoring requests across 4,156 retail locations in the United States from September 2023 to August 2024. Read Now

  • Gaining a Competitive Edge

    Ask most companies about their future technology plans and the answers will most likely include AI. Then ask how they plan to deploy it, and that is where the responses may start to vary. Every company has unique surveillance requirements that are based on market focus, scale, scope, risk tolerance, geographic area and, of course, budget. Those factors all play a role in deciding how to configure a surveillance system, and how to effectively implement technologies like AI. Read Now

  • 6 Ways Security Awareness Training Empowers Human Risk Management

    Organizations are realizing that their greatest vulnerability often comes from within – their own people. Human error remains a significant factor in cybersecurity breaches, making it imperative for organizations to address human risk effectively. As a result, security awareness training (SAT) has emerged as a cornerstone in this endeavor because it offers a multifaceted approach to managing human risk. Read Now

  • The Stage is Set

    The security industry spans the entire globe, with manufacturers, developers and suppliers on every continent (well, almost—sorry, Antarctica). That means when regulations pop up in one area, they often have a ripple effect that impacts the entire supply chain. Recent data privacy regulations like GDPR in Europe and CPRA in California made waves when they first went into effect, forcing businesses to change the way they approach data collection and storage to continue operating in those markets. Even highly specific regulations like the U.S.’s National Defense Authorization Act (NDAA) can have international reverberations – and this growing volume of legislation has continued to affect global supply chains in a variety of different ways. Read Now

Featured Cybersecurity

Webinars

New Products

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises. 3