Three Security Questions to ask Cloud Vendors

Three Security Questions to ask Cloud Vendors

Your company is looking to dramatically change the way they are saving large amounts of data and they are thinking about moving to the “cloud.” There are many concerns when transferring to the cloud and security is one of the biggest, followed closely by concerns about complying with regulations and losing control of data according to a recent study by 451 Research.

While these are valid fears based on the recent news about breaches in data, loss of information and general doubt of cloud security at both the company and government level. Jack Sepple and Daniel Mellen tend to disagree, stating that “most public clouds are infinitely more secure than most companies’ current internal data centers and security functions,” in a column on Forbes.com.

Does this cloud meet my business’s specific needs?

There are major differences among cloud providers in their approach to security and their use of security technologies, processes, and personnel. These differences can have a major impact on the availability, integrity, accessibility, privacy, and compliance of your data. These cloud components can directly impact your company. Figure out exactly what your business needs, ask yourself questions such as: how many people will be using the cloud, how much storage will it need and how much will it cost? First research the needs of your company and then study available vendors to eliminate the ones that don’t work best for you and when you’ve narrowed down the options, dive deeper into questions about data protection, regulations and isolation of databases.

How can you isolate customer data?

“Some cloud providers will promote the fact that they provide data isolation or tenant isolation, but often that isolation mechanism is just one bad keystroke away from potentially comingling customer data,” Ben Nelson, vice president of security and regulatory compliance for Oracle Cloud said in an article on Forbes.com.

It is all too easy for a cloud provider who segregates customer data on one database and relies on application-level tools to accidentally update information for the wrong customer or multiple customers. If there is proper isolation between customers, meaning each cloud database is separate (although on running on the same hardware) and has proper authentication credentials it could dramatically reduce the chance of a data breach. The provider could even have a unique schema associated with your database instance to keep it even more secure. If all these proper tools are applied, it is less likely for data to be changed, manipulated or lost.

Who can access my data?

When trying to avoid a breach in data, it is crucial to know who can access the data in which you’ve stored on the cloud. You’ll want to know how the cloud provider controls and manages access to your database, from cloud vendor employees to your own staff, and which data they can access and any given time.

In the cloud model, data is transmitted between and among connected data centers and a diverse array of clients: mobile phones, desktops, laptops, tablets, etc. While the cloud service provider has no control over the security mechanisms put in place by the vendors of these devices, they can ensure that no client ever opens a hole in your firewall with any externally accessible port, communicates with any non-authenticated source, or stores cached credential information in an unencrypted format. This will stop three of the most common attack vectors and the people who could be behind the potential breach.

When evaluating prospective vendors, be sure to get a detailed description of their use of the cloud, from their customer isolation process to their protection of your data. Don’t be afraid to ask questions and if you’re not conversant in the technology yourself, consider having it appraised by an expert.

Featured

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.