Three Security Questions to ask Cloud Vendors

Three Security Questions to ask Cloud Vendors

Your company is looking to dramatically change the way they are saving large amounts of data and they are thinking about moving to the “cloud.” There are many concerns when transferring to the cloud and security is one of the biggest, followed closely by concerns about complying with regulations and losing control of data according to a recent study by 451 Research.

While these are valid fears based on the recent news about breaches in data, loss of information and general doubt of cloud security at both the company and government level. Jack Sepple and Daniel Mellen tend to disagree, stating that “most public clouds are infinitely more secure than most companies’ current internal data centers and security functions,” in a column on Forbes.com.

Does this cloud meet my business’s specific needs?

There are major differences among cloud providers in their approach to security and their use of security technologies, processes, and personnel. These differences can have a major impact on the availability, integrity, accessibility, privacy, and compliance of your data. These cloud components can directly impact your company. Figure out exactly what your business needs, ask yourself questions such as: how many people will be using the cloud, how much storage will it need and how much will it cost? First research the needs of your company and then study available vendors to eliminate the ones that don’t work best for you and when you’ve narrowed down the options, dive deeper into questions about data protection, regulations and isolation of databases.

How can you isolate customer data?

“Some cloud providers will promote the fact that they provide data isolation or tenant isolation, but often that isolation mechanism is just one bad keystroke away from potentially comingling customer data,” Ben Nelson, vice president of security and regulatory compliance for Oracle Cloud said in an article on Forbes.com.

It is all too easy for a cloud provider who segregates customer data on one database and relies on application-level tools to accidentally update information for the wrong customer or multiple customers. If there is proper isolation between customers, meaning each cloud database is separate (although on running on the same hardware) and has proper authentication credentials it could dramatically reduce the chance of a data breach. The provider could even have a unique schema associated with your database instance to keep it even more secure. If all these proper tools are applied, it is less likely for data to be changed, manipulated or lost.

Who can access my data?

When trying to avoid a breach in data, it is crucial to know who can access the data in which you’ve stored on the cloud. You’ll want to know how the cloud provider controls and manages access to your database, from cloud vendor employees to your own staff, and which data they can access and any given time.

In the cloud model, data is transmitted between and among connected data centers and a diverse array of clients: mobile phones, desktops, laptops, tablets, etc. While the cloud service provider has no control over the security mechanisms put in place by the vendors of these devices, they can ensure that no client ever opens a hole in your firewall with any externally accessible port, communicates with any non-authenticated source, or stores cached credential information in an unencrypted format. This will stop three of the most common attack vectors and the people who could be behind the potential breach.

When evaluating prospective vendors, be sure to get a detailed description of their use of the cloud, from their customer isolation process to their protection of your data. Don’t be afraid to ask questions and if you’re not conversant in the technology yourself, consider having it appraised by an expert.

Featured

  • 2025 Security LeadHER Conference Program Announced

    ASIS International and the Security Industry Association (SIA) – the leading membership associations for the security industry – have announced details for the 2025 Security LeadHER conference, a special event dedicated to advancing, connecting and empowering women in the security profession. The third annual Security LeadHER conference will be held Monday, June 9 – Tuesday, June 10, 2025, at the Detroit Marriott Renaissance Center in Detroit, Michigan. This carefully crafted program represents a comprehensive professional development opportunity for women in security this year. To view the full lineup at this year’s event, please visit securityleadher.org. Read Now

    • Industry Events
  • Report: 82 Percent of Phishing Emails Used AI

    KnowBe4, the world-renowned cybersecurity platform that comprehensively addresses human risk management, today launched its Phishing Threat Trend Report, detailing key trends, new data, and threat intelligence insights surrounding phishing threats targeting organizations at the start of 2025. Read Now

  • NRF Supports Federal Bill to Thwart Retail Crime

    The National Retail Federation recently announced its support for the Combating Organized Retail Crime Act of 2025. The act was introduced by Chairman Chuck Grassley, R-Iowa, Senator Catherine Cortez Masto, D-Nev., and Representative Dave Joyce, R-Ohio. Read Now

  • ISC West 2025 Brings Almost 29,000 Industry Professionals to Las Vegas

    ISC West 2025, organized by RX and in collaboration with the Security Industry Association, concluded at the Venetian Expo in Las Vegas last week. The nation’s leading comprehensive and converged security event attracted nearly 29,000 industry professionals and left a lasting impression on the global security community. Over five action-packed days, ISC West welcomed more than 19,000 attendees and featured 750 exhibiting brands. Read Now

    • Industry Events
    • ISC West
  • Tradeshow Work Can Be Fun

    While at ISC West last week, I ran into numerous friends and associates all of which was a pleasant experience. The first question always seemed to be, “How many does this make for you?” Read Now

    • Industry Events
    • ISC West

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance.