Cloud Computing can be an answer for companies who want data security and system reliability. Especially if you see a computer device that is usually a PC that has been aging and the data is backed up almost rare. Nevertheless, you should never assume that cloud computing is the safest and best system.
Companies should look at cloud security alliance 10 recommendations (CSA) following in order to enjoy a secure cloud computing services. CSA is an industry that was founded specifically to promote security in cloud computing.
1. Identify and calculate the value of assets.
Any company that intends to use cloud computing services should carefully review the asset and its value, especially the assets transferred to the cloud. In addition to PC, Server, Storage and other assets also include applications, operating systems and customer information.
2. Calculate the liability.
Concerns are often expressed cloud users are systems breached and data stolen. Not a problem if the data is stolen property was limited to the office. Yet another case is if the stolen customer data, because instead of the cloud service providers are held accountable, but that company.
3. Understand the terms - the terms of compliance (Compliance)
For some industry sectors, the government is firmly in the management of electronic data. For example, the banking industry are prohibited from storing and managing customer data outside of the country concerned. In the sector - this kind of industry sectors, the number and types of security controls are generally very clearly defined and governed by the regulations.
4. Determine risk tolerance.
Dare to risk
How large is the organization's ability to bear risk, if they see obligations, regulations, and important asset to the company? Not just a matter of courage and ability, but also the cost to ensure data security. The more stringent the desired security of cloud computing provider, the more expensive the service will be subscribed. So do not be tempted by a solution is a low cost cloud computing.
5. Find Out The Side Cloud Provider.
Learn the offer of the Provider, particularly the details of how the cloud services that are presented to the client (ie us), where And how data is placed or moved, what security controls are applied by default provider and the provider would provide security solutions in accordance with our request. Ask also the type and level of security offered by encryption.
6. Ask Certificates and Reliability.
This is a step short cut road test the thoroughness of the security controls offered by the provider. Ask a variety of certificate they may have or we can examine the website of the Provider.
7. Include security controls are explicitly in the contract.
Learn what is written carefully contracted, especially article - article related to security. If the Provider to be flexible and willing to negotiate, set in the contract type and level of encryption that we want, including how to - how to prevent data loss.
8. Negotiate SLA and Exit Strategy.
Security in the Cloud is not just a matter of data protection but also about business continuity. So make sure the Security Level Agreement (SLA) agreed to include the percentage of uptime and time to response when there is a problem. SLA also includes financial pinalty if the provider fails to meet the agreed SLA. Make sure we can move to another provider's services easily and securely.
9. Prepare a safety measure offline
For example by setting up a data backup in the cloud or retain control over the encryption keys.
10. Read the manual of the Cloud Security Alliance
CSA has prepared a comprehensive document regarding due diligence related to moving data and applications into the cloud securely.
No comments:
Post a Comment