Cloud computing – the process of storing, accessing and sharing company data and processes remotely on the Internet – has changed the audit and risk profile of data systems in most organisations. Whilst the economics of going down the cloud route for data storage are highly attractive, there are also a number of data security issues to consider.
Where, for example, is my data really being stored? What happens when I delete it – is it really deleted, or is there a backup somewhere I’m not aware of? These are questions that need to be asked by the audit team before negotiations with the cloud service provider begin.
We are at the start of a huge learning curve with cloud security and many organisations are contracting with cloud service providers without undertaking the due diligence that is vital.
Generally speaking there are four main cloud services that organizations of all sizes are looking for – applications, data storage, infrastructure and platform – and they all are linked.
Most cloud services are offered on a shared server basis, ie the IT resources on a given server are shared between multiple organisations. Some companies are going down the route of signing up for non-shared cloud services that are offered on a secure basis by the likes of IBM and Unisys.
Even though this effectively means a company’s data storage facilities are installed remotely, the economies of scale of major data centres make such services cost-effective – though not as highly cost-effective and environmentally friendly as shared cloud services.
Introducing Risk Analysis to the Selection Process
Virtually all company IT systems are engineered to support physical drives, so integrating a cloud environment into the IT resource usually involves a lot of work on the software and integration front.
In the real world, you can see your PC or drive has been stolen, but in the virtual world, there are no such comforts. As a result, meeting compliance and regulation issues is very difficult.
But even secure cloud services have an increased risk of data going walkabout – for any reason – compared to having your organisation’s data neatly tucked up on your own servers.
To counter these issues, it is necessary to employ a carefully defined risk analysis of IT systems and procedures before a decision on which cloud technology and service is the best option for your organisation, before later steps such as the creation of service level agreements, remediation procedures and penalty clauses are started.
The four main stages in this analysis are as follows:
1) ID management and Access Control – who is authorised to do what and when.
2) Regulatory requirements – Basel II, SOX, PCI, SAS70.
3) Data handling processes – where is the company’s data located? And how is it managed?
4) Staff management – when someone leaves, comes on board or changes roles, what happens?
Whilst cloud computing changes the data handling ballgame significantly, provided the IT security technology that is being employed (or planned) by the organisation can handle cloud, as well as conventional, IT data storage systems, the gap between network and cloud-based security analyses is not as great as some experts report it to be.
What is required is an assessment of the expectations that management and the business have for the cloud outsourcing contract – ie what precise functions are required to be completed by the outsourcing company? And what are the performance and security criteria that the provider will be held to?
Questions to Ask
Q1 – Who can see my information?
Data loss is now a reality and a sizeable chunk of all data loss incidents are down to third party providers. As a result, you need to know whether the service provider, who is the administrator of the system, can see your data. Most admins have this ability. Therefore, do they have the controls in place to avoid sending, copying, e-mailing etc your data?
Q2 – What happens if the service provider loses some of your data?
You need to ask your cloud service provider what their data protection policy is and what their audit procedures are. And then you should perform due diligence on those procedures.
Q3 – Are you happy with data co-location?
What does the third party organisation do to separate information and systems? Could your competitor – who is also using the service – get their hands on your data? Remember that, in the cloud, you cannot tell whether your data is copied. So you really need to get this one answered!
Q4 – What happens in the event of data corruption?
How many copies of your data does the third party have? Do they use incremental backups and can they reconstruct an image of your data at a given point in the past from these partial backups. How far back do their backups go in calendar terms?
Q5 – How easy is it to migrate to another cloud service provider?
This is a question few organisations ask – until it’s too late. Porting data between cloud service providers is a relatively new capability and only a small number of service providers have implemented what will become a very necessary service.
Q6 – Are you relying too much on service level agreements?
A service level agreement is the contract between you and the cloud service provider.
Whilst figures are usually central to most SLAs, you need a remediation process in the event the service provider does not meet their agreement. Things can – and do – go wrong, so it is important to agree the remediation process, a lot could rest on the integrity of the agreement.
Compensation is only part of the equation, as by the time the money is paid, you could be out of business.
Conclusion
Our observations here at Cyber-Ark are that cloud computing can really work for most organisations. But the principle of caveat emptor applies.
Do your homework and know your options. Nothing can protect you against the unexpected, but for a reasonable cost, you can usually reduce the likelihood of a disaster.
Adam Bosnian is VP of Products, Strategy and Sales at Cyber-Ark: www.cyber-ark.com
