Software Licensing & Master Service Agreements : Chicago Software Licensing Lawyer & Attorney : Sam Conforti Law Firm : Master Service Agreements, Negotiations, Outsourcing : Cook County, Illinois

I found a very good White Paper on Cloud Security entitled Cloud Security Myths and Strategies Uncovered. I think the best way to start off is with the opening quote from the White Paper itself:

“In today’s evolving information economy, cloud computing offers immense opportunity. Whether companies have started their cloud journey or not, security concerns remain the largest inhibitor to adoption. Concerns around control, data privacy, and security abound. However, the technology and expertise required to build a trusted cloud is closer than imagined. Progressive CSOs are embracing a new strategic role as a true business enabler in partnership with business leaders, to make sure that the trusted cloud becomes a reality and enterprises can capitalize on cloud technology.”

Security concerns still abound with Cloud Computing and a fair number of adopters still opt for a private cloud environment. However, there is a trend towards a more hybrid approach, allowing enterprises to take advantage of the cost saving a public cloud provides. A majority of IT professionals surveyed indicated that their top priority was managing access to the data in the cloud. The White Paper suggests that “Virtualization” provides better visibility than the older legacy systems.

The White Paper then lists the three major Myths about Cloud Computing and provides the answer that debunks each one:

1.       The Cloud simply cannot be secure - YES IT CAN.

2.       Cloud Security is a new challenge – NO IT’S NOT.

3.       Compliance equals security – not necessarily … it is only an “as of” date.

The authors state that a successful and secure Cloud is one that has “Trust” as its foundation. The Trust Equation is as follows:

Control + Visibility= Trust

Control

·         Availability: Ensure access to resources and recovery following interruption or failure.

·         Integrity: Guarantee only authorized persons can use specific information and applications.

·         Confidentiality/privacy: Protect how information and personal data is obtained and used.

Visibility

·         Compliance: Meet specific legal requirements and industry standards and rules.

·         Governance: Establish usage rights and enforce policies, procedures, and controls.

·         Risk management: Manage threats to business interruption or derived exposures.

The White Paper goes on to say that the key to obtaining the visibility needed to control the Cloud is Virtualization. “Virtualization consolidates multiple physical components into a logical view so they can be administered from one place. This alleviates the complexity of managing and monitoring multiple moving parts across internal and external infrastructure.”

When it comes to building a trusted cloud, Checklist for Your Trusted Cloud is as follows:

·         Use virtualization as your foundation.

·         Build control and visibility into your security framework.

·         Extend your security perimeter to include applications and endpoints.

·         Adopt the three-layer controls framework: controls enforcement, controls management, and security management.

·         Select a cloud vendor with offerings that can meet enterprise-class cloud security requirements across private and public clouds.

·         Ensure services are secured to a common standard, in a transparent and auditable fashion.

·         Tap prescriptive guidance from industry coalitions such as the Cloud Security Alliance (www.cloudsecurityalliance.org).

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Due to the current economic conditions, IT departments are coming under increasing pressure to do more with less.  However, over the last few years upper level management has become leery of divesting themselves of the servers and network to a service provider.  In prior postings to this Blog I have provided reasons why outsourcing can benefit the enterprise, 10 Reasons to Outsource, and also a comprehensive checklist to consider prior to making the decision, Checklist Before Outsourcing Your IT.  In an effort to continually update this topic as events evolve, this posting is another in this series and concentrates on the concerns one might have regarding the Service Provider.  To get the full detail underlying the following points to consider when evaluating which Service Provider is best for your enterprise read Outsourcing Your Infrastructure: Ten Points to Consider When Making the Move.  Here is a brief summary of those ten points:

·         Uptime:  Greater reliance on the internet makes “On” the only option.  The global marketplace makes this a necessity.  The options could be straight hosting, managed service, or SaaS.

·         Redundancy and Business Continuity:    loss of customer call center could result in lost orders.

·         Data Restoration:  eDiscovery Laws require a significant and competent back-up plan.

·         Response Time and Site Performance: providers have high-performance servers and high-speed access, but do they have only one location.

·         Scalability to meet growth: Can the Service Provider add capacity quickly to meet the rapid increase in demand, in other words, does the Service Provider have the financial capital available to rapidly add more servers.

·         Customer Support:  This is the “value-add” dimension that differentiates one Service Provider from the other.

·         Security:  Must be able to adhere to the Data Privacy laws such as Sarbanes-Oxley, and Gramm-Leach-Bliley.

·         Cost Reduction and One-Stop Billing:  Abandon the ala carte approach to IT infrastructure.  Bundled services are discounted.

·         Optimized IT resources i.e. dedicated servers:  Allows IT staff to redirect their efforts to delivering their own services.  Plus services on demand priced on usage is better offered from a service provider’s business model.

·         Financial improvements:  Eliminates the need for cash oulay for hardware and turn the cost into an operational expense as the enterprise pays for a service.

• Email This
• Print
• Comments
• Trackbacks
• Share Link