Microsoft wants ISO security certification for its cloud services
External validation could bolster market confidence in hosted services
Computerworld - Microsoft Corp. wants to get its suite of hosted messaging and collaboration products certified to the ISO 27001 international information security standard in an effort to reassure customers about the security of its cloud computing services. The move comes at a time of broad and continuing doubts about the ability of cloud vendors in general to properly secure their services.
Google Inc., which has made no secret of its ambitions in the cloud computing arena, is currently working on getting its services certified to the government's Federal Information Security Management Act (FISMA) standards for much the same reason.
It's unclear how much value customers of either company will attach to the certifications, particularly because the specifications were not designed specifically to audit cloud computing environments. Even so, the external validation offered by the standards is likely to put both companies in a better position to sell to the U.S. government market.
Speaking with Computerworld this week, Bill Billings, chief security officer of Microsoft Federal, said the company is currently in the process of putting Microsoft's Business Productivity Online Suite through the ISO 27001 certification process. The hosted service includes Exchange Online, SharePoint Online, Office Live Meeting and Office Communications Online. Billings declined to say just when Microsoft hopes to achieve the certification.
The goal is to offer customers, particularly those in the public sector, a higher level of confidence about Microsoft's cloud services than FISMA certification alone provides, said Teresa Carlson, vice president of Microsoft Federal.
"FISMA is outdated. It is largely a paper-based exercise. We want to take it up a notch" by getting ISO 27001 certification, Carlson said. At the same time, Microsoft is also working to get its cloud services certified to the standards prescribed under FISMA; it hopes to complete that task by the end of the year, Carlson said.
The ISO 27001 standard is managed by the international standards body ISO and the International Electrotechnical Commission. To get certified under the standard, Microsoft will need to show that its physical, logical, process and management controls for protecting its suite of cloud services meet a rigorous set of audit criteria.
Though the ISO 27001 standard is widely recognized internationally, it has failed to gain much traction in the U.S., said Chenxi Wang, an analyst at Forrester Research Inc. "Most U.S. companies don't pay much attention to ISO 27001. They don't know quite what to make of it."
Even so, in the absence of any cloud-specific certification standard, ISO 27001 remains one of the best security benchmarks available. "There's nothing specific to cloud computing in it. But it has been used in traditional outsourcing for years and is the best standard there is" for information security, she said.
Salesforce.com Inc. last year became one of the first vendors of hosted applications to become certified according to ISO 27001 standards. It's unclear how much that certification has helped the company acquire new customers, Wang said. But it has certainly played a role in reinforcing Salesforce.com's message about the security and reliability of its products.
News about Microsoft's plans to acquire ISO 2700 certification comes at a time of persistent user concerns about cloud security. The concerns have been fueled by high-profile incidents such as the recent outage affecting Microsoft's T-Mobile Sidekick and breaches in July involving Twitter and Google Apps.
Though the vendors themselves and many analysts have insisted the incidents had nothing to do with cloud security failures, the perception about the cloud being vulnerable to security failures isn't going away. It is for those reasons that certifications such as ISO 27001 and FISMA are important, especially in government, Billings said.
"Within the federal market, it is a cultural issue," Billings said. "This is really about making them feel comfortable about their partnership" with Microsoft.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts