Computerworld -
At the end of my Cloud Expo West presentation last week, I was asked, "How can we verify that a cloud provider actually has all of these infrastructure and security mechanisms in place?" It's a great question, one that deserves a fuller answer than I was able to give in the time available. So here's a more detailed version of my response.
The primary options -- certifications and inspections -- could be added as a requirement in your contract with the cloud provider. Currently, there isn't one formal standard for cloud computing certification, but the following are increasingly being used:
FIPS 200/SP 800-53
As a result of the Federal Information Security Management Act (FISMA), the National Institute of Standards and Technology (NIST) developed the Federal Information Processing Standards 200 (FIPS 200), Minimum Security Requirements for Federal Information and Information Systems, and the Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems and Organizations. (You can see why the acronyms are preferred.)
To continue reading, register here to become an Insider
It's FREE to join
Computerworld - At the end of my Cloud Expo West presentation last week, I was asked, "How can we verify that a cloud provider actually has all of these infrastructure and security mechanisms in place?" It's a great question, one that deserves a fuller answer than I was able to give in the time available. So here's a more detailed version of my response.
The primary options -- certifications and inspections -- could be added as a requirement in your contract with the cloud provider. Currently, there isn't one formal standard for cloud computing certification, but the following are increasingly being used:
FIPS 200/SP 800-53
As a result of the Federal Information Security Management Act (FISMA), the National Institute of Standards and Technology (NIST) developed the Federal Information Processing Standards 200 (FIPS 200), Minimum Security Requirements for Federal Information and Information Systems, and the Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems and Organizations. (You can see why the acronyms are preferred.)
FIPS 200, which is essentially intended to promote the use of more secure information systems by the federal government, defines 17 security requirements in areas that include access control, configuration management, contingency planning, identification and authentication, incident response, and system and information integrity. FIPS 200 also mandates the use of SP 800-53, which provides guidelines for selecting and specifying security controls for information systems to meet the requirements of FIPS 200.
These can be useful even for organizations that aren't federal agencies, since knowing that a cloud provider has been certified to meet these standards could be a valuable tool toward understanding and verifying its infrastructure and security practices.
ISO 27001 & 27002
Developed and published by the International Standards Organization, the ISO 27001 is a security certification standard that lays out a suite of 133 information security controls for evaluating, implementing, maintaining and improving an information system management system.
ISO 27002 is a security control framework intended to provide a common basis and practical guidelines for developing organizational security standards and effective security management practices.
It is important to ensure that the two are used in tandem, because 27001 is best used to evaluate efficacy against 27002's defined security control framework.
Because they are international standards, ISO 27001 and 27002 can be particularly useful for multinational organizations.
SSAE 16, SOC 2 & 3
Statements on Standards for Attestation Engagements 16 (SSAE 16), issued by the American Institute of Certified Public Accountants (AICPA), recently replaced SAS 70, which became commonly known as a standard for reporting on controls at a service organization but was never intended for application to cloud providers.
You are previewing premium content. 
Free Insider Guide
