Network World - Last August the Cloud Security Alliance (CSA) announced at the Black Hat security conference in Las Vegas a registry that it hoped would serve as a place for prospective cloud users to go to easily inspect and compare cloud vendors' security controls. But to date, only three companies have submitted their cloud security data, making the registry of limited use.
The Security, Trust and Assurance Registry (STAR) is designed to index the security features of cloud providers using a 170-point questionnaire that end users are then able to peruse. Soon after the CSA announced STAR, big names such as Google, Intel, McAfee, Verizon and Microsoft all agreed to take part. So far though, Microsoft is the only one of that group to have followed through.
MORE CLOUD: Are you paying too much for cloud services?A
ROUNDUP: 10 cloud management companies to watchA
Kyle Hilgendorf, a Gartner analyst who tracks the cloud industry, is disappointed more providers have not signed up for the registry. It has the potential to provide valuable insight for end users, but only if there is a critical mass of companies in the registry, he says.
If you only have three, four or five providers, that doesn't add a whole lot of perspective on the entire market," Hilgendorf says.
CSA Executive Director Jim Reavis remains bullish on the program and says by the end of the year he expects the registry to be more complete. Several providers, he says, are in the late stages of making submissions to the registry. "Everything starts from scratch," he says.
One issue that could be holding back adoption is what information providers are willing and able to disclose. Jon Heimerl is director of security strategies at Solutionary, a managed security services provider, and one of three companies that has submitted to STAR. Mimecast, a cloud-based e-mail optimization and security service, is the third.
When filling out Solutionary's submission Heimerl says there was a fine line that had to be drawn between how much meaningful information can be divulged without creating a security risk.
"We made our best effort to answer the questions as clearly as possible without revealing too much of the secret sauce of our security protocols," he says. One way Solutionary did that is by giving general answers to some questions and encouraged interested customers to contact them if they need additional information.
For example, Heimerl says when answering a question about encryption of information, the company answered that it uses a 256-byte encryption code and device hardening methods. It did not, however, divulge exactly what those device hardening methods are.
- The business impact of BYOA: Five major challenges and how your enterprise can solve them This E-Book reviews five major challenges of BYOA with key subject matter experts and outlines how businesses can solve them.
- The BYOA Opportunity Visual demonstration of problems that unmonitored, employee-introduced cloud apps can cause a business, and why IT managers need a solution to help and...
- BYOA: Embracing the Opportunity, Controlling the Risk This whitepaper explores the shift from BYOD to BYOA (bring-your-own-application) and how IT departments today can address this new change in the IT...
- AppGuru Reference Guide: Conquer BYOA Challenges, Leverage BYOA Benefits As the advantages of Bring-Your-Own-Application environments become increasingly apparent, BYOA is quickly becoming a reality for organizations of all sizes. But with the...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Cloud Computing White Papers | Webcasts