Making sure your cloud provider can protect your data as promised

Certifications and inspections should be included in your contract

Become An Insider

Sign up now and get FREE access to hundreds of Insider articles, guides, reviews, interviews, blogs, and other premium content. Learn more.

At the end of my Cloud Expo West presentation last week, I was asked, "How can we verify that a cloud provider actually has all of these infrastructure and security mechanisms in place?" It's a great question, one that deserves a fuller answer than I was able to give in the time available. So here's a more detailed version of my response.

The primary options -- certifications and inspections -- could be added as a requirement in your contract with the cloud provider. Currently, there isn't one formal standard for cloud computing certification, but the following are increasingly being used:

FIPS 200/SP 800-53

As a result of the Federal Information Security Management Act (FISMA), the National Institute of Standards and Technology (NIST) developed the Federal Information Processing Standards 200 (FIPS 200), Minimum Security Requirements for Federal Information and Information Systems, and the Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems and Organizations. (You can see why the acronyms are preferred.)

FIPS 200, which is essentially intended to promote the use of more secure information systems by the federal government, defines 17 security requirements in areas that include access control, configuration management, contingency planning, identification and authentication, incident response, and system and information integrity. FIPS 200 also mandates the use of SP 800-53, which provides guidelines for selecting and specifying security controls for information systems to meet the requirements of FIPS 200.

These can be useful even for organizations that aren't federal agencies, since knowing that a cloud provider has been certified to meet these standards could be a valuable tool toward understanding and verifying its infrastructure and security practices.

To continue reading this article register now

5 power user tips for Microsoft OneNote
  
Shop Tech Products at Amazon