Security and cloud computing

How can we ensure Enterprise data is protected in transit to the cloud, and once in storage (and when subsequently accessed), how is it appropriately protected to provide integrity and non-disclosure to other parties. Specifically (and generally referring to an infrastructure as a service scenario):

• What models are in place to ensure Corporate Enterprise data is not co-mingled with other companies’ data or, if co-mingled, how is data segregated to ensure non-disclosure?

• What encryption (specific algorithms) is available to allow Corporate Enterprise to implement to protect Corporate Enterprisedata (and what encryption is available on your end)?

• Describe how this encryption can be applied to every access channel to the data, and also while the data is at rest

• How is key management handled?

• Another aspect to data segregation: data availability. Liquid Motors is one fairly well-known case where FBI confiscated outsourced computers & data under subpoena. The landlord saw no reason to resist (in court) and readily granted them the equipment. Since data & computers were commingled, innocent co-tenants were also put out of business. Hence: outsourcing can amplify some disaster and business continuity threats that must be mitigated (at additional cost).

• How is authentication (user, admin or both? At guest OS or at VM hypervisor?) handled?

• Describe for each type of user (admin, user, service account) how authentication is/can be implemented.

• Does ability to integrate with PKI or externally provided user credentials exist (specifically can SAML assertions be utilized)?

• Can server creation and deployment be limited to a group of pre-authorized users?

• How many cloud administrators exist, and what instances and/or data would they have access to?

• Is there a mechanism in place to allow only Corporate Enterprise “blessed” images to be deployed?

• Describe log capture and monitoring capability, as well as log review process for areas handled by cloud provider, as well as integration capabilities with external security event and log management systems.

• Option available for full Corporate Enterprise log review, or audit on demand?

• What proof can be rendered to ensure logs are complete and unaltered?

• Describe incident handling process

• Under what circumstances is the tenant alerted to potentially significant events so countermeasures can be defined and implemented?

• Is it possible to ebond the landlord’s ticketing system to the tenant’s so communication of agreed-upon incident tickets is reliable and verifiable?

• Does the ability exist to specify which geographic areas would be permissible for location of Corporate Enterprise data?

• If so, how can we be assured that data is not relocated to another geographic area where different local laws on protection of data may be in effect

• More generally, what assurances are there that the tenant could be an approver in all changes in a rigorous change control process? Does the vendor have a change control process at all?

#CyberSecurity #CloudComputing