* Verification of cloud security should be based on facts, not on assumptions
Verification of cloud security is difficult but also important so businesses need to figure out the best way to handle this.
Recently a vendor of a hosting service enlisted a cloud provider to supply the back-end storage and application servers needed to run the business. Asked what the backup plan was if the cloud failed, the vendor said that if the cloud crashed for 24 hours, then the vendor’s service would crash for 24 hours.
The vendor gave the provider credit for doing its due diligence in designing and securing its infrastructure to protect it from crippling attacks, but had never checked it out. The vendor was assuming that the cloud provider, being professional, must have thought the problem through. Believing in the cloud provider’s competence was an act of faith.
This is no way to run a business. The temptation is certainly there if you’re running a hosting service and you don’t need to invest in a data center and hire people to run it. These cost savings and the agility cloud services offer when demands for capacity burst are attractive, but they shouldn’t lead to shirking responsibility.
It can be difficult and time consuming to evaluate security measures set up by cloud providers, but it is something that must be done. It also costs money, but most businesses will be saving money by using the cloud in the first place, and some of that should be diverted to verification.
Some in the cloud industry are talking about third-party certifications that could make this process simpler for businesses interested in contracting for cloud services, but if they come about, it won’t be for awhile.
Investigation of cloud provider’s security may reveal flaws, but they may be vulnerabilities that customers are willing to tolerate in exchange for the convenience, cost savings and capabilities of the service. That is a risk assessment that individual businesses will have to make, but it should be made on the facts, not on assumptions.
As one cloud user said recently, “You’re never going to have 100% confidence that a service provider is perfect, but you don’t have that assurance at your own place, either.”
