cloud security
MANAGED SERVICES
#dcsarticle
http://dcseurope.info/n/tosu
Lowering the barriers to cloud computing adoption
While most service providers have started to realise the enormous potential of the cloud services market, many must overcome the hurdle of allaying customers’ security concerns. Whether it is fears over data protection, access control, data integrity or authentication, many customers harbour degrees of trepidation and confusion when it comes to cloud security. By Richard Nichols, Business Operations Director, RSA the security divsion of EMC.
S
tarting in 2014, spending on external cloud services will accelerate as offerings mature to address business concerns1
. Yet
security continues to reign as the concern most often raised by end users. So, what can service providers do to allay these concerns and accelerate customer adoption of cloud-based services? Essentially, it’s up to the service provider to build platforms that meet the specific needs of individual industries and create flexible infrastructures that allow policy-based customisation. Putting these structures in place will help make organisations feel more at ease about conducting business - and moving parts of their most critical data - to the cloud.
In order to alleviate the security concerns that are either deterring customers away from cloud computing or causing hesitancy, service providers need to tackle the following issues:
Multitenancy: There will always be a concern about security breaches when many different companies are sharing the same physical resources. The fear is that other ‘tenants’ of the shared infrastructure would be able to access confidential data belonging to fellow tenants. Application workloads, based on priority and purpose, must be carefully separated on a tenant-by-tenant basis with strong security measures put in place to ensure privacy and data protection.
Authentication and access control: The key takeaway here is for service providers to work closely with their customers to establish access controls based on each of their specific business policies and procedures. Access controls and authorisation must be set according to user type, job function and the type of service or application being accessed, as well as on other considerations determined by the customer. The service provider’s goal should be to open up access control and federate information in a joint control model.
42
www.dcseurope.info I June 2012
Providers who can create a strategy for a secure, single sign-on capability - a personal digital identity (PDI) that moves with the user from device to device - will be offering their customers some serious value add. This level of identity management makes it much easier to access data securely. When customers enter the service provider customer portal, they are able to log into all applications and services for which they are authorised with a single logon from any authorised device.
Protection and trust: The requirements for a trusted computing environment are compliance, governance and risk management, availability, integrity and confidentiality. All cloud-resident, customer data needs to be available or recoverable regardless of where it resides, be it internal (private) or external (service provider delivered). Data encryption at two levels must be supported to ensure that data is protected ‘in flight’ and ‘at rest’. It falls on the providers to inform their customers what levels and types of protection are available and at what cost, in terms of performance. A variety of resources are available and last year, the RSA launched the Cloud Trust Authority - a set of cloud-based services designed to facilitate secure and compliant relationships among organisations and multiple cloud service providers. By enabling visibility and control over identities, information, and infrastructure, the RSA Cloud Trust Authority will foster the trust and confidence necessary for organisations to more fully adopt cloud computing for business-critical applications and sensitive information.
Pre-building secure, industry-focused platforms Security and compliance issues affect nearly every customer, whether mandated by government, industry, or their own corporate policies. But certain industries may have more urgent security requirements,
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56