We all know the array of business benefits associated with cloud compute, the benefits are such that it seems a no brainer to move to the cloud. However some find it difficult to overcome the security concerns, both real and not, to take the leap and thus not obtaining the complete advantage-set available. Security remains a focal point, with surveillance and breaches evident presently and in the future. This does not help to develop organisation confidence; security is
even more of urgency.
Hopefully through clarifying the real security risks and disregarding the misperceptions, the route to a more comprehensive cloud compute
may become clearer, security can be more effectively managed and provider choice made
simpler to attain. Listed below are some common misconceptions which are not correct about cloud computing
There is a misconception that traditional software undergoes superior vetting compared
with that of cloud applications, making traditional software more secure and reliable. This is not the case. Cloud applications are continuously monitored, maintained and kept patched and up to date, where as traditional software patching and updates is wholly reliable on the end-user
doing this. Within a business the likelihood of this being undertaken daily or even weekly is
slim but this is commonplace within a cloud environment of a reputable cloud provider. The likelihood is that your traditional software
is more vulnerable than your applications within the cloud.
Another misconception regarding cloud apps is that they are all equal when it comes to securing them. This should not be the case. Each app is used for a different purpose and
thus the app should be secured in a manner best suited to its purpose taking into account the type of data it processes, who is using it and for what it is being used. Each app should be secured independently and comply with a unique and specific security policy.
Data in a public cloud and security
A very common misconception is that if you have your data in and are serviced by a public cloud, others using that cloud can access your
data and you will also be more vulnerable to attack from others utilising the same public
cloud. This is not the true. You are sharing the cloud resources with others but you are secure within the multitenant environment if the proper measures to segregate data are in place. Precautionary security measures like encryption and access control need to be in place to ensure that a breach is not likely to
occur.
Data security, not as secure in the cloud compared with secured on enterprise premises Some businesses question the level of security offered by a cloud vendor. Theyoften incorrectly consider their data to be more secure on their premises behind their own
firewalls however this is not always the case. Cloud vendors place all their efforts and resources into ensuring that their data centres are as secure as can be. They conform to strict compliance standards and access to
data is strictly controlled with physical and biometrical parameters. Whereas on premise access to company data, from within the
enterprise, is often very relaxed with servers holding critical data usually not secured and access to the data easily achievable by employees hence easily breached, often the result of inside attack. Cloud vendors offer numerous data centres,
backup, disaster recovery and layers of Security. Frequently audited to keep security up to date.
The truth is presently that data is likely to be more secure with a reputable cloud vendor than on most businesses own premises. It’s
becoming exceedingly difficult for businesses to stay on top of security, patches, upgrades and vulnerabilities with the same tenacity and
dedication of a reputable could vendor.
Outside threats, breaches and the cloud
Many consider the cloud to be more
vulnerable to outside threats than an alternate service delivery environment. This is not necessarily true. All environments need to be
secured adequately, to secure against these potential threats. Firewalls, vulnerability scanning, network security technologies and
encryption should be used but this is not unique to cloud environments but necessary for all environments. If the cloud is properly secured it does not have to be more vulnerable to outside threats or pose any heightened security risk.
This is a concern. It’s critical to many
businesses to have control over where their data resides for legal and other reasons. There is a misconception that if you use the cloud, you will not be able to choose the jurisdiction in which to keep your data. This does not have to be a concern. Many providers do offer
global data centre options and you can easily choose where to store your data. Data governance can be addressed as long as you choose wisely and use a provider that can
guarantee data accountability.
The misconception that the cloud provider is responsible for managing the data, controlling access and controlling utilisation of the service is common. The provider must ensure that their infrastructure and application is secure but it is the users obligation to make sure passwords are properly protected, devices correctly managed and secured and data is secured through encryption. Security will always be a shared responsibility between cloud provider and cloud user. It’s important to know your responsibilities to allow for the best possible attainable security.
Allocation of Responsibility
A common misconception is the allocation of responsibility when it comes to security of data. If something goes wrong who is responsible. Many would like to believe that once they’ve selected a provider they can clean their hands of any responsibility however
this is not the case. The customer is
ultimately responsible for their data and must ensure the security of that data. The reputable provider will do their best to secure their infrastructure but it is up to the
customer to make sure this is the case and that the data within the cloud is secure at all times. In the unfortunate event of something going wrong, of course the provider will hold some liability but the customer will also have to answer to any compromise of their data and be held legally responsible. And that is why it is highly recommended that you make use of a cloud managed service providers, who now takes absolute control of the cloud infrastructure and security. While you concentrate on what you can do best. Linx Networks Ltd is the number one when it comes to cloud managed services providing because of the way we handle it with our efficient service level agreements.
Cloud Certifications and standards
It is incorrect to assume that cloud standards or certifications provide comprehensive security assurance. This assumption is often
falsely made. Certifications alone should not be taken as proof that the provider will fulfil the compliance your business requires. At the end
of the day the responsibility to uphold that your security needs are being met and that your data is secure is with you, the consumer. Be sure that you are knowledgeable of the security procedures in place and those offered by the provider and that the security meets your requirements effectively.
