Common Gotchas: Cloud Security Problems to Avoid

Cloud computing security can be a conundrum. The point of using the public cloud is to outsource certain infrastructure and application needs to third party providers, after all. How can you secure your data once it leaves your perimeter and your control? As puzzling as it may seem, there is hope. Luckily for organizations looking to adopt the cloud, securing sensitive information outside the corporate perimeter isn’t as daunting (or as impossible) as it may appear. Technologies exist to enable cloud computing security strong enough for companies to remain in compliance while taking full advantage of the flexibility, agility, and economies of scale of the cloud. Avoid these common pitfalls for a secure cloud experience. PITFALL 1: ASSUMING THAT RESPONSIBILITY FOR CLOUD COMPUTING SECURITY RESTS WITH YOUR CSP If your cloud service provider is the one housing your data, then doesn’t responsibility (and legal liability) rest with them when it comes to cloud computing security? It stands to reason but isn’t true. While recent revisions to data privacy regulations like HIPAA do specify that third party contractors bear some responsibility for data security—and while CSPs take security very seriously—that doesn’t shift the burden from covered entities at all. In the event of a breach of your organization’s data, your organization will be still be held liable and still have to make a public breach disclosure. Look for ways to retain control over the privacy and integrity of your data no matter which CSP you choose. PITFALL 2: NOT ENCRYPTING ENOUGH Your key vulnerability lies in the public Internet connections that data has to traverse between your perimeter and your CSP’s, right? Not quite, and therefore encryption in transit isn’t enough. Encryption in transit is a cloud computing security standard, of course. It protects data from would-be eavesdroppers while that data’s en route from your premises to the CSP’s. Data should always be encrypted in transit. But encryption in transit is only one part of the story. Last year, the NSA’s MUSCULAR program made waves when the news came out that the agency had tapped directly into Google and Yahoo internal networks in order to intercept data as it moved between their data centers. Encryption in transit wouldn’t be much help there. Choose a cloud data encryption solution that will protect your data every step of the way—in transit to the cloud, at rest in the cloud, and even while in motion or in use in the cloud. PITFALL 3: FORGETTING YOUR NEIGHBORS As one of many customers of a public cloud provider, you’re analogous to a renter in an apartment complex. Multi-tenancy can raise cloud computing security issues. Fortunately, taking steps to secure your data addresses those issues. Choose a cloud data encryption solution that gives your organization exclusive access to the encryption keys. This way, even if your data is inadvertently leaked or disclosed, no one can read it or do anything with it without your knowledge and consent. Cloud computing security concerns can make companies hesitant to adopt the cloud, but they don’t need to be. There is a solution to the data privacy challenges created by the cloud, and that solution is control. Maintain control of your data from the moment it leaves your perimeter throughout its life cycle in the cloud and maintain control of your encryption keys, and your data can remain safe no matter where it roams.

*** This is a Security Bloggers Network syndicated blog from CipherCloud CASB+ Platform | Enterprise Cloud Security authored by CipherCloud. Read the original post at: https://www.ciphercloud.com/blog/common-gotchas-cloud-security-problems-to-avoid