3 Problems Cloud Security Certification Can Solve

What if there were widely accepted standards for cloud security and, better yet, a universally recognized designation for “trusted” cloud providers?

The basic promise of cloud computing is undeniably appealing: Increase efficiency and reduce cost by taking advantage of flexibly pooled computing resources managed by somebody else.

Indeed, as Bill Brenner of CSO put it, “Given how expensive it is to maintain in-house hardware and software, the idea of putting one’s IT infrastructure in the cloud sounds downright heavenly.”

Unfortunately, this “heavenly” scenario is marred by real concerns about security – concerns which can range from network security basics like data integrity and identity management to abstruse questions of “local law and jurisdiction where data is held.”

Yes, cloud computing is changing everything from data center architecture to entire business eco-systems. However, as a new paradigm the many complex questions it poses, particularly when it comes to issues of security, governance, and compliance, are effectively preventing (or at least slowing) its widespread adoption.

So how would a Cloud Security Certification, such as that being proposed by the Cloud Security Alliance (CSA) help matters?

1. One standard cloud-specific definition for “secure”

“Security controls in cloud computing are, for the most part, no different than security controls in any IT environment,” the CSA writes in their recently released security guidance document for cloud computing.

“However,” the document continues, “because of the cloud service models employed, the operational models, and the technologies used to enable cloud services, cloud computing may present different risks to an organization than traditional IT solutions.”

A common, standardized definition of what properly belongs to cloud security would ensure that cloud providers and their clients operate with a shared, comprehensive view of the cloud security landscape and clear expectations of how it should be managed.

2. Streamline process for evaluating providers

The complexity of the cloud security equation and the fact that every provider addresses this complexity in its own unique way makes the process of mapping the security requirements of the enterprise to the capabilities of the vendor both difficult and time-consuming.

By allowing cloud providers to display a “visible seal of trust”, insists Novell’s Jim Ebzery, certification like this will give organizations “a simple way to assure their specific corporate security policies and regulatory concerns will be enforced in the cloud.”

3. Overcome security fears to Cloud adoption

Cloud technology can solve real problems faced by organizations and enterprises today and will play a major role in the evolution of IT infrastructure going forward. The continuing growth of this field will benefit everyone.

Nevertheless, the speed of this evolution, and the rate of innovation fostered by the cloud more generally, will absolutely be determined by the rate of cloud adoption.

The emergence of a generally accepted cloud security “seal of approval” should allay many of the concerns that stand in the way of this adoption and, ultimately, open the door to a future of practically unlimited opportunity.

What are your thoughts on a logo or certification program for the cloud?

Originally published by Jim Reavis on the Cloud Security Alliance Blog.

Related Posts

How Android Security Stacks Up Today's smart phones have all the speed, storage, and network connectivity of desktop computers from a few years ago. Because of this, they're a treas...
Mozilla Debates Whether to Trust Chinese CA Sometimes geeky technical details matter only to engineers. But sometimes a seemingly arcane technical decision exposes deep social or political divis...
New Security Threat Against ‘Smart Phone’ Users Computer scientists at Rutgers University have shown how a familiar type of personal computer security threat can now attack new generations of smart ...
A Comfortable and Secure Login Method As most Internet users know, it is often hard to remember or keep apart all the passwords and login names for one's different online accounts. Dr. ...
Removing the RSA Security 1024 V3 Root There’s been confusion today about the work we’re doing on our root store, the set of trusted certificate authorities shipped with Mozilla products. T...
How to manage disk encryption passphrases and key slots Disk encryption is one method you may use to enhance the physical security rating of your computer. From my experience, it is rarely used, which is a ...

We Recommend These Vendors and Free Offers

Launch an SSD VPS in Europe, USA, Asia & Australia on Vultr's KVM-based Cloud platform starting at $5:00/month (15 GB SSD, 768 MB of RAM).

Deploy an SSD Cloud server in 55 seconds on DigitalOcean. Built for developers and starting at $5:00/month (20 GB SSD, 512 MB of RAM).

Want to become an expert ethical hacker and penetration tester? Request your free video training course of Online Penetration Testing and Ethical Hacking

Whether you're new to Linux or are a Linux guru, you can learn a lot more about the Linux kernel by requesting your free ebook of Linux Kernel In A Nutshell.


Leave a Comment

Your email address will not be published. Required fields are marked *

*