Security Requirements for cloud providers

For some people, Cloud is a great opportunity to change the way they work. For others, the cloud is more like a fuzzy concept. Although I am a cloud service fan, but also cannot blindly choose cloud. If you have a cloud service to resell, you need to ask the cloud provider for security. Independent cloud audits are based on SAS70 (developed by the American Society of Accountants, AICPA, the provider you choose should be able to show you cloud performance and security data for the financial services provider's internal controls, security, audit standards for customer services, cloud trusts, cloud audits, or other cloud auditing standards. You certainly don't expect providers to disclose every detail of their work because it poses a security threat to itself. But you can get a comprehensive report that provides a summary of the content, findings, and fixes from a business perspective. If the business requires other details for legal and audit purposes, your provider should be able to customize the report for you. If you need additional detail, you can ask them if they can provide an overall independent vulnerability assessment. But this is a way to pay an extra fee. Cloud Security: Intellectual property in the heart of any cloud service, there are a staggering number of virtual machines running on multiple blades. These machines are likely to share your information. So be aware that this environment meets your desired level of security and effectiveness. High-security virtual machines must be paired together, with additional security controls exceeding the standard security configuration. Lifecycle management and tracking meta data not only do you need to worry about information security, but also worry about the metadata that is near them. If you receive an attack, you may need to provide electronic evidence to illustrate what happened, such as access time and login credentials. In addition, you should know how to destroy a virtual machine when you don't need it. Because they are likely to still have information. A security checklist and virtual machine Permanent elimination scheme will make you sleep more soundly at night. Cloud security: Physical security undeniable, I am a bit paranoid, perhaps the cloud provider's physical data center site will question: "I do not have staff to control it?" "But the simpler the facility the better." In data centers, mission-critical systems must be physically detached and have physical access control. What security controls are you responsible for? Once you put the business process into the cloud, it doesn't mean you don't have security responsibilities. You have to be clear about your responsibilities and those of your provider. This article is certainly not a comprehensive list, but there are still some thought-provoking things. Rigorous cloud providers certainly understand this, and they can provide most of the information above. And those that are not available are not the cloud providers you are looking for. "Editorial Recommendations" RSA General Assembly Procedure Committee Chairman Mao Wenbo: "Cloud security" is still in the infancy cloud security remains a problem for program developers the thinking and prospect of cloud security protecting the API keys in the cloud improve enterprise cloud security Websense: Create the landing "flower" cloud Security "responsible editor: Shang Micro TEL: (010) 68476606 "to force (0 votes) is tempted (0 Votes) nonsense (0 Votes) Professional (0 Votes) The title of the party (0 Votes) passed (0 Votes) in original text: Security requirements for cloud providers return to network security home