Cloud Security: Solutions for four customers

Some people think that cloud security is the most difficult problem in the industry, and they will not be resolved in the near future, but some people think that cloud security is not a big problem, because with customers than cloud service providers have more stringent security measures.

In many surveys on this topic, security issues are always a major concern, and they become a top priority for many it stores. There are already a number of innovative security standards that may eventually help eliminate some problems, but there is still a long way to go before these standards are introduced.

Now there is one thing to be clear, i.e. do not make any assumptions until you have conducted a full investigation in person. Jay Heiser, an analyst at Gartner, a marketing research firm, has been working on the potential risks to companies and regulations. "It's nice that service providers may be doing a lot of work protecting data, or creating a better security application framework, but the big question is how you're sure they're doing it," Heiser said. Providers cannot (through testing and data validation) prove the safety of their products as they advertise. In this way, you will not be able to make decisions about whether or not to choose them. ”

Fred Cate, director of the Network Security Applied Research Center at Indiana University's Morilfa College, said the biggest problem facing the company when it comes to cloud security is who should be held responsible for the law.

Cate said: "Cloud service providers believe that the company should be responsible for this, while the company believes that the cloud service provider should be responsible." To address this problem, some companies have opted for trusted service providers such as Microsoft. "However, he points out, this approach leads to a significant reduction in customer selectivity and does not guarantee data security, as you simply choose a well-known service provider for your cloud infrastructure."

Fortunately, some of the new technologies are helping to secure the cloud, at least for employees making it harder to advertise intellectual property or sensitive data to the public cloud.

United Airlines: Deploying cloud computing on airplanes

United Airlines is embarking on a radical experiment. United will offer 10,000 Apple ipads to crew members this year. These ipads will replace the storage manuals, charts and other flight kits for the sensitive information used for flight preparation. The crew members can access a hosting service provider such as Jeppesen to obtain an online flight manual service. United also used the ipad as a communications tool to update corporate news and employee information.

John Van Hoogstraten is the managing director for IT security and risk management at United. He said the company tended to develop cloud-related deployments, but because mobile devices such as the ipad had many advantages, they could no longer postpone the deployment, which included better management of flight manuals and lower fuel costs, as crew members no longer had to carry heavy flight packs.

He said the company is currently using Symantec's products for identity management and virus protection, and next they will consider deploying a single sign-on product called Symantec O3 Cloud Identity and access control to perform a single authentication process.

John Van Hoogstraten, managing director of IT Security and risk management, said they were considering using a single sign-on technology to simplify the certification of cloud software.

Hoogstraten: "We need to use a secure certification system to ensure the identity of those who use the ipad, especially when pilots fly to third-world countries that lack security." "His plan is to use single sign-on because it can access United's Active Directory system and provide a portal for crew members visiting the service provider." This means that pilots do not have to log on to different services multiple times, which can save pilots ' time.

Single sign-on is one of the most common new mechanisms for dealing with cloud security issues. This means that there is only one point of failure in the event of a problem. O3 will run as a tool in the data center, which means that all cloud accesses will flow through the device, which may slow down the connection.

"Single sign-on solves the fundamental problem of cloud security: the balance between convenience and security," Heiser said. Of course, certification is not always the biggest problem. Let's review a Gmail (password) incident. In an accident, people can easily get access. Many companies should be aware that passwords are flawed. ”

To address this problem, Symantec uses two-factor authentication. Typically, employees need the tag ID and password installed on the ipad to gain access to the cloud service.

Cate says a secure solution to dealing with new security issues like ipad access to corporate systems is to make security audits part of the deployment content. One of the benefits of security audits is that you can identify potential risks, such as over-reliance on a particular strategy. "If you store a lot of data in one place, the more likely you are to be targeted, the more you deserve the hacker to spend time attacking you," he said. ”

Security assessments, he says, need to be meticulous, in addition to data storage and strategy, to check for specific devices such as ipads or smartphones. This means using automated risk management tools and conducting risk assessments. For example, the United Airlines pilots will be the first to use the ipad exchange of news in the company. If executives decide to deploy tablets to ground crews, the company should assess the overall risk.

"Every company should consider these questions: if so, how much trouble would it be?" What is the risk of doing so? Do not focus on the problems of legal production, but on the corporate reputation and shareholder impact. ”