Security Basics: How well do you know about cloud security data protection?

At the RSA conference in 2009, a disturbing study was released: Companies that use cloud computing services are concerned about security issues, but they do not verify that suppliers are cashing in on their security commitments.

Although most respondents to the Deloitte Institute's survey of Cloud computing services said they had signed a security demand contract with service providers, 82.6% per cent said they did not plan to verify the supplier's actual work.

This problem involves many levels. Higher-value data can be lost, tampered with, or stolen. Although the supplier agrees to protect the data according to the user's requirements, they also have an unshirkable responsibility once the user's data is compromised.

So once the user's credit card number is compromised, the enterprise that promises to protect the data in the cloud has an unshirkable responsibility and may also need to bear legal responsibility. The user may claim a portion of the compensation from the supplier, but this step is often followed by lengthy legal proceedings.

If these data are compromised and must be told to the public, the blow to corporate reputation is not only bad, it may be irreparable.

While it is important to reach a legal agreement with suppliers, the user must take other steps:

Verify that the supplier has indeed taken appropriate measures to protect the data;

Perform a pilot operation of the service and ensure that the data is properly protected, stored, or even regularly destroyed in accordance with corporate policy. For an enterprise, data can be destroyed only when the service agreement is over.

Read the contract terms that the supplier has given you. But many users do not.

It is important to sign a contract with a supplier, but the contract itself does not protect the actual data.