Cloud computing network security best practices

RELATED CONTENT Network security threat management Is it enough to analyse log files, or is an IDS necessary? What to look for in a network security audit How to address a spike in TCP and UDP flows How secure are extended validation SSL certificates? What should happen to users and devices that fail NAC policies? When to use a unified threat management system When IT security costs are cut, which security product is a must? What considerations should be made when outsourcing IT infrastructure? When running Wireshark, will adding a switch stop packet sniffing? How to enable a local keyboard after an RDP connection Security for Cloud Computing and Hosted Services Microsoft's Charney details new botnet protection, IdM technology at RSA Cloud-based services require stalwart business continuity plans Cloud security issues, targeted attacks to be hot-button topics at RSA Cloud Security Alliance releases top cloud computing security threats Cloud computing compliance: Exploring data security in the cloud Maintaining security after a cloud computing implementation Preparing the network for a cloud computing implementation Cloud Security Alliance releases updated guidance Cloud computing data security starts with internal strategy, experts say Secure cloud computing: a contradiction in terms?

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

EXPERT RESPONSE FROM: Peter Wood Pose a Question Other Security UK Categories Meet all Security UK Experts Become an Expert for this site

ANSWERED June 2009:
There is a distinct lack of security visibility in cloud providers: "You can't know where your data is, you can't prove that it's being protected and you can't know who's accessing it." according to Robert Richardson, director of the Computer Security Institute.

Cloud computing places the burden of security on the provider, but doesn't relieve you of the responsibility for protecting personal and sensitive data. Therefore it becomes essential to conduct a thorough review of the provider's security to ensure good governance. This means inspecting their information security policy and procedures against proven standards, such as ISO 27001.

You must also ask for proof of their staff vetting and management processes, as well as their technical infrastructure. They must be able to assure you of their data security controls, such as encryption of data, both in transit and at rest. The provider should be able to demonstrate that it conducts regular, independent audits and penetration tests, and be willing to share the results with you. Your contract should also give you the right to conduct audits and tests of your own.