Data security in cloud computing
Data security in cloud computing is on top of the list of cloud concerns companies have. Cloud computing does simplify the way we do business, but it is still highly vulnerable. Public, private or hybrid cloud business solutions are all susceptible to threats that could seriously harm any company that uses them. Companies do expect the providers to manage the entire cloud infrastructure, but are often hesitant in giving them access to sensitive data. Everyone wants to use the cloud because it has lower costs and sustains new and agile business models. When it comes to data security in cloud computing, companies have to understand how this is different from any other solutions.
The security challenges companies have in cloud computing are various and include the need to protect confidential business, regulatory, or government data; cloud services have multiple tenants that share the same infrastructure; data mobility and legal issues must comply to various government rules such as the EU Data Privacy Directive; there are no clear standards about how cloud service providers recycle disk space and erase existing data in a secure manner; there are various auditing, reporting, and compliance concerns; key security and operational intelligence is no longer visible and available to the company’s IT security intelligence and risk management.
All of these challenges show the security risks a company faces when working in the cloud. Companies not only worry whether they can trust their employees, but also whether cloud computing providers can provide the much needed protection in such an environment which not only has more than one tenants, but might also store the data of other competitors. There is also a lot of concern about the safety of moving data from the company to the cloud. Cloud computing brings new challenges in securing data, and one of the challenges is to protect data as it is moved between the enterprise and a public cloud service. These security challenges are common to each and all of the three cloud service models currently in use, Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS).
The strategy of a company that wants a comprehensive data security in cloud computing should be based on an approach that addresses both compliance requirements and actual security threats. This should include sensitive data securing, an appropriate separation of duties between IT operations and IT security, making sure that that the use of cloud data is in accordance with the existing company policies, and strong key management and strict access policies for all users. An effective cloud security solution must have three key components in order to properly work, and these are data lockdown, access policies, and security intelligence.