Transparency Key To Cloud Security - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud // Infrastructure as a Service

Transparency Key To Cloud Security

Customers get help assessing compliance, security practices of cloud vendors through Cloud Security Alliance's STAR program.

Slideshow: Cloud Security Pros And Cons
Slideshow: Cloud Security Pros And Cons
(click image for larger view and for full slideshow)
Is secrecy the key to security? Not according to the Cloud Security Alliance, which is looking to gather up information on how cloud service providers are securing their services. The truth of the matter is that it is not secrecy that builds effective security; it is adopting and adhering to best practices and standards that create a secure environment--secrecy is best left to end users protecting their passwords and logon credentials.

Perhaps that is the point the CSA is trying to get across to the purveyors of cloud services with STAR, which is open to all cloud providers. STAR allows cloud providers to submit self-assessment reports that document compliance to CSA-published best practices. According to the CSA, the searchable registry will allow potential cloud customers to review the security practices of providers, accelerating their due diligence and leading to higher-quality procurement experiences.

The CSA claims that STAR will offer a major leap forward in industry transparency, encouraging providers to make security capabilities a market differentiator. Ideally, STAR can become another metric for customers to validate if a cloud service provider meets their internal security needs, especially in the world of compliance--where security practices are often dictated by law.

For those looking to build private clouds or internal clouds, the results of the assessment process could provide valuable guidance and clues on how to implement security for internal cloud services. What's more, the best practices offered by the CSA will further speed the security planning process for those building clouds.

CSA STAR will be online in Q4 of 2011. Cloud providers can submit two different types of reports to indicate their compliance with CSA best practices:

-- The Consensus Assessments Initiative Questionnaire (CAIQ), which provides industry-accepted ways to document what security controls exist in IaaS, PaaS, and SaaS offerings. The questionnaire (CAIQ) provides a set of over 140 questions a cloud consumer and cloud auditor may wish to ask of a cloud provider. Providers may opt to submit a completed Consensus Assessments Initiative Questionnaire.

Read the rest of this article on Network Computing.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Top 10 Data and Analytics Trends for 2021
Jessica Davis, Senior Editor, Enterprise Apps,  11/13/2020
Where Cloud Spending Might Grow in 2021 and Post-Pandemic
Joao-Pierre S. Ruth, Senior Writer,  11/19/2020
The Ever-Expanding List of C-Level Technology Positions
Cynthia Harvey, Freelance Journalist, InformationWeek,  11/10/2020
White Papers
Register for InformationWeek Newsletters
Current Issue
Why Chatbots Are So Popular Right Now
In this IT Trend Report, you will learn more about why chatbots are gaining traction within businesses, particularly while a pandemic is impacting the world.
Flash Poll