How to Secure Your Cloud

There's been a great deal of debate, as well as erroneous assumptions, being cast about regarding cloud computing, particularly the use of public cloud services. However, a strong, well-thought-out architectural approach can make cloud computing just as safe as a locked-down on-premises system.

That's the word from Mike Kavis, a seasoned chief technology officer and IT architect. In his new book, Architecting the Cloud: Design Decisions for Cloud Computing Service Models, Kavis shows what steps companies should take to keep their data and applications safe in cloud settings.

Kavis provides three key security strategies to ensure the highest level of protection in the cloud, as well as three distinct actions.

The three key cloud security strategies consist of the following:

1. Centralize: Consolidate “security controls, processes, policies and services, and reduce the number of places where security needs to be managed and implemented.”
2. Standardize: Develop standardized security services and mechanisms “that can be shared across the enterprise, not a solution for a specific application.” Kavis recommends subscribing to industry best practices, l as encryption, authorization and API tokenization.
3. Automate: Bake security into all processes without the need to human intervention.

If these bits of advice all look familiar, they should. They are best practices that have been established for security in the days of on-premises systems. Cloud doesn't make security any easier, not does it shift the onus to some outside provider. As was the case 10 years ago, security needs to be front and center in the enterprise.
As Kavis puts it, cloud consumers need to “apply security best practices to applications and services, monitor and detect security issues, and practice security prevention by addressing issues found by monitoring logs.” All basic stuff — the kind of things enterprises should have been doing 10 years ago. The methodologies, tools and standards are already available.

Joe McKendrick is an author, consultant, blogger and frequent INN contributor specializing in information technology.

Readers are encouraged to respond to Joe using the “Add Your Comments” box below. He can also be reached at joe@mckendrickresearch.com.

This blog was exclusively written for Insurance Networking News. It may not be reposted or reused without permission from Insurance Networking News.

The opinions of bloggers on www.insurancenetworking.com do not necessarily reflect those of Insurance Networking News.