Can You Trust Your Cloud Infrastructure Provider

Making the decision to outsource cloud hosting services is not always easy, the keyword here being the word TRUST. You may be continents apart with your cloud provider, which therefore means that you will have to rely on their word when it comes to quality service provision. You will not be able to physically verify their infrastructure or even visit their business premises thus making the decision much harder. The argument that most employers give is that how can I trust a third party with critical data, if I cannot even trust my own employees with it? I will discuss some of the common concerns amongst business owners when it comes to outsourcing cloud services, and how to minimize such risks.

Common concerns among subscribers of hosted cloud services

Compliance with IT standards

Most people are usually concerned whether the service provider has fully complied with IT standards, which is a legitimate cause of worry because it determines a lot of things such as data security, compliance with safety & regulation measures and availability of quality equipment. Lack of compliance may easily be transferred to the subscriber and may end up affecting the business operations.

It is therefore very important to ask for relevant documentation, licensing and certificates before you get into business with any cloud service provider, for your own safety.

Data security

The moment you store your business data with an outsider, it`s safety and security is no longer on your hands. Thus, any breach on the cloud provider`s firewalls will leave your files exposed to people who may use them against your company. It is therefore very important to enquire from your provider the measures they have taken to ensure that their system is secure.

You cannot also leave the security of your files on your provider alone, and you will thus have to take steps to ensure that any breaches of security on the public cloud will not cripple your company`s operations. This may easily be achieved by hiring IT technicians who will monitor the cloud on a regular basis and report any issues of downtime or when they notice anything fishy is cooking on the system. Sometimes it is difficult for the user to know if their system has been breached because hackers are always careful to cover up their tracks but an ethical hacker may have a clue when this happens and may come in handy in terms of damage control. It is therefore advisable to have an ethical on your side. This is a good example of the common saying `set a thief to catch a thief. `

Another great way of ensuring data security is storing critical company files on a private cloud, if indeed you have one, and less critical files on the public cloud. This will ensure that in case of a breach on the public cloud, nothing critical will be exposed. However, if your company does not have a private cloud to store such data, you will need to invest in a few dedicated servers for your own security.

Control over data

The decision to hand over organization IT admin tasks to an outsider is not always easy, because the outsider`s employees will have access to the data and may collaborate with your competitors in order to sabotage you. It is therefore very important to enquire from your service provider about the number of their staff who will have full access to your company files and their profiles. After that you may decide to choose a few who you deem as trustworthy as the only ones who will have full access and rights over your files. Reducing that number makes it easier to follow the trail in case there is a breach. This is usually very critical because being in bed with untrustworthy individuals may harm your company and because they have access to the logs, they may easily cover their tracks. You can also take matters on your own hands and have passwords which are not easily cracked. Making use of data encryption will also go a long way in ensuring that your data kept safe from preying hands.

Control over accesses

The cloud provider will have access to your firewalls, restrict rights & permissions. It is thus very important to enquire from your provider the measures they have taken to ensure that their employees do not abuse such rights. Always ensure that someone from your IT department keeps your cloud provider accountable, so that the accesses are properly managed.

For your own protection, you should request for a service level agreement (SLA) which will give your CIO the rights to examine system logs after a certain time frame.

How to ensure that your files are safe

• Check the hosting company reputation – Your reputation always precedes you, and a good hosting company must have a good track record. Before you trust anyone with your data, do a thorough research and enquire from its previous clients about their experience and whether they were satisfied with the company`s way of doing business. Check whether the company has had any breaches since it started operating, and if there were any breaches how they were handled. Also, check how long they have been in business- you don’t want to store your data with a company that goes under after a few months of operation, and with it goes your data.
• Check how often the cloud provider scales up their security firewalls – lack of periodic security updates will easily lead to a breach which may be very catastrophic to everyone who has stored their data with that particular company.
• Conduct a thorough audit of your cloud service provider or request for an independent audit report before choosing any provider. This is very crucial because you will have a chance to study their security compliance and whether it is relevant to your organization.

All in all, we trust cloud providers with our data because they are generally expected to have better resources than we do, but it doesn’t hurt to keep them accountable because it is for our own safety. This is just the same way we expect banks to have better resources to keep our money safe, compared to just keeping it at home.