Everyone seems to be talking about cloud and how great it will be at cutting costs by reducing manpower needed for maintaining on premise hardware. Cloud is the future they say. While this may be true, it is also true to be logically minded about what information you make available on cloud platforms and what should be the layers of security you place around accessing this information.
To place all your data on a cloud platform is daunting at best to most IT Security departments. So to help you in your journey to cloud I have listed what I feel to be the important factors that I believe should go into the decision-making process of going to cloud or not.
Factors that should influence your to-the-cloud-decision:
- Does your data hold any personally identifiable information?
- Have the subjects of this data been notified of the use and storage of this data?
- Is there any competitive advantage in keeping this information?
- Would you lose market share if this information was released to the public unwillingly?
- Would you suffer reputational loss if this information was released to the public unwillingly?
- Does cloud offer a competitive edge to your business if the information is made available on a cloud platform?
- Are there obstacles to offer an equally mobile solution to the business without going to public cloud?
- Can these obstacles be overcome be employing the right skilled resources?
- Can these obstacles be overcome be implementing the right levels of infrastructure internally?
- Is their budget constraints that make cloud more attractive to overcome these obstacles?
- Have you thought about the different ways someone can get at your information that is hosted on a cloud platform?
- Does your cloud platform allow for login to access the information?
- Is your password strong enough?
- Is the lockout policy enabled for incorrect login attempts?
- Do you have a strong complex password policy enabled for login?
Complex password policy would mean that at a minimum, your password is required to be 12 characters long, which will include both UPPERCASE and lowercase English characters as well as numerical values and special characters.
- Does the system use unique randomized usernames that are not easily guessed by looking at a LinkedIn profile or email address?
- When clicking on the “Forgot My Password” link and taken through your security questions process, are your security questions and answers easily guessed by looking at your social media profiles?
- Does the Cloud solution have brand uniqueness that cannot be easily replicated onto a fake portal where users are easily convinced to give up their login details to the real portal?
- Is your user base familiar with the terms “Browser Jacking”, “Spoofed Websites”?
- Is there any user awareness around being vigilant when capturing logon details on any of the cloud login pages?
- Can your users identify a fake login page?
- Do you scrutinize what information you place on the cloud platform OR Do you implicitly trust the cloud platform and upload any information you feel necessary?
- How easily can you categorize to your staff on what information is cloud safe vs what is not?
- Is the information that will be stored on the cloud platform going to be encrypted?
- What levels of encryption will be used?
By now, your brain is almost fried. You probably had a little cry from the stress levels of having to think about all that fun stuff, right? You’re on the right path if this concerns you.
It is absolutely the stuff you need to be thinking about when making that call to put your information on the cloud or not.
With the Internet of things approaching our sights steadily fast, you have to wonder, has you non-work life habits imprinted an appetite within your self-consciousness to already be ready to consume cloud services? Your personal appetite and experiences with cloud services also impact the decision to move your business data to cloud but the cost if compromised is so much greater with your business data.
Therefore you have to place your own personal beliefs aside when making this call and evaluate the cloud solution for what it is, a solution that offers ease of access of your information that must be coupled with strong security controls to mitigate any of the attack scenarios a bad actor might use to get at your data. The more informed you are the more armed you are in your decision to cloud or not to cloud…