Cloud compliance: How to manage SaaS risk

By Joel Dubin, Contributor | Dec 8, 2008

1 comments

Facebook

LinkedIn

Digg

Being an information security pro means learning how to deal with headaches. As if worrying about securing data within a corporate network isn't enough of a headache, securing data when it's in somebody else's network is even more complicated.

In a nutshell, that's the security issue surrounding hosted software, so-called cloud computing or Software as a Service (SaaS).

At first glance, SaaS might seem like a glorified version of third-party outsourcing. Many companies send data out to third parties, particularly those that process credit cards, but SaaS is a bit different: The third party hosts the software and manages the deployment and infrastructure. Instead of purchasing and installing software, a company links up with the SaaS provider, often via the Internet. SaaS is usually business driven for reasons such as availability, ease of management and cost-cutting.

Some well-known SaaS providers are Google Inc. and Amazon.com Inc., which offer applications as services through their networks. Other examples are Salesforce.com Inc., which offers customer relationship management (CRM) software online and Qualys Inc., which offers on-demand security monitoring and scanning of all things, including those mandated by PCI DSS itself.

SaaS and compliance
Basically, the same security concerns companies already have within their own networks -- securing networks, hardware, applications and data -- apply for companies outsourcing their data with SaaS. However, when compliance with government regulations like Sarbanes-Oxley (SOX), Gramm-Leach-Bliley (GLBA) and HIPAA, and industry standards like the Payment Card Industry Data Security Standard (PCI DSS) is thrown into the mix, things can get messy.

Before SaaS, compliance success could typically be boiled down to a few key tasks: identify users and access privileges; identify sensitive data, where it's located and how it's encrypted; and document all of this for auditors and regulators. SaaS makes these processes more complicated. Theoretically, an enterprise has full control of its data, but in reality it may be difficult for a customer to discern where its data resides on a network controlled by its SaaS provider, or a partner of that provider.

1 comments

Facebook

LinkedIn

Digg