Overcoming cloud computing security challenges

By Michael Cobb | Feb 1, 2010

1 comments

Facebook

LinkedIn

Digg

As information security program managers begin the new year, it's common practice to identify the key themes that will affect an enterprise security strategy.

However, there's one theme that arguably stands out above all others: cloud computing. The tough economic climate does help make the case for cloud computing very persuasive. Because on-demand resources are dynamically scalable and flexible; on-demand resources have been the hot topic of 2009 and will always be attractive to businesses large and small. Whatever the state of the economy during 2010, cloud computing will surely continue to change the way we do IT.

For everyone involved in trying to protect their organizations' network users and data, a move to cloud computing will present a huge change and challenge. Compliance regulations will most likely prevent an enterprise from moving all its data and operations to the cloud, so the transition is in fact an additional security challenge on top of protecting existing network infrastructures. Moving to the cloud requires data and applications to be placed outside the comfort zone of well-established perimeter defenses and physical access controls. An increasing number of users who don't come under the controls of HR, such as suppliers, clients and partners, will access your data via Web-based collaboration tools. IT administrators already struggle with the task of securing mobile users who access corporate networks, but cloud computing is on a different scale altogether.

For me, one of the key security challenges is how to efficiently manage and enforce access control for employees, customers and partners beyond the enterprise firewall. Cloud computing turns us all into remote workers, and cloud applications and data, by definition, are outside the enterprise. This means that you can no longer rely on multiple layers of authentication, firewalls and other perimeter defenses to do the job for you.

Strategically, managing these challenges requires a number of actions. HR security policies must be reviewed and tightened up so they enforce robust lifecycle management of users. A detailed identity and access management strategy must also be put in place, one that makes full use of federated identity management, an arrangement that enables users to securely access data or systems across autonomous security domains. I recommend enabling single sign-on (SSO) within your own enterprise applications and leveraging this architecture to simplify cloud provider integration and implementation.

1 comments

Facebook

LinkedIn

Digg