An article from Network World:
==
"In almost all cases if you have a IaaS or PaaS service then you
should be encrypting your data at rest. Be sure the Key server is not
also stored in the cloud service as this would defeat the purpose. Have
the key server be at your corporate site or some other site not related
to the cloud provider. Why should your data you ask? Well, in a nut
shell when you move data the question of "Is it still just your data"
becomes a very real one.
Cloud providers are subject to law enforcement subpoenas,
surveillance and data seizure activities that you wouldn't normally be
subjected to in your own Datacenter. Loss of 4th amendment rights for
US companies are also at issue. By moving data to a cloud service you
may be decreasing your protection from search of your data by law
enforcement and civil plaintiffs? A warrant with a gag order mean
that’s that your cloud provider must provide your data without notifying
you they did so. Ability to protest a warrant is also compromised
because the warrant is issued to the provider not your business. There
is no legal obligation for the cloud provider to inform their customers
that data was given because of a court order, etc.
In one case the FBI seized assets the physical assets/servers from a
co-location provider. Over 50 innocent companies were shutdown in the
process because their data was intermingled with the FBI target. Read
more here FBI
raids Data Center . When one of the affected companies tried to
sue the texas court ruled that the FBI had the right to do this."
==
"Cloud services do not lend themselves well to the methodical collection
of digital forensics. If you do have a security breach, digital
forensics become critical to finding out how extensive the breach was.
Several state and local governments now have "breach notification" laws
on the books. In addition the healthcare hi-tech law and PCI require
you to notifiy customers of a breach. The notification methods
sometimes vary based on the size of the breach. Be sure your contract
provides you with the necessary forensics capabilities you'll need.
Chain of custody is also an issue. Be sure your provider will not
hamper your ability to prosecute criminals. Ask them about how they
handle log and other important data."
==
"An often-overlooked issue is how cloud providers deal with the
protection of your data during and after a natural disaster. For
example, if a hurricane hits their datacenter and rips it apart what are
their procedures for keeping your data secure. In many cases the
physical access controls will be rendered inoperable by the storm and
worst case servers could be strewn throughout the site. They need to
show you a comprehensive plan for securing the site and your data during
the clean up effort. You don't want volunteers picking up the pieces."
==
http://www.networkworld.com/community/node/61877
Just some things to think about for those who think I'm being a ninny about security in this whole "move to cloud" game. IMHO, cloud will be another option in the mix--it won't "take over the world." People are getting more concerned about their privacy, not less. For instance, see:
http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2010/05/30/BUPP1DL6DN.DTL
http://www.washingtonpost.com/wp-dyn/content/article/2010/05/28/AR2010052804853.html?hpid=topnews
(removed a section here, because of corrections to the second article above)
Of course the answer will be, "just don't put your data in there in the first place," as it always is. But then I'll say what I've always said--that's not a realistic answer. The realistic answer is--put your data in there, and I'll let you keep it where you want it, rather than where I want it.
:-)
Russ
