I recently read an article on cloud computing security and implementation. Always considering moving legal “enterprise software” to the cloud, it reminded me how important it is to insure the utmost security for clients. The subject of security in a cloud environment is expansive, but here are a few things to look for in a cloud provider:
- Access Control
It makes a user feel secure when asked for passwords, etc., but how secure is your provider’s routine maintenance and other back-end and front-end performance controls? This leads me to the next point… - Internal Management Control
In other words, who in the “cloud” organization is authorized to view your information? Most cloud vendors have secure procedures in place. One of the benefits of cloud computing is it circumvents storage of information on the in-house server; less risk of information leaking. Very few cloud companies have had problems with internal “leakage,” and those that have are probably, newer. When dealing with a cloud vendor, just make sure the internal process is secure and proven. - Internal Security
A quality cloud software provider will have a secure authentication and authorization process in place, but not to the point of being annoying (of course). IP addresses should be checked and security breaches should be easily flagged. - Encryption
This is kind of a no-brainer. Again, most cloud vendors honor this obvious requirement, yet some vendors either do not or cannot have encrypted information within the cloud. Internal encryption is the best case scenario and it’s something you ask for from the cloud software vendor. Additionally, the Federal Information Processing Standards (FIPS)-140 security standard specifies the requirements for cryptology modules. - Internal/External Audits
Even with all of the security red tape, intrusions still occur. How does your vendor detect a breach? The vendor should be capable of monitoring and measuring any breach of information and how will they communicate that to you? These are very important things to keep in mind when signing a service agreement. - Disaster Recovery
This is a must; every cloud vendor needs to have a back-up plan. They should be able to communicate this plan to you. This plan should be as solid as the back-up plan they have for the software itself. Also, any impending disasters should be communicated to you, in addition to how the disaster will be handled. All data should be protected at every level – no ifs ands or buts.
Cloud computing is a brave new frontier and there are many things to learn. What do you look for in a SaaS vendor?



