July 31, 2017 | By Ryan Felkel
Organizations of all sizes are moving to the cloud to maximize on its cost benefits, flexibility, and scalability. But adopting a cloud strategy can also bring with it a host of new challenges, the most crucial ones of which are data protection and regulatory compliance. Regardless of industry, there are a number of government regulations that organizations should adhere to when handling personal data.
Being able to achieve at least an adequate level of compliance in the cloud requires some changes in the company’s approach to data protection because you are essentially moving from internal security to external security where many factors could be out of your control. That said though, there are a few basic points that should be kept in mind when navigating the complicated waters of compliance in the cloud.
Encrypt data at all stages.
A minimum requirement of many compliance regulations is data encryption. Encrypting data, both at rest and in transit, is not only considered a best practice when it comes to data protection but also contributes to meeting compliance requirements for many privacy regulations. Some regulations that have supporting encryption requirements include the Payment Card Industry Data Security Standard 3.0 (PCI DSS 3.0), Gramm-Leach-Bliley Act (GLBA), Sarbanes-Oxley Act (SOX), Health Insurance Portability and Accountability Act (HIPAA), among others.
Be on top of access control.
A key component in IT security compliance is being able to show that proper access controls are in place. At the core of this security practice is the goal of keeping data private and confidential, and therefore only appropriate users should have access to it, with even fewer individuals having control over access rights. Even if a part of your organization’s network infrastructure and perhaps a huge chunk of your data now reside in the cloud, the same degree of vigilance should be exercised over user access controls. This aspect of network security and maintenance should be one of your primary considerations when choosing a cloud service provider (CSP).
Remember that security is a shared responsibility.
While achieving cloud compliance may be a daunting task for companies and business owners, one thing that could make the load lighter is the fact that security has become a shared responsibility between the organization and the CSP. In an effort to strengthen the case for cloud adoption, most established cloud vendors have also improved their overall security controls to assist corporate clients in meeting compliance demands. It’s not even uncommon these days to find SLAs that stipulate the role that the CSP would take in mapping and assisting the customer in audit and compliance activities.
Regulatory compliance is always founded on security. The potential security risks and compliance issues of a cloud strategy should be brought up early on with the key stakeholders to ensure that risk assessment, budget alignment, and the important SLA terms with the cloud vendor are in place to ensure a smooth transition to the cloud.