Putting data “into the cloud” isn’t just about theft of data (that’s obviously one very important part of information security).
Information Security Management includes, at the very least: a) Ensuring that non-authorized parties don’t get access (so theft of online data via application vulnerabilities, vulnerabilities in the provider’s infrastructure, theft of data at rest, theft of data in transit) b) Ensuring that authorized parties do have access (e.g. ensuring that denial-of-service attacks against the application, authentication services, utility services can be mitigated, and when the sh*t does hit the fan, you don’t get finger pointing between suppliers) c) Ensuring information assurance: the data is valid and accurate (i.e. not corrupt or tampered with) and that the data can be restored to known good values (if required), and that there is adequate audit logs of access and potentially changes) Aside from information management, there’s the whole other realm of how a business extends their other services (request, release, change, incident/problem etc. management) into a different environment. Do you have the skills, processes and appropriate technology (including license agreements etc.) to adequately manage and monitor this environment to your necessary regulatory and service level requirements? For small(er) orgs this is generally not really too much of an issue. But as the org, tech footprint and regulatory burden gets more complex, it rapidly becomes a nightmare. For large orgs, especially in regulated environments, there are reams and reams of requirements, and getting this all squared up in a new environment (external or otherwise) is quite cumbersome. From: ozdotnet-boun...@ozdotnet.com [mailto:ozdotnet-boun...@ozdotnet.com] On Behalf Of Greg Keogh Sent: Thursday, 26 February 2015 6:18 PM To: ozDotNet Subject: Re: Azure and security trust (resend due to forgetting to remove the quoted content and thereby blowing the post size limit) Chaps, thanks for the great comments on this. I've forwarded a paste-up of the important parts to the person I'm working with on the hospital data. Next time I talk to someone who manages web servers or an IT department and I get the old argument that they don't trust putting data in the cloud, I'm gong to ask them to explain to me what their policies are regarding backups, security defense, threat models, intrusion detection, etc, and what skills they have. When I get a confused and indignant reply I can take the high ground in the argument and borrow some points from what Greg L said. Now that we know that major governments and security services are spying on us by devious means, I guess there's nothing you can do against that (or a court order) without politicians getting involved. However, that's not a typical threat to a business application containing personal information. Hospitals aren't worried about ASIO stealing their databases, they're worried about complying with state and federal laws, and from what I've read so far, Azure management seem to be working hard to build trust in this area. I'm certainly feeling much more confident about Azure security after what I've read in the last couple of days. I'm going to continue to develop the demo in Azure anyway, as it's really convenient. Greg K
