5. Cloud Computing Security

Security aspects of cloud computing draw much attention. Many cloud customers feel that their lack of control over hardware and software makes their information vulnerable for compromise on the cloud. The security issues surrounding the cloud vary among the different types of cloud services such as SaaS, PaaS and IaaS. Among the cloud deployment models only the public cloud has several vulnerabilities. Businesses feel that since they do not control the cloud infrastructure any data stored in the cloud is insecure. It is more a perception issue than something that is inherently insecure. The cloud service providers are trying to reassure the public of their security practices and provide third party audits to back up their claims. Moreover, all the major service providers seek the enhanced SSAE 16 Type II Audit and the ISAE 3402 international reporting standards compliance certification. In this chapter we will analyze the security implications for businesses from the perspective of compliance with laws and industry standards as well as certifications carried by the service provider. Moreover, the service providers facilitate implementing both access control mechanisms and organizational control policies to limit the number of privileged users with access to customer data. Also, we discuss the proactive steps an organization could take to protect their data in transit and storage.