Article

Prasenjit Saha
Prasenjit Saha 6 May 2016

Best Practices For Technology Security Infrastructure Implementation

The structure of IT infrastructure is changing and with it, its security aspects. Gartner in its ‘Top Predictions for IT Organizations and Users for 2016 and Beyond’ reveals, ‘By 2018, 50 percent of enterprises with more than 1,000 users will use cloud access security broker products to monitor and manage their use of SaaS and other forms of public cloud…’

Yet, the security of the virtualized environment and the responsibility of ensuring regulatory compliance lie with the enterprise.

So, how do enterprises ensure security control over cloud data — its collection, storage, access, usage, transfer, and disposal? How can they ensure compliance with regulatory requirements?

Best practices dictate:

Control of input and access — Opt for cloud encryption CRM gateways, firewalls, inputs of only encrypted data. In parallel, put in place strict Identity and Access Management (IAM) protocols to address possible human-related vulnerabilities. Allow only vetted, authorized personnel both within the enterprise and in the cloud service provider organization, access to the enterprise cloud data. Also, check that data collected and uploaded follows defined standards and complies with applicable laws.Enterprises that have access to highly restricted and regulated data such as CJIS (Criminal Justice Information System Database) and HITECH (Health Information Technology for Economic and Clinical Health Act) and so on have stringent regulatory requirements to safeguard data.

Control of storage — ISO 27001 is a widely accepted certification to check the security of a physical data center. Conformance would mean that business threats are assessed and managed; physical security processes such as restricted/named access are consistently enforced; and, audits are conducted regularly at each site, including tests of security and CCTV planning andmonitoring. Adhere to similar high standards in assessment, management and audit of cloud data centers as well. Enterprises that fall under regulatory data residency requirements need to ensure that their cloud service provider is not offloading storage to overseas data centers according to traffic.

Control of use and transfer — Ensure checks at all points. Data from a protected server can lose its security layer by an inadvertent unchecked transfer into an unprotected server. Track data even within a private cloud, to safeguard against data exposure to unauthorized, possibly malicious insiders. Keep access control protection of all used servers active and patched up to date. Also, ensure compliance with applicable regulations. An EU directive currently places restrictions on the export of crucial data like Personally Identifiable Information (PII) outside the European Economic Area.

Control of disposal — The problem of data remnants arises from factors like the dynamic movement of data and shared apps/platforms. While regulatory bodies like the Health Insurance Portability and Accountability Act (HIPAA) have rules for the safe disposal of their digital media, the problem of residual data on the cloud is yet unregulated. Where possible, use crypto-shredding — the destruction of the encryption protocol to ensure that the data cannot be used. Else, work with the provider to wipe free space and ensure that the SLA with the provider covers this.

With the inevitability of cloud adoption for cost and convenience, enterprises need to understand the critical nature of cloud security issues and put in place appropriate strategies to address them.

Resource: Gartner, Inc., Gartner Reveals Top Predictions for IT Organizations and Users for 2016 and Beyond, 2015 October, accessed 2015 December, http://www.gartner.com/newsroom/id/3143718

Original Article

Please login or register to add a comment.

Contribute Now!

Loving our articles? Do you have an insightful post that you want to shout about? Well, you've come to the right place! We are always looking for fresh Doughnuts to be a part of our community.

Popular Articles

See all
Promote Your Blog On These 30 Places

Promote Your Blog On These 30 Places

Social Media channels are one of the best ways to promote your blog content, but you shouldn’t stop there. Besides Social Media, there are more available places on the web which can be a great marketing tool for your blog promotion. I’m bringing you 30 proven places where you can promote your blog content and get great results.

Aleksej Durdevic
Aleksej Durdevic 7 December 2016
Read more
Top 10 Digital Branding & Marketing Trends for 2017

Top 10 Digital Branding & Marketing Trends for 2017

It’s time to re-evaluate and rebalance the digital approach for your company. Here are the Top Digital Branding & Marketing Trends for 2017 to watch for. The probing minds at the Borenstein Group, a Top Washington DC Digital Marketing and Branding Agency, have done the homework for you. Use it or lose it.

Gal Borenstein
Gal Borenstein 7 December 2016
Read more
4 Important Digital Marketing Channels You Should Know About

4 Important Digital Marketing Channels You Should Know About

It goes without saying that a company can't do without digital marketing in today's world.

Digital Doughnut Contributor
Digital Doughnut Contributor 5 November 2014
Read more
What Mobile App Design Looks like in 2017

What Mobile App Design Looks like in 2017

They say ‘move with the time or the time will leave you behind’. Being a startup it is important for you that you understand the trends, and amalgamate them in your business in order to attain the targets.

Nasrullah Patel
Nasrullah Patel 6 December 2016
Read more
Digital Marketing Vs. Traditional Marketing: Which One Is Better?

Digital Marketing Vs. Traditional Marketing: Which One Is Better?

What's the difference between digital marketing and traditional marketing, and why does it matter? The answers may surprise you.

Julie Cave
Julie Cave 14 July 2016
Read more