Cloud Security: Why Auditors Are Part Of The Problem

InformationWeek Green - Sept 2, 2013

InformationWeek Green

Audit Fail

What your CISO says when asked about moving a server to the public cloud: "No way -- we'll lose control of a mission-critical application." What she's really thinking: "No way -- it'll make my life a living hell during security audits."

And in fact, that's one of the few perfectly rational security-related reasons to shy away from the cloud. Audits become much more stringent -- and much more work to pass -- if you're using a third party for any kind of data storage or manipulation. Security auditors don't distinguish between the controls at a well-run on-premises data center and the security at, say, an Amazon Web Services or Rackspace data center, even though that difference is usually massive. In the most extreme cases, we're talking a keypad lock and someone casually perusing logs versus military-grade perimeters, data integrity monitoring, maybe even guys with M16s. Consider Terremark's entry in our IaaS Buyer's Guide: Run your server in its center and you get an SSAE 16-certified facility listed with the Cloud Security Alliance Security, Trust and Assurance Registry (STAR) that's compliant with both FIPS 140-2 and PCI DSS Level 1.

But will that level of security earn you any points with an auditor? Nope, even though the providers themselves are subject to relentless scrutiny.

"The level of inspection going into public cloud providers -- eight to 15 audits per year -- is significantly higher than into an individual organization, which would usually see a handful at most," says Matt Gyde, group general manager of security at service provider Dimension Data.

Research: Cloud Security and Risk Survey

Report Cover

Get This And All Our Reports

Furthermore, most security audits impose a fairly stiff penalty, in terms of additional paperwork and diligence required, on companies that use vendors rather than hire additional staff for a given task. Generally, as long as your company does criminal background checks, auditors give your employees the benefit of the doubt. Vendors, however, are treated like common criminals by default; IT organizations must prove their innocence for pages and pages. Amazon matches the criminal background check standard, plus it requires employees to explicitly request access to all AWS cloud components through a ticketing system. It reviews accounts every 90 days or when a job function changes. The default is explicit reapproval, or access is automatically revoked. How many private data centers have that level of control?

Dave Frymier, CISO at IT services vendor Unisys, says he deals frequently with customers that want to move to the public cloud but are running into problems with their auditors. At some point, we'll get to a place where auditors focus on what matters -- things like identity management and who has privileged access -- rather than where data lives. Consensus on how to use the public cloud securely, especially via efforts led by the federal government, will also drive significant changes in how public cloud security is judged.

But we're not there yet, and at the end of the day, companies must pass their security audits.

To read the rest of the article,
download the September 2, 2013, issue of InformationWeek.