09.11.2015 Views

October/November 2015 Digital Edition

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Cloud security trending as for<br />

government agencies<br />

Continued from page 13<br />

its system and completing necessary<br />

patches. This may depend upon the<br />

specific service level selected, so it<br />

is important to understand who has<br />

responsibility for this. If the provider<br />

is responsible, the agreement<br />

should confirm that updates and<br />

patches will be implemented in a<br />

timely fashion.<br />

• Breach notification procedures.<br />

The agreement also should<br />

detail notification procedures, as<br />

well as how and when data can be<br />

accessed in the event of a security<br />

breach, in addition to any log file<br />

access that would be necessary to<br />

help determine what happened. The<br />

agreement also should be specific<br />

about whether or not your agency<br />

can bring in an independent forensic<br />

team to review how the attack<br />

occurred and what remediation<br />

steps must be taken.<br />

• Disaster recovery. The cloud<br />

provider should offer, at a minimum,<br />

disaster recovery policies that<br />

meet industry standards. Review<br />

the provider’s general protections,<br />

type of backup services provided<br />

and business continuity practices.<br />

• The long-term outlook. Once<br />

you have made the move to the<br />

cloud, it can be hard to transition<br />

back out. Accordingly, the agreement<br />

should delineate very clearly<br />

how long it will take and what steps<br />

will be required to retrieve your<br />

data if you decide at some point to<br />

move out of the cloud.<br />

In addition to the points noted<br />

above, having a cloud strategy and<br />

performing due diligence is essential<br />

for an agency considering a<br />

move to the cloud. Such due diligence<br />

should include a thorough<br />

evaluation of the provider’s years of<br />

experience, how much content the<br />

provider has under contract and the<br />

company’s track record protecting<br />

data.<br />

The cloud can present several benefits,<br />

as well as a number of risks.<br />

Determining what is best for any<br />

government agency involves a careful<br />

review of the terms and conditions<br />

contained the agreement, plus<br />

a calculated, upfront risk/benefit examination,<br />

free of any assumptions,<br />

to reveal whether the time is right to<br />

make a move to the cloud.<br />

About the author: Jayne Friedland<br />

Holland is Chief Security Officer at<br />

NIC Inc. (NASDAQ: EGOV), the<br />

country’s dominant provider of egovernment<br />

services and secure payment<br />

processing. Contact her at jayne@<br />

egov.com.<br />

Post Your Video on<br />

the Busiest Website<br />

in Homeland Security!<br />

To Place Your Order or Get Further Information, Contact:<br />

Mike Madsen, Publisher, at 732-233-8119, or mmadsen@gsnmagazine.com<br />

26

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!