CIO & LEADER-Issue-10-January 2018 (1)

Column
With increased sophistication of threats, cloud security is
becoming even more dynamic as it evolves
as a data center. Whether cloud or onpremise,
organizations have to deal
with human error, malicious breaches
from internal and external sources, as
well as system glitches. The massive
amounts of data located on shared
cloud servers always entice criminals.
Things get a lot more complicated
when a multitude of mobile devices
are used in organizations.
With increased sophistication of
threats, cloud security is becoming
even more dynamic as it evolves.
Organizations continue to be responsible
for security, privacy and compliance
even when under different cloud
service models. The need for consistent
policies, password rules and
specialized data encryption methods
has never been greater. Both the organization
and the CSP have roles that
vary in scope, but then both also have
different levels of responsibility that
encompass the entire gamut of operations—from
data classification,
endpoint protection, identity and
access management, application and
network level controls, to host and
physical security.
There are clear boundaries defined
and responsibilities identified for
organizations and CSPs. For instance,
in both on-premise and cloud models,
the organization is responsible for
ensuring that the data is classified
and encrypted in compliance with the
regulatory obligations. In the case of
endpoint devices, CSPs may facilitate
the management of these devices by
providing secure device management,
mobile application management, and
PC management capabilities; however,
the responsibility of implementing the
security solution again lies with the
customer organization.
Who is responsible for
a breach?
There is no question about who is
responsible when a breach occurs. For
businesses, the vital consideration in
securing the infrastructure and data
relates to where the CSP’s responsibility
ends and the organization’s begins
so that a breach does not occur in the
first place. This means that while the
provider is responsible for protecting
the hardware, software, physical facilities
and other aspects involved with
running the cloud services provided,
businesses maintain control over a
number of key security measures.
Some key security measures for
January 2018 | CIO&LEADER
13