Last year the European Commission invited me to speak at their meeting of IT managers. During the questions and answers panel the IT managers asked many questions about cloud computing technology. I heard a common theme in the questions: data security and how to handle failures were keeping the IT manager community from moving applications into the cloud.
A friend is the IT manager for a large digital advertising agency. He is tasked with preparing the agency with enough equipment, bandwidth, and test automation capability to serve the agency customers. I asked him the same questions I heard from the EC IT managers: How do you secure customer data in the cloud?
My friend pointed to SAS 70, Cloud Security Alliance, Amazon and Rackspace.
SAS 70 is the Statement on Auditing Standards from the American Institute of Certified Public Accountants (AICPA). SAS 70 is different from the ISO 9000 standard certification in that SAS 70 is not a pre-determined set of standards that a service organization must meet to “pass”. Instead an independent auditor evalutes and audits a service organization’s security controls. You sit down with an auditor to conduct a security review. The auditor asks you how you comply with standard. And it only costs you $25,000 USD to go through the audit.
The problems begin when you are on the receiving end of a SAS 70. For example, a customer of Amazon or Rackspace may see SAS 70 certification on the Web site and believe the company to be risk free for security controls. SAS 70 is a reporting tool for auditors. While the Web site may herald SAS 70 certification, the actual audit may determine that the company is only complying with a few security controls. For example, an SAS 70 certification may have found the security controls are inadequate and the staff not trained. Making sense of a SAS 70 requires the reader to be well versed in IT control and compliance. My friend says some are pretty clear, others obscure.
As an IT industry we need the following:
1) A standards body to define cloud security best practices and controls. The Cloud Security Alliance does a good job at fulfilling this need.
2) A standard way to report an organization’s compliance with the best practices and controls. SAS 70 publishes the data in an “auditor”-focused lingo. It is not entirely obscured.
3) A way to transform the certification and audit publication into a set of APIs that are easy for software developers to adopt in their cloud-hosted applications. Platform-level security management is an opportunity for the platform providers: Oracle for Java, Microsoft for .NET, Zend for PHP.
Combining security policy management with scalable platform support will help cloud computing take off. And hopefully our jobs will multiply to support the infrastructure. Every IT and development organization leader will eventually need to answer the changing requirements for data security and when to build a better hosting platform.
-Frank