by James Ling, Director, CISA, and Misha Kalhin, Senior Project Manager.
Switching to the cloud from in-house can transform your business, as we’ve discussed in our previous blog posts.  Cloud hosting promotes efficiency, cost reduction, and flexibility by freeing your organization from managing large air-conditioned spaces with rapidly aging hardware and by reducing your reliance on in-house IT expertise to manage functions that are not core to your business.  There are a lot of benefits of moving to the cloud, but, every executive in charge of the decision to migrate services to the cloud needs to consider the risks. This post will focus on managing the security risks of moving your systems and data out of your own facilities.
Cloud security is an issue that has been in the spotlight after Target and Home Depot data breach scandals, which prove that if your security measures are insufficient, the results will be devastating.  Tens of millions of dollars, in this case. Cloud service providers typically “share” security responsibilities with their clients, i.e. they provide fundamental security of the infrastructure, and expect their clients to secure applications that have been deployed in that infrastructure. After the incident Home Depot, for example, implemented “enhanced encryption of payment data” to avoid future breaches.
From a security standpoint, the two factors you need to consider when you plan cloud migration is reliability of your cloud infrastructure provider and reliability of the partner, who will design your cloud solution architecture, migrate your systems, and then test the solution. In addition, to avoid potential risks, your organization needs a robust Cloud Governance policy to define the appropriate uses of the cloud, cost management and disaster recovery.
Selecting a Cloud Infrastructure Provider
- Secure Access to AWS services using an encryption protocol.
- Built-in Firewalls that can be configured based on your organization’s needs, as well as a Virtual Private Cloud network.
- Unique users, Encrypted data storage, Isolated GovCloud compliant with US ITAR regulatons (here’s the full list)
 Selecting a Cloud Migration Partner
- Linux – by reinforcing the kernel to avoid DOS and spoofing attacks. Other services include Mandatory Access Control, locking down with SELinux.
- Apache – by disabling unnecessary “mods”, secure access, restrict access to root directory, configure CGI and SSI, keep and monitor access logs.
- PHP – by limiting execution time to prevent large-scale SQL injection attacks, disable potentially vulnerable services.
- MySQL – by restricting service by IP and implementing additional secure access methods.
Cloud Governance
