With more and more data and applications heading to the cloud, leaving the familiar data centre for the fresh field of hosted online data centres, it's time to think hard about security issues.
Can hosted, multi-tenant services ever be as secure as your own server?
This isn't a new problem. Far from it. It's actually one the industry keeps coming back to. First it was data processed by time-sharing systems at a data processing bureau, and then it was outsourcing, and most recently off-shoring. Data leaks and breaches in the news focus attention from legislators, and regulations are put in place to try and manage things but regulations are never enough. It's what you do that protects your data.
There are three basic models for cloud services, and how you treat security is going to differ as a result of the cloud services you choose:
Infrastructure as a Service (IaaS): a service like that provided by Amazon Web Service, where they provide an infrastructure, leaving you to deploy your own virtual servers.
Platform as a Service (PaaS): a service like that provided by Microsoft Azure, where you run your applications on the service's operating system, using its storage infrastructure.
Software as a Service (SaaS): a service like that provided by Salesforce.com, where you store your data in the services databases, and use its software to process the information.
If you're using an IaaS provider, then you're going to need to treat your virtual machines much like any cluster of virtual machines in a data centre. The service provider is providing the network infrastructure (and the network security tools), and you're going to need to secure your virtual servers. You can use familiar tools and techniques, but it does mean that you're going to have to treat security as a full time IT task.
