For all the challenges of information security in the cloud, it really isn’t that different from information security in the data center. The same processes, tools, and strategies that are used for on-premises security apply to security in the cloud, with a few changes in the details of their implementation. These methods include:

1. Identity and access management. Controlling who has access to your data and managing their privileges is critical for information security. For your data in the cloud, you should understand the cloud provider’s controls over their employees’ access to your systems. You should extend your own identity and access management to the cloud, using federated security with single sign-on and roles-based privileges to minimize the number of identities and privileges to be managed. Root privileges, which should always be minimized, should be managed even more tightly in the cloud.
2. Patch management. The need to know your systems’ vulnerabilities and apply patches doesn’t go away when your servers are in the cloud. With some types of cloud service, the vendor will handle these issues, but with some versions of Infrastructure as a Service, you remain responsible. The challenge of tracking whether patches have been applied becomes even more difficult in the cloud, as servers spin up and down much more frequently. You’ll want to scan for vulnerabilities continuously, rather than periodically.
3. Configuration management. One of the biggest threats in the cloud is misconfiguring a system and accidentally exposing it to the public internet. While configuration management is important for internal systems, too, this risk makes it even more important in the cloud. Define standard configurations and automate procedures for deploying them. Your cloud vendor may have tools to verify that your instances apply best practices.
4. Monitoring. Knowing what your users and systems are doing requires reviewing log files. In the cloud, you’ll likely need to rely on your vendor to provide log files and you probably will not be able to review logs of the underlying shared infrastructure. Despite the potentially limited information, you should ensure that logs are pulled together and flow into your event management tool.

With good security controls in place in the cloud, the cloud can be as secure as any on premises infrastructure. Prescient Solutions offers IT consulting and managed services to businesses in Chicago and Schaumburg. Our partnership with Microsoft makes us expert in Azure cloud, and our team provides comprehensive security services to keep your data safe wherever it’s located. Contact us to learn more about how to achieve information security in the cloud.