Top 5 Security Factors to Consider When Moving to the Cloud

First, you have to recognize and acknowledge that any time you are using public cloud, you are using a shared responsibility model—this means that you are responsible for security to and from the cloud and the cloud provider is responsible for security within its cloud infrastructure.

Second, you should choose a cloud provider that offers the highest levels of protection and expertise—particularly in areas that have a significant effect in reducing risk, such as encryption, access control, monitoring and visibility, along with data sovereignty and other compliance requirements.

Third, you should use a public cloud platform that is tightly integrated with your on-premises virtualized environment, specifically VMware. With tight integration, you can run VMware workloads in the cloud with a high uptime availability at the virtual machine (VM) level while leveraging innovations such as stretched clusters to reduce risk and improve availability of mission critical applications.

With those three considerations in mind, here are five additional important security factors to consider in choosing a public cloud provider:

1. Encryption: As noted, encryption is the number one factor in preventing and mitigating the impact of a breach. Ask if your public cloud vendor offers a FIPS 140-2 Level certified Hardware Security Model. This is important because Level 4 certification provides industry-leading protection against tampering. Additionally, you can access functionality so that no one—including cloud administrators—has access to encryption keys at any point.
2. Role-based access control: With role-based access control, you can decrease the risk of breaches and data leakage by reducing and managing access to sensitive information. You can guarantee that only authorized users are given access to what they need to do their jobs. You also enhance compliance by more effectively managing how data is accessed and used.
3. Data sovereignty: As described by TechTarget, “Verifying that data exists only at allowed locations can be difficult. It requires the cloud customer to trust that their cloud provider is completely honest and open about where their servers are hosted and adhere strictly to several level agreements (SLAs).” Make sure your cloud provider has data centers all around the globe and can comply with data sovereignty regulations by geo-fencing workloads running on trusted servers.
4. Compliance: Data sovereignty and compliance go hand-in-hand, particularly as more and more enterprises are conducting business globally and local governments and agencies have strict compliance requirements for doing business, such as General Data Protection Regulation (GDPR) in the European Union. In public cloud, you want to be able to enforce compliance requirements with continuous monitoring and alerting against policy-based templates for audit readiness.
5. Business continuity: Backup and disaster recovery are vital use cases when it comes to public cloud, but you must also make sure that your provider supports high availability capabilities to ensure the integrity of backup and DR sites when recovering from cyberattacks. Make sure to ask your cloud provider about recovery time objectives and recovery point objectives, as well as capabilities such as stretched vSAN clusters for your VMware solutions in hybrid and public cloud.

Perhaps it is inevitable that business and IT leaders will have concerns about cloud security. The idea of trusting your mission critical data and applications to another company can be somewhat daunting.

Today’s reality, however, is that you can mitigate risk—and concern—by choosing a public cloud provider that is focused on security leadership and trust, offering enterprise grade protections in key areas such as encryption, control, compliance, data sovereignty, and business continuity.

Learn more about IBM’s security leadership and how to most securely migrate your mission critical VMware workloads to IBM Cloud.