It is pretty much common nowadays to store, process, or transmit data by means of a Cloud. Whatever the Cloud of your choice might be (public or private), you expect the Cloud provider to provide you with the security of your information. But how safe is a Cloud? And what can one do to tackle this issue?
Security has been big issues when it goes to cloud system. Since the best encryption and secure thing is not secure enough with development of technology and software made by hacker and cracker. Cloud is still not safe environment to store confidential data if you don't have any special security personnel or system to handle and administrated it.
If you insist on using it , my advice is you use a private cloud that the server on physical and logical layer you can see and control/administrate.
I believe it is perhaps still a little early to tell. But there is no doubt that the issue of security and safety will evolve to an acceptable level to the extent that potential users would be less skeptical about cloud. Let's wait and see...
The answer to "Is the Cloud a safe environment to store confidential data? ": Not at all.
No Security in the Cloud. You need to make absolutely sure that you choose the most reliable service provider, who will keep your information totally secure. Cloud is prone to Attack from external threats. Internet is not completely secure and hence, there is always the lurking possibility of stealth of sensitive data.
If you can make a contract with the cloud provider then it might be possible. But this contract must be very strict and also proved by a lawyer. The Austrian goverment have some data outside of their environment and now the data was found at another server in Romania.... Better not to do.
From a computational point of view cloud computing generates more problems than answers. Of course there is the issue about ethics and security. The main weakness of cloud computing results from the fact that it does not truly improve the traditional Von Neumann architecture, the Church-Turing thesis, and the dependence of linear and hierarchical procedures and processes.
The Cloud is not one monolithic entity. You need to read the provider's user license and review the provider' system. They vary widely.
For me, Google Docs is not a solution because they are allowed to make specified use of data.
1. The most difficult part of ensuring compliance with your ethical duties will probably be knowing which questions to ask. The following are good questions to consider.
i. What type of facility will host the data?
ii. Who else has access to the cloud facility, the servers, and the data and what mechanisms are in place to ensure that only authorized personnel will be able to access your data? How does the vendor screen its employees? If the vendor doesn’t own the data center, how does the data center screen its employees?
iii. Does the contract include terms that limit data access by the vendor’s employees to only those situations where you request assistance?
iv. Does the contract address confidentiality? If not, is the vendor willing to sign a confidentiality agreement?
v. How frequently are back-ups performed? How are you able to verify that backups are being performed as promised?
vi. Is data backed up to more than one server? Where are the respective servers located? Will your data and any backup copies of it always stay within the boundaries of the a particular country?
vii. How secure are the data centers where the servers are housed?
viii. What types of encryption methods are used and how are passwords stored? Is your data encrypted while in transit or only when in storage?
ix. Has a third party, such as McAfee, evaluated or tested the vendor’s security measures to assess the strength of, among other things, firewalls, encryption techniques, and intrusion detection systems?
x. Are the audits of the security system, e.g. under SAS 70, available for your review?
xi. Are there redundant power supplies for the servers?
xii. Does the contract include a guarantee of uptime? How much uptime? What happens in the event that the servers are down? Will you be compensated if there is an unexpected period of downtime that exceeds the amount set forth in the agreement?
xiii. If a natural disaster strikes one geographic region, would all data be lost? Are there geo-redundant backups?
xiv. What remedies does the contract provide? Are consequential damages included? Are total damages capped or are specific remedies limited?
xv. Does the service agreement contain a forum selection clause? How about a mandatory arbitration clause?
xvi. If there is a data breach, will you be notified? How are costs for remedying the breach allocated?
xvii. What rights do you have upon termination? Does the contract contain terms that require the vendor to assist you in transitioning from their system to another?
xviii. What rights do you have in the event of a billing or similar dispute with the vendor? Do you have the option of having your data held in escrow by a third party, so that it is fully accessible in the event of a dispute? Alternatively can you back up your data locally so that it is accessible to you should you need it?
xix. Does the provider carry cyber insurance? If so, what does it cover? What are the coverage limits?
- Badges
- Science topic