Pass the Buck: Who 's Responsible for Security in the Cloud?

Cloud computing changes the equation of responsibility and accountability for information security and poses some new challenges for enterprise IT. At Vormetric we are working with service providers and enterprises to help them secure and control sensitive data in the cloud with encryption, which has given us a good perspective on the issues surrounding who is responsible for cloud security.

While data owners are ultimately accountable for maintaining security and control over their information, the cloud introduces a shared level of responsibility between the data owner and the service provider. This division of responsibility varies depending on the cloud delivery model and specific vendor agreements with the cloud service provider (CSP). In addition, the use of multi-tenant technology by CSPs to achieve economies of scale by serving customers using shared infrastructure and applications introduces another layer of risk.

Where the buck stops or gets passed on poses some new operational and legal issues. Let’s look at each cloud delivery model to understand how each creates a slightly different balance of security responsibility between the data owner and CSP.

Software-as-a-Service (SaaS) and Platform-as-a-Service (PaaS) models typically place much of the responsibility for data security and control in the hands of the SaaS or PaaS provider. There is not much leeway for enterprises to deploy data security or governance solutions in SaaS and PaaS environments since the CSP owns most of the IT and security stack.

Infrastructure-as-a-Service (IaaS) tilts the balance towards a greater degree of shared responsibility. IaaS providers typically provide some baseline level of security such as firewalls and load balancing to mitigate Distributed Denial of Service (DDoS) attacks. Meanwhile, responsibility for securing the individual enterprise instance and control of the data inside of that instance typically falls to the enterprise.

A widely-referenced example that clearly describes IaaS security responsibilities can be found in the Amazon Web Services Terms of Service. While enterprises can negotiate liability, terms and conditions in their Enterprise Agreements with service providers, the IaaS business model is not well suited for CSPs to assume inordinate amounts of security risk. CSPs aren’t typically willing to take on too much liability because this could jeopardize their business.

Since an enterprise’s ownership of security in the cloud gradually increases between SaaS, PaaS and IaaS, it’s important to clearly understand the level of responsibility provided in the terms and conditions of CSP agreements.

Having established what a cloud provider is delivering in the way of security, enterprises should backfill these capabilities with additional controls necessary to adequately protect and control data. This includes identity and access management, encryption, data masking and monitoring tools such as Security Information and Event Management (SIEM) or Data Loss Prevention (DLP). One valuable resource for evaluating cloud service provider security is the Cloud Security Alliance Cloud Controls Matrix.

Enterprises looking to further mitigate the risk of data security incidents in the cloud can also investigate Cyber insurance offerings that protect against cyber events such as cyber extortion, loss of service or data confidentiality breach. Finally, enterprises should develop both a data recovery plan and exit strategy if they need to terminate their relationship with a CSP.

Cloud security is a new and evolving frontier for enterprises as well as CSPs. Understanding the roles, responsibilities, and accountability for security in the cloud is critical for making sure that data is protected as well in the cloud as it is in an enterprise data center. The process starts with a thorough due diligence of what security measures are provided and not provided by the CSP, which enables enterprises to know where they need to shore up cloud defenses. Until further notice, the cloud security buck always stops with the enterprise.

Todd Thiemann is Senior Director of Product Marketing at Vormetric and co-chair of the Cloud Security Alliance (CSA) Solution Provider Advisory Council.