Most business solutions are migrating to the cloud due to the flexibility, scalability, and cost-saving features. However, while moving to the cloud, data, systems, and services can be exposed to serious security and compliance challenges.

When moving data to the cloud, it is necessary to ensure that your information and data remain compliant with the laws and regulations of your industry.

Key compliance strategy questions

• What will be kept on-premises and what information will move to the cloud?
• What will be required of your cloud services provider (CSP)?
• What terms and conditions will be written into the SLA(s) to remain compliant?

With the implementation of federal laws such as HIPAA (Health Insurance Portability and Accountability Act), SOX (Sarbanes-Oxley Act), and PCI DSS (Payment Card Industry Data Security Standard), organizations face more regulatory pressure than ever before. Compliance can be made more challenging and complicated in a cloud environment.

“The cost benefits for cloud service providers come from the ability to scale multiple clients across shared resources. This can make compliance difficult as regulations often require encryption, auditing, and data separation, which increase hardware requirements and limits resource sharing. These additional requirements may increase the cost of the cloud solution to the point where it is no longer a good business decision,”

 -Joseph Granneman--Information security professional for the financial and healthcare industries

Understanding business needs and challenges

Migrating to the cloud can increase the organization’s ability to achieve their business objective, but also increases the complexity for delivering services securely to the clients. Due to the interconnected nature of the cloud environment, a malicious attacker can potentially gain access to a number of systems.

When considering your cloud architecture, it is important to have a very good cloud compliance mechanism in place to reduce the complexity and associated risk. Proper foundation scaffolding is a must to achieve a proper balance of IT policies that are appropriate for both internal line of business "experiments" and agile applications that are intended to transform your business.

Maintaining the confidentiality, integrity, and availability of data has become the most prominent requirement for the business, and cloud service providers are rushing to harden security.  For example, Microsoft recently introduced shielded VMs deployment to protect cloud-based servers from theft attempts and hyperjacking.

Ensuring security in the cloud

Effective data secure in the cloud requires the combined efforts of both the client and the cloud service provider. Key components of your compliance strategy should include:

• Credential management: Thoroughly vet and periodically review your long-term strategy for securing your infrastructure from phishing, ransomware, natural, and human-made disaster threats (especially in healthcare environments) with the help of credential management tools.
  
  
• Encryption: File-level encryption is a comprehensive encryption approach in cloud security efforts.
  
  
• Advanced Endpoint Security: Firewall and advanced endpoint security solutions should be deployed to protect the IaaS and PaaS based cloud models along with the end-user devices which are accessing these cloud resources.
  
  
• Security Guidelines and Best Practices: Click here for articles detailing security best practices to use when you are designing, deploying, and managing cloud solutions with Azure.

Ensuring regulatory compliance in cloud

As more standards have been developed, it has become more challenging for businesses to stay in compliance. Most of these regulatory compliance standards were not specifically developed for cloud computing but they are applied to cloud architectures. These standards include:

• FedRAMP: Is a US-government standardization approach that offers authorization, security assessment, and monitoring of cloud services and products.
  
  
• General Data Protection Regulation (GDPR): (Regulation (EU) 2016/679) is a European regulation that aims to strengthen and unify an individual’s data protection in the European Union and affects all organizations that store the personal data of individuals living in the EU.  Even Non-EU CSPs and service providers are liable for rule violations and other data breaches under this sweeping regulation.
  
  
• Sarbanes-Oxley Act (SOX) of 2002: SOX is a standard which works to protect shareholders and the general public from fraudulent activities and accounting errors. This law also provides guidelines on storing business data in IT and cloud systems.
  
  
• Health Insurance Portability and Accountability Act of 1996 (HIPAA): HIPAA is a standard which helps to maintain and protect medical records (including data privacy and confidentiality of patients). It was signed into law by President Bill Clinton on 21^st Aug 1996.
  
  
• Payment Card Industry Data Security Standard (PCI DSS): is a set of rules created by Visa, MasterCard, Discover, and American Express in 2004 to ensure the security of credit, debit, and cash card transactions.
  
  
• Federal Information Security Management Act (FISMA): Is a US standard signed into law in the Electronic Government Act of 2002 that protects government information and assets against natural or human-based threats.

Cloud and on-prem solutions

Businesses are digitally transforming and expanding to the cloud, and protecting both physical and virtual assets from threats is becoming more challenging and complex. Risks such as phishing attacks, ransomware, natural, and human-made disasters can threaten the viability of any organization.  Businesses need monitoring, management, and security solutions that effectively address both on-premises and cloud environments.

Are you compliant?

A secure long-term strategy for your infrastructure and applications starts with a solid foundation.

Learn more.