monitoring, application penetration testing, and risk management. So, if you’re using a Platform as a Service (PaaS) to develop applications, be concerned about application security. Likewise, if you’re running your application in the cloud or using a SaaS provider, application security will be an issue. 

✓ Identity and access management:  Controls and maintains access to computer resources, applications, data, and services 

 In a traditional data center, you may use a directory service for authentication and then deploy the application in a firewall safe zone. The cloud often requires multiple forms of identity to ensure that access to resources is secure. 

✓ Encryption and key management:  Ensures that only intended recipients receive data and can decrypt it 

 Data encryption refers to a set of algorithms that can transform text into a form called cyphertext (an encrypted form of plain text that unauthorized parties can’t read). The recipient of an encrypted message uses a key that triggers the algorithm to decrypt the data and provide it in its original state to the authorized user. 

Develop a thoughtful approach to cloud security to succeed in mitigating security risks. Part of this involves asking your cloud provider some tough questions. It may also include a visit to the provider’s facility. Here are a few suggestions for questions to ask your potential provider: 

✓ What security policies does it have in place? Are they consistent with a recognized framework and control standard? 

✓ Does the provider have any industry certifications? 

✓ How does the provider meet audit standards? 

✓ Does the service provider have documented policies and procedures, including escalation procedures in the event of an incident? 

✓ How does the provider handle identity and access management? 

✓ How does the provider protect data? 

