How do you talk to your cloud provider about security?

When implementing a cloud, we must remember that the cloud needs the same controls as the on-premises environment. The difference is in the effort for adjustments and implementations because it has to be a little easier and faster in the cloud. However, we need access to the risks right after the performance, register them, and create contour plans. One of the most critical steps is the logical design of the cloud structure, separating a specific design for the security architecture and its layers using the cloud. I recommend, before redesigning the wheel, exploring the security packages offered by Cloud by hiring, it can be very worthwhile.

When choosing a CSP solution, security should be a top priority. Look for vendors with rigorous cloud-based security, including controls to prevent data leakage, strong authentication, and data encryption. Ask about visibility and threat detection, continuous compliance, and integrated security.

First, ensure that your data and applications are sufficiently protected by being aware of your obligations, such as having a clear grasp of your personal security obligations, shared obligations, and provider obligations. The service level agreement (SLA) is also reviewed.

Cloud providers are unlikely to be responsible for something logical that could happen in our environment during a Cyber Security event, which is why we have Cyber insurance today (One of the reasons). We have to take advantage of what they offer in terms of services in general, be it IaaS, PaaS or SaaS, always keeping in mind that the cloud facilitates and speeds up. It DOES NOT guarantee security, as I said above, we have to ensure almost the same controls as in the physical environment, but in the cloud.

For easier understanding of shared responsibilities between you and your cloud provider try to work with those who have SOC2 Type2 report which will contain a part of responsibilities that you as client have to take care of. Also providers who are publish such reports are audited by independent auditors who examine their internal controls over client data security and etc.

Whenever we discuss policies and procedures, we must consider the regulations that my organization must respect. Some tools can be used for this control, or some manual control can be carried out depending on the organization's size. After defining measured and controlled, we must start the review with the periodicity, versioning, identification of gaps, improvements, revision, dissemination and encouragement of continuous improvement.

From my point of view, there is not the best cloud, but the cloud that best suits your needs. It's crucial to evaluate the security functionalities and offerings your cloud provider provides. These encompass a range of tools and services designed to enhance the security of your cloud environment, including encryption, firewall configuration, identity and access management, backup and recovery solutions, monitoring and logging capabilities, and vulnerability scanning services.

The most important thing at this stage is to be aware of barriers, roles and responsibilities. We have to cover everything we need but with intelligence. Something that is always forgotten on both sides is adding the relationship with security partners. It is usual for a service provider company to have other security partners and use these partners depending on the problem or project to be solved, and with this, we have a double responsibility, or we can call it co-responsibility, but this must be clear in the contract.

Instead of evaluating or auditing our cloud provider, we must make them responsible, report and make the necessary decisions (in many cases). Today, your cloud provider must be treated as a business partner and not just a service provider, our partners need to have this sensibility and work together. Thinking this way, we must evaluate the day-to-day treatment of vulnerabilities and good practices, understand the reports, measure whether they are sufficient for our business, etc. I'm trying to encourage companies to trust service providers because I often always say how they have to do something, but I've been surprised by many exceptional ideas from them.

Clouds nowadays, there is no better or worse, just the one that best fits your technology and cost strategy. The most important thing is to remember that the Cloud is not secure and needs almost the same controls as the on-premises environment. Another critical point is having your supplier be a partner so working together becomes more transparent, more accessible, faster and safer. Good luck!