Cloud Security Review Service

To understand cloud security, it is necessary to understand what we mean by the ‘cloud’.  At the most fundamental level, the Cloud (sometimes referred to as ‘Cloud computing’ or ‘Cloud services’) is just a different way of providing digital services.

The physical technology and hardware that underpins Cloud services are no different to what is available to consumers and all other businesses – it’s just that the physical infrastructure is owned and managed by the Cloud provider, who provides a service in a flexible, scalable, on-demand manner which supports self-service. Cloud, therefore, is more about service provision than it is about technology.

Cloud services take many different forms – and as long as they still follow the characteristics listed above – they are all still Cloud services… even if they aren’t all equal.

There are three “categories” that Cloud services are usually grouped into (terms you
may have heard before), they are:

> Infrastructure-as-a-Service (IaaS)
> Platform-as-a-Service (PaaS)
> Software-as-a-Service (SaaS)

Not all Cloud services are equal – they come in
various forms, shapes and size – so, as you would expect, securing them is not always
the same. Whilst the exact activities will vary, the considerations fall into the following
categories:

> Assurances from our Cloud Provider
> Our Configuration of the Cloud service
> Penetration Testing Cloud services/in Cloud environments
> Visibility and Awareness of the Cloud service

The short – and best – answer to this question is that the two different ways of doing service provision have different risk profiles. For some risks, choosing to move to the Cloud will potentially make it a higher-risk proposition; in other cases, you may inherently reduce a risk by the way Cloud services work.