Physical Security in the Cloud is it Secure?

Steve Van Till writing in SDM magazine (registration required) tackles the question: If physical security is moving to the cloud where it can be accessed on demand by anyone anywhere (even with restrictions), how do we keep it secure?

Van Till considers the question in three stages:

• Define the varieties of cloud computing in use today
• Explain which models offer the best fit for physical security
• Suggest some ways to keep the cloud secure for these applications

Assuming that the number of physical security solutions using public clouds will continue to grow, what are some of the approaches the industry (or customers) can do to make sure these applications are as secure as possible?

First, there’s an old rule of thumb that says your security is only as good as your last security audit. Vendors need to perform standardized audits, and customers need to insist on them. Within the federal market, this audit requirement has been institutionalized in FISMA (Federal Information Security Management Act) and more recently with FEDRAMP, which has a specific cloud focus.

Second, there are many best practices that the cloud industry has already started advocating. Physical security service providers should incorporate these best practices into their own offerings. One of the best sources for this type of information is the Cloud Security Alliance.

Finally, buyers always need to take at least some responsibility for the security of their purchases. Ask questions. Ask about audits. Ask where the data is hosted. Ask whether the service has undergone penetration testing. There are many “top 10 cloud security” lists on the Web — download a few and learn the hallmarks for recognizing good, secure cloud offerings for your physical security solution.   read it all here