<Is the Cloud Really Secure?/>

It’s a fair question. After all, like the money in our IRAs and mutual funds, when we don’t really know where our assets are — when they’re abstracted into some nebulous, intangible system — it’s difficult not to wonder whether they’re really there and really secure. But, as one New York Times writer put it, both our money and our software are actually safer this way.

The same way that your money is probably safer mixed up with other people’s money in a bank vault than it is sitting alone in your dresser drawer, your data may actually be safer in the cloud: It’s got more protection from bad guys.

• Quentin Hardy, New York Times

And in fact, according to Gartner research, public cloud IaaS workloads will suffer at least 60 percent fewer security incidents than those in traditional data centers.

Why is that?

First, cloud service providers give companies the opportunity to automate significant portions of their software-related processes, minimizing the human error that is ultimately responsible for most security breaches. But the primary reason CIOs and IT execs can rest assure that their software systems are secure in the cloud is the sheer power of providers like Google, Amazon, and Microsoft to keep their clients’ data safe.

These providers offer storage backup, risk management policies, and disaster recovery protocols to secure the data and systems their clients entrust to them. All this is possible because these industry giants have the resources to develop sophisticated security measures that individual companies just don’t have. To become as resilient or as secure as a cloud-hosted system would require billions of dollars in infrastructure, development, and personnel. So let’s break down exactly what some of these security measures look like.

Secure Storage

Cloud providers store client information in data systems all over the world, and each client’s data is usually backed up on at least three hard drives at any given time. What’s more, cloud providers also take advantage of software that enables workloads to be shared among different machines, which means any given company’s data actually moves from machine to machine to improve efficiency based on the provider’s overall capacity needs. So not only do providers build redundancy into their storage and backup methods, but they make client data something of a moving target that’s harder for would-be hackers to hit.

Furthermore, all this data is encrypted so that, without the key, the content is indecipherable. While the provider may supply the encryption key, the client can supply its own, instead. This way, the cloud provider will be able to store the data for the client, but it won’t be able to see any of it. And many cloud-service providers, such as Dropbox, take the encryption measure a step further, splitting files into shards and encrypting each shard separately. That way, even if a file is compromised, only a small portion of its data will be exposed.

Maintenance & Testing

While companies who host their own software systems or use traditional hosting providers are responsible for finding the time, talent, and resources to conduct their own security testing, maintenance, and support, cloud-based providers have teams of experts dedicated to ensuring all of the hardware and systems are secure and functioning properly. And the same is true for regulatory compliance. These providers are equipped to ensure their systems are constantly up to date as new rules and regulations go into effect, protecting their clients’ data — and protecting their clients from hefty fines for noncompliance.

Compliance

For many businesses, regulations designed to improve privacy and security add an extra layer of headaches to software development and maintenance. However, from SOC to ISO to HIPAA to PCI, cloud providers take care of compliance issues for their clients. And, just like the advantages these heavyweights hold in infrastructure and security, the big cloud providers have the expertise and resources to ensure their clients’ solutions are always compliant with ever-evolving industry regulations.

Multi-Cloud Deployment

For businesses that want to take security even further, multi-cloud deployment is an option that adds extra redundancy to their backup methods. By running software systems — or elements of them — from multiple providers at once, further minimizing the risk of data loss or downtime in case one provider is compromised. While a multi-cloud strategy does require more management time and resources on the client’s end, it can be a comforting insurance against loss.

Still unsure whether the cloud is secure enough for your business needs? All three of the biggest cloud providers — Amazon, Google, and Microsoft — offer government cloud solutions for federal, state, and local governments. These are designed to improve citizen services, improve operations, enhance public safety, and more — and all with airtight security and defense. If the cloud is secure enough for the US Government, it should be secure enough for the majority of other businesses.

Of course, the responsibility for security never disappears completely. As the owner and custodian of its data, a business is always ultimately responsible for it. Fortunately, moving software systems to the cloud is a big step toward more secure systems — not to mention the countless other advantages cloud providers can offer.