ISF advises firms on cloud computing security

The ISF is aiming to take a lead on cloud security education

Not-for-profit body the Information Security Forum (ISF) today released a new report detailing ways in which firms can minimise data security risks when moving to cloud computing environments.

Working with its member organisations, the ISF has produced Security Implications of Cloud Computing, which covers various areas including how to manage user identities and credentials, third-party service providers, legal and regulatory issues and how to protect against new forms of malware.

The ISF advised firms to take five key steps before moving to the cloud: prepare a strategy; identify the operational impact; assess data risks; ensure information security is part of the decision-making process and work on the assumption that cloud computing is already being used in the organisation.

“Moving to cloud computing services shifts direct control over the technology and resources that provide the services, making it a shared responsibility for the infrastructure and also the data within the cloud computing environment,” said report co-author Gary Wood.

“Security professionals also have some concerns about issues such as the protection of intellectual property, enforcing contractual specifications and preventing unauthorised use of data; but with the right planning and preparation we firmly believe it is possible to deploy a rich, robust and secure implementation.”