[star2law]

Hello – what steps are typically taken to ensure cloud based data storage vendors (i.e. Dropbox) have the appropriate cyber security in place?

Topic

[Security123abc]

@star2law a good place to check cloud security strategy and framework is the Cloud Security Alliance – http://www.cloudsecurityalliance.org – access on August 31, 2019. It is a group with the top Tech companies which collaborates to improve cloud security. Kind regards,

[Chrisr]

@security123abc looking at the CSA website I was struggling to find an indication if they independently audit a supplier before granting them membership? Obviously providers such as Dropbox state that they have certain data protection measures in place, however I was just curious if you knew they were made to demonstrate this independently. Thanks!

[mattburrows]

Am interested in this question as well, including if there are specific standards that they should be adhering to.

[rg05]

Ask if they have a SOC 2 Type II Report and if you can review it. In many cases a lot of details about the operations of the organization are outlined in the report. Since a Type II is performed over time you will see if the companies internal controls are operating correctly.

Examples of items covered in some of the SOC 2 reports I have reviewed and participated in include:

Technical Details on security configurations: encryption settings, network segmentation, backup and recovery, key management etc.

HR Details: employee screening, security policy compliance

More details on SOC 2 here: https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/aicpasoc2report.html

Security Governance: testing routines, reporting mechanisms etc.

[MSIngh05]

@star2law – In addition to the replies above, a very key factor and differentiator for cloud providers security is not just evaluation vendor security, however also evaluating the security controls implemented by the origination during implementing the cloud solution. The cloud providers put an onus on the companies using them to implement a lot of security controls – inherently they may provide the capabilities however its upto the company using them to implement those controls (such as MFA, encryption, audit controls, password complexity and so on). No cloud security evaluation is completed unless 360 degree view of security is taken (vendor security plus implementation controls)

[skumbhat]

@star2law – Agree with @rg05, Soc 2 Type II report is a great start. Additionally, you could also refer this whitepaper from Dropbox Security – https://www.dropbox.com/static/business/resources/Security_Whitepaper.pdf

[paddeev]

Hi regarding cloud storage security, it was nice to get information on the SOC 2 TYPE II report. I tried downloading the report for Microsoft Office 365, but the page had been loading for past 15 minutes where I have a bandwidth of around 100 Mbps. 🙂 Do anyone have a copy of this report?

[Author]

Replies