Enhance cybersecurity awareness and survivability for DoD, industry partners, and academia in the face of the ever-increasing threat of cyber attacks. Cybersecurity (CS) includes managing risks related to the use, processing, storage, and transmission of information and the systems and processes used for those purposes, including analog and physical form. CS includes information availability, identification and authentication, confidentiality, integrity, and non-repudiation as well as the economic considerations with respect to selection of CS techniques, CS processes, and industry trends.
Cyber Security for Cloud Data Storage
This topic contains 7 replies, has 1 voice, and was last updated by 
-
Topic
-
Hello – what steps are typically taken to ensure cloud based data storage vendors (i.e. Dropbox) have the appropriate cyber security in place?
-
Replies
-
@star2law a good place to check cloud security strategy and framework is the Cloud Security Alliance – http://www.cloudsecurityalliance.org – access on August 31, 2019. It is a group with the top Tech companies which collaborates to improve cloud security. Kind regards,
-
@security123abc looking at the CSA website I was struggling to find an indication if they independently audit a supplier before granting them membership? Obviously providers such as Dropbox state that they have certain data protection measures in place, however I was just curious if you knew they were made to demonstrate this independently. Thanks!
-
Am interested in this question as well, including if there are specific standards that they should be adhering to.
-
Ask if they have a SOC 2 Type II Report and if you can review it. In many cases a lot of details about the operations of the organization are outlined in the report. Since a Type II is performed over time you will see if the companies internal controls are operating correctly.
Examples of items covered in some of the SOC 2 reports I have reviewed and participated in include:
Technical Details on security configurations: encryption settings, network segmentation, backup and recovery, key management etc.
HR Details: employee screening, security policy compliance
More details on SOC 2 here: https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/aicpasoc2report.html
Security Governance: testing routines, reporting mechanisms etc.
-
@star2law – In addition to the replies above, a very key factor and differentiator for cloud providers security is not just evaluation vendor security, however also evaluating the security controls implemented by the origination during implementing the cloud solution. The cloud providers put an onus on the companies using them to implement a lot of security controls – inherently they may provide the capabilities however its upto the company using them to implement those controls (such as MFA, encryption, audit controls, password complexity and so on). No cloud security evaluation is completed unless 360 degree view of security is taken (vendor security plus implementation controls)
-
@star2law – Agree with @rg05, Soc 2 Type II report is a great start. Additionally, you could also refer this whitepaper from Dropbox Security – https://www.dropbox.com/static/business/resources/Security_Whitepaper.pdf
-
Hi regarding cloud storage security, it was nice to get information on the SOC 2 TYPE II report. I tried downloading the report for Microsoft Office 365, but the page had been loading for past 15 minutes where I have a bandwidth of around 100 Mbps. 🙂 Do anyone have a copy of this report?
You must be logged in to reply to this topic.
