9 Cloud Security Questions you need to ask Service Providers

Companies in Ireland and the UK who are considering cloud adoption might already have a general idea of the security risks inherent in cloud computing. However, since different providers may not offer the same levels of risk mitigation, it is important to know which providers can give sufficient assurance on cloud security.

Here are 10 cloud security questions to ask service providers vying for your attention.

1. Where will my data be located?

There are a variety of reasons why you will want to ask this question. One big reason is that there are certain countries that don’t have strict legislation (or any legislation at all) pertaining to cloud computing. In that case, the provider won’t be as motivated to apply high levels of risk mitigation.

So if your data is hosted off shore, then you might want to reconsider or at least conduct a deeper study regarding the security conditions there.

2. Do you have provisions for regulatory compliance?

Certain standards and regulations (e.g. PCI DSS and possibly the EU Data Protection Directive) have specific guidelines pertaining to data stored in the cloud. If your organisation is covered by any of these legislation, then you need to know whether your provider can help you meet requirements for compliance.

3. Who will have access to my data?

In a cloud environment, where your data is going to be managed by people who aren’t under your direct supervision, you’ll have to worry as much about internal threats as you would with external threats.

Therefore, you need to know how many individuals will have access to your data. You also need to know relevant information such as how admins and technicians with data access rights are screened prior to getting hired. You also need to determine what access controls are being implemented.

4. How is data segregated?

Since there will be other clients, you will want to know how your data is going to be segregated from theirs. Is there any possibility of an accidental or intentional data breach due to poor data segregation? Find out if your data is going to be encrypted and how strong the encryption algorithm is.

5. How will you support investigative activities?

Sometimes, even if strong cloud security measures are in place, a data breach can still happen. If it does happen, the provider should have ways to track each user/administrator’s activity that can sufficiently support a detailed data forensics investigation.

Find out whether logs are being kept and how detailed they are.

6. Are we protected by a Disaster Recovery/Business Continuity plan? How?

Don’t be fooled by sales talk of 100% up-time. Even the most robust cloud infrastructures can suffer outages too. But the important thing is that, when they do fail, they should be able to get up and running in the soonest time possible.

Don’t just ask about their guaranteed RPOs and RTOs. Find out whether your data and applications will be replicated across multiple sites. Unless the provider says they will be, you need to find a provider with a better infrastructure.

7. Can I get copies of my VMs?

In a cloud infrastructure, your servers are actually in the form of files known as virtual machines (VMs). Because VMs are just files, they should be easily copied. There may be issues though, like the VMs might be stored in a not-so-popular proprietary format. Another possible issue is that the provider may simply not allow copying.

Having copies of your VMs can be useful should you later on decide to transfer to another provider or even duplicate your cloud infrastructure on your own.

8. What will happen to my data when I scale down?

One outstanding benefit of cloud computing is that when your business demands drop, you can easily scale down computing resources and reduce your cloud spending. ?But what will happen to your data when you decommission virtual servers? Will they be discarded?

You might want your data to be retained up to a certain period. On the other hand, you might also want them to be deleted immediately. Ask about the provider’s data deletion/data retention policies and see if they are in line with yours.

9. What will happen to my data if I decide to close my account?

There might come a time when you’ll want to terminate your contract with your cloud provider. Just like in issue #8, you’ll want to find out more about data deletion/data retention policies.

Although some providers can give you detailed answers, many of these answers can include a lot of technical jargon that can leave you totally confused. If you want someone you can trust to:

  • simplify those answers;
  • help you pick the right cloud service provider, and
  • even make sure cloud security is really upheld once your cloud engagement is ?under way

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK

Check our similar posts

How to Reduce Costs when Complying with SOX 404

Section 404 contains the most onerous and most costly requirements you’ll ever encounter in the Sarbanes-Oxley Act (SOX). In this article, we?ll take a closer look at the salient points of this contentious piece of legislation as it relates to IT. We?ll also explain why companies are encountering difficulties in complying with it.

Then as soon as we’ve tackled the main issues of this section and identify the pitfalls of compliance, we can then proceed with a discussion of what successful CIOs have done to eliminate those difficulties and consequently bring down their organisation’s IT compliance costs. From this post, you can glean insights that can help you plan a cost-effective way of achieving IT compliance with SOX.

SOX 404 in a nutshell

Section 404 of the Sarbanes-Oxley Act, entitled Management Assessment of Internal Controls, requires public companies covered by the Act to submit an annual report featuring an assessment of their company?s internal controls.

This ?internal control report? should state management’s responsibility in establishing/maintaining an adequate structure and a set of procedures for internal control over your company?s financial reporting processes. It should also contain an assessment of the effectiveness of those controls as of the end of your most recent fiscal year.

Because SOX also requires the public accounting firm that conducts your audit reports to attest to and report on your assessments, you can’t just make baseless claims regarding the effectiveness of your internal controls. As a matter of fact, you are mandated by both SEC and PCAOB to follow widely accepted control frameworks like COSO and COBIT. This framework will serve as a uniform guide for the internal controls you set up, the assessments you arrive at, and the attestation your external auditor reports on.

Why compliance of Section 404 is costly

Regardless which of the widely acceptable control frameworks you end up using, you will always be asked to document and test your controls. These activities can consume a considerable amount of man-hours and bring about additional expenses. Even the mere act of studying the control framework and figuring out how to align your current practices with it can be very tricky and can consume precious time; time that can be used for more productive endeavours.

Of course, there are exceptions. An organisation with highly centralised operations can experience relative ease and low costs while implementing SOX 404. But if your organisation follows a largely decentralised operation model, e.g. if you still make extensive use of spreadsheets in all your offices, then you’ll surely encounter many obstacles.

According to one survey conducted by FEI (Financial Executives International), an organisation that carried out a series of SOX-compliance-related surveys since the first year of SOX adoption, respondents with centralised operations enjoyed lower costs of compliance compared to those with decentralised operations. For example, in 2007, those with decentralised operations spent 30.1 % more for compliance than those with centralised operations.

The main reason for this disparity lies in the disorganised and complicated nature of spreadsheet systems.

Read why spreadsheets post a burden when complying with SOX and other regulations.

Unfortunately, a large number of companies still rely heavily on spreadsheets. Even those with expensive BI (Business Intelligence) systems still use spreadsheets as an ad-hoc tool for data processing and reporting.

Because compliance with Section 404 involves a significant amount of fixed costs, smaller companies tend to feel the impact more. This has been highlighted in the ?Final Report of the Advisory Committee on Smaller Public Companies? published on April 23, 2006. In that report, which can be downloaded from the official website of the US Securities and Exchange Commission, it was shown that:

  • Companies with over $5 Billion revenues spent only about 0.06% of revenues on Section 404 implementation
  • Companies with revenues between $1B – $4.9B spent about 0.16%
  • Companies with revenues between $500M – $999M spent about 0.27%
  • Companies with revenues between $100M – $499M spent about 0.53%
  • Companies with revenues less than $100M spent a whopping 2.55% on Section 404

Therefore, not only can you discern a relationship between the size of a company and the amount that the company ends up spending for SOX 404 relative to its revenues, but you can also clearly see that the unfavourable impact of Section 404 spending is considerably more pronounced in the smallest companies. Hence, the smaller the company is, the more crucial it is for that company to find ways that can bring down the costs of Section 404 implementation.

How to alleviate costs of section 404

If you recall the FEI survey mentioned earlier, it was shown that organisations with decentralised operations usually ended up spending more for SOX 404 implementation than those that had a more centralized model. Then in the ?Final Report of the Advisory Committee on Smaller Public Companies?, it was also shown that public companies with the smallest revenues suffered a similar fate.

Can we draw a line connecting those two? Does it simply mean that large spending on SOX affects two sets of companies, i.e., those that have decentralised operations and those that are small? Or can there be an even deeper implication? Might it not be possible that these two sets are actually one and the same?

From our experience, small companies are less inclined to spend on server based solutions compared to the big ones. As a result, it is within this group of small companies where you can find a proliferation of spreadsheet systems. In other words, small companies are more likely to follow a decentralised model. Spreadsheets were not designed to implement strict control features, so if you want to apply a control framework on a spreadsheet-based system, it won’t be easy.

For example, how are you going to conduct testing on every single spreadsheet cell that plays a role in financial reporting when the spreadsheets involved in the financial reporting process are distributed across different workstations in different offices in an organisation with a countrywide operation?

It’s really not a trivial problem.

Based on the FEI survey however, the big companies have already found a solution – employing a server-based system.

Typical server based systems, which of course espouse a centralised model, already come with built-in controls. If you need to modify or add more controls, then you can do so with relative ease because practically everything you need to do can be carried out in just one place.

For instance, if you need to implement high availability or perform backups, you can easily apply redundancy in a cost-effective way – e.g. through virtualisation – if you already have a server-based system. Aside from cost-savings in SOX 404 implementation, server-based systems also offer a host of other benefits. Click that link to learn more.

Not sure how to get started on a cost-effective IT compliance initiative for SOX? You might want to read our post How To Get Started With Your IT Compliance Efforts for SOX.?

When Carrefour Pushed the Right Buttons

Retail giant Carrefour based in Boulogne Billancourt, France is big business in anybody?s numbers. Europe?s #1 retailer opened its first store in 1958 near a crossroads (Carrefour means ?crossroad? in French) and has largely not looked back since then. The slogan for the hypermarket chain with more than 1,500 outlets and close to a half million employees is ?choice and quality for everyone?. Our story begins when Carrefour decided these things belong at home too.

The company implemented a worldwide universal responsibility program firmly anchored on a tripod of goals for environmental, economic and social progress. Its first step was to appoint a five-person project team tasked with liaising with program delegates in all thirty countries in which it operates, and who had responsibility for driving these goals.

The team?s job was to make sure that policies, standards, procedures and key performance areas were common visions throughout Carrefour. By contrast, the local managers? were tasked with aligning these specifics to local conditions in terms of environmental, political and social issues. The project team checked the fit quarterly via video conferences.

The Triple Bottom Line Goals were woven through with Carrefour?s Seven Core Values, namely Freedom, Responsibility, Sharing, Respect, Integrity, Solidarity and Progress. Constant contact was maintained with staff and other stakeholders through ?awareness training? seminars and other dialogues. As the program took hold and flourished, it became evident that the retail giant needed help with managing the constant stream of metrics flowing in.

After reviewing options, Carrefour appointed a software provider to monitor progress against its primary focuses on energy, water, waste, refrigeration, paper, disposable checkout bags, hygiene & quality, management gender parity, disabled people and logistics. This enabled it to track progress online against past performance, and produce meaningful reports.

The Environmental Manager in the Corporate Sustainability Department waxed lyrical when he said, ?We believe that our sustainability strategy and software solution have powerfully improved collaboration, innovation, and overall performance?. He went on to describe how it was helping drive cost down and profitability up, while simultaneously growing brand.

Non-conformance costs can be high and run counter to the imperative to make a profit – while simultaneously ensuring a better world for our children?s children. In Carrefour?s case, having a consultant to measure progress was the key that unblocked the administrative bottleneck. Irish company Ecovaro does this for companies around the world. Click here. Discover what we will do for you.

How AI Helps Improve Field Service

Its seems that with the current rate of technological innovation that these is something new every single day.  Therefore, you’re always looking forward to a new technological innovation that’s going to help you make your business operations more efficient and automated.

One of the most fascinating milestones in the field of technology is the integration of Artificial Intelligence (AI) in business. In one way or the other, AI gives a glimpse of machine supremacy that allows computers to perform tasks that were initially performed by humans. 

Are machines going to completely replace people in the workplace?

Of course, not.  Technologies like AI and Machine Learning are designed and meant to support employees in doing their tasks too boost their productivity.

AI is predominantly used to eliminate jobs and tasks that humans find boring, demotivating or monotonous. In some cases AI is also used to do jobs that are considered dangerous for humans to preform.

Previously the most common implementations for AI were all about gaming, entertainment, and advanced science,  now it’s spreading into a number of industries including the field service industry.

FieldElite – Field Service Software , can help you optimise the day-to-day operations of your business.

AI in field service management will enhance you business capabilities with:

  • Information Sharing
  • Real Time Updates
  • Automated Workflows
  • Digital Form Data Collection
  • Data Analysis

Improved Customer Service

For Service Based companies, customer retention is vital. Primarily because It can be 5-25 times more costly to acquire a new customer than it is to retain an existing ones.

Therefore customer retention should be a primary focus.? The good news is that by making use of AI you can implement services It can be 5-25 times more costly to acquire a new customer than it is to retain an existing one.

Staying on top of and ensuring you satisfactorily address and meet you customer demands and expectations can be a daunting task.? It can also be an expensive one,? especially for small field service based businesses like :

  • Heating & Plumbing Engineers
  • Electrical Contractors
  • Fire Safety Inspectors
  • HVAC Engineers
  • Facility Management
  • Building, Construction & Trade

Implementing Artificial Intelligence and Machine Learning to automate mundane and repetitive customer administration tasks will enable your staff to be free to provide additional value added tasks for your customers. Making your customers happier.

?Think about the active Chatbots. You can always get complaints directly from customers and address them right away.??

If at any point the customer is unhappy with your services, they can always raise the issue via the Chatbots. Since the bots contain necessary customer information, you can always get back to them and fix the issue at hand.?

With AI in field service, you can solve problems before they arise, or what is otherwise known as predictive maintenance,? In that way, you’ll have better customer relations because you’ll be able to address your customer concerns before they even become aware of them.

Improved Productivity

Scheduling tasks and managing the workforce isn’t a walk in the park. It goes beyond assigning tasks to your team members in the field and giving them deadlines to meet. Whether it’s a small firm or a big organisation, it’s quite difficult to organise the workforce.?

However, adopting Artificial Intelligence can iron out the difficulties most field organisations face in scheduling and managing tasks. Some years back, most firms relied on human intelligence to dispatch jobs to the right people based on given conditions. This was quite difficult, especially that it wasn’t always successful. But thanks to AI. With field service apps like FieldElite scheduling tasks and managing workforce is only a few clicks away.?

What’s more? There?s no room for error. Therefore, you’ll always match the right people for the job. Again, your team will always get tasks on time. That means, the job completion rate will go up, and hence the workforce becomes more productive.?

Predictive Maintenance

Usually, most business operations are based on ?solve the problem as it occurs?, which is just OK. However, it’s not always safe to wait until a problem occurs so that you solve it. Prevention is better than cure, and that’s why Artificial Intelligence comes handy in Field Service.

Using FieldElite Workforce Management Software , you don’t have to wait until something breaks.? Utilizing AI in field service enables you to proactively address field service needs and prevent unforeseen failures and interruptions.?

The ability to predict field service needs through field service apps like FieldElite enables you to make more accurate forecasts. In this way, resource planning is made easier, and as such, you’ll have smoothly running workflows. Again, by taking care of unforeseen circumstances in advance, you’re flexible enough to take care of the unexpected. And that means the overall productivity of your business will go up.

Job Management

Most field service jobs involve multiple stages that can take several days to complete. In addition to this, more often than not, you have to coordinate lots of equipment and contractors at the same time. All these can’t be achieved solely by human efforts. For more successful outcomes, it’s important to incorporate Artificial Intelligence in your field service operations.?

FieldElite is the field service solution that can help you manage sophisticated tasks. The app is packed with field service management tools that enable you to assign complicated tasks and keep track of your field techs. For long-cycle jobs, FieldElite app enables you to follow up on the activities going on the field to ensure they’re completed.?

With AI, there?s no room for error even when the jobs become more sophisticated.

Data Analysis

?

Field service industry involves lots of data. Some years back, organisations depended on human intelligence to analyse big data. Well, things still worked out, but as a human is to err, the outcome wasn’t always perfect. However, with Artificial Intelligence data analysis, 100% accuracy in data analysis is achievable. Field service solutions like FieldElite provide sophisticated data analytic tools that enable you to crack massive data and offer accurate solutions.?

FieldElite data analytics capabilities give you an insight into what’s not working and what needs to be improved. In that way, you can always address matters arising and take care of the loopholes.?

It’s time to go paperless with field management software like FieldElite if you?d like to make your business more profitable. Apart from improving the productivity of your workforce, incorporating AI in your business increases profitability. If you’re still doing your usual field rounds with a clipboard, it’s time to simplify your task with FieldElite app.?

Contact Us

Ready to work with Denizon?

Contact Us Today