{3} Heading to the Cloud, Safe and Secure

10.03.2020

Topic: Digitalization | Cloud

New technologies such as modern cloud solutions create many new interfaces. As a result, potential vulnerabilities increase. These vulnerabilities can arise both at the cloud provider and in the company's internal network. It is therefore important to safeguard against possible dangers before a risk arises. Even though many security aspects are the responsibility of the cloud provider, each company is responsible for the security of its data itself. So if a company wants to use cloud solutions, it is in a company's best interest to consider in advance the various requirements for sufficient coverage of security needs, as well as which provider is most likely to fulfill them.

Following on from the previous two articles in our three-part blog series on "Security in the Cloud," this article offers eight tips on what decision makers should consider when selecting a cloud solution.

Eight tips for implementing a secure cloud

When choosing a provider for a cloud service, it is crucial to check the service portfolio of the provider against your own requirements. It makes sense to develop a cloud strategy that includes the use case of a cloud service, the essential internal requirements for this use case, the requirements an external solution has to fulfill, and the time frame for the implementation.

1. Understand the real significance of digitalization for your company

Nowadays, many companies are not aware of the exact impact that digitalization has or will have on their own business as they move processes to the cloud. So it is important to define various aspects of digitalization and to identify their effects on one's own business activities. The question often arises as to not only which areas and which processes can be digitalized in companies and moved to the cloud. They also face the question of which areas to move to the cloud — in terms of advisability.

2. Develop a binding corporate strategy for the cloud

The cloud is usually not an isolated solution that is purchased. Therefore, it is essential that Management and IT devise a clear cloud strategy for the future.

3. Document existing processes

Especially when developing use-case scenarios, it is important to document and define the processes, resources and roles that were previously in place. With this documentation on hand, you will be able to make the most accurate possible assessment of potential cloud deployment and how to use hybrid scenarios and replace existing processes. It will also put you in good stead when it comes to the maintenance of the system.

4. Develop use-case scenarios and requirements for cloud deployment

As your company digitalizes its processes and finds itself subject to the quick turnover prevalent in services and products, you will need to evaluate exactly which processes and areas can be digitized and where outsourcing to a cloud service actually makes sense. The use of a cloud application is not necessarily sustainable in every case. Ideally, requirements for the solution will go hand-in-hand with existing business processes. Therefore, once application scenarios have been evaluated, it is a good idea to define the kind of requirements that will provide for this result.

5. Analyze present structures for deployment

In order to determine the possible uses of a cloud solution, companies should first analyze current IT infrastructure, out of which to derive a plan of action for migration. Foremost in an analysis such as this is the presentation of the baseline situation. Which software systems are being used, in which versions, and what kind of IT infrastructure is housing it all?

We recommend that you take this analysis as your basis when drawing up your plan of action. Our recommendation is to consider the entire IT environment when performing the analysis. A SWOT analysis of the advantages and disadvantages will tend to strengthen your approach to the cloud. The results of this kind of analysis tend to vary significantly from company to company and even from division to division. In addition to the analyses described above, cost analysis should be carried out over the course of several years in order to lay the groundwork for a reliable prediction of amortization of investment costs.

6. Review offers from cloud providers in keeping with your own requirements for data protection and data security

When installing systematic compliance with data protection regulations, all parties concerned must be involved company compliance strategy right from the start. As a rule, these parties will include the data protection officer, some specific departments, and the purchasing department. It is advisable that checklists be used; they can be of aid when checking the offer of a cloud provider in terms of your own requirements. Simplify the selection process by keeping an overview of possible certificates, attestations, and test procedures on hand.

7. Define security measures and implementation strategies

Security measures and security requirements must be defined. They will vary depending on the infrastructure existing at your company and the cloud model you have selected for future use. These questions might help you to define the security measures:

• What data will be outsourced to the cloud?

• Is it important to be GDPR-compliant?

• What is the security strategy for the data?

• What is the procedure in the event of a breach of security?

• How is availability regulated?

• How are cyber attacks detected?

• How can damage be limited?

• What backup/restore procedures can you avail yourself of?

8. Train your staff

Users of a solution must be involved in decision-making at the beginning of the process. See to it that they gain knowledge and experience around the application you are considering. Even after a cloud solution has been implemented, internal training courses should be held regularly. Only when correctly used will a solution serve your ultimate goals and contribute to the success of your company.

Companies moving into the cloud must be aware that there is always a residual risk when data is outsourced to the cloud. It is necessary to evaluate how the company's own, individual "cloud" concept fits in with the cloud offerings available on the market. It is important that cloud providers explain their security concept and discuss relevant requirements and security measures with the client company, and that they take all eventualities into account.

Do you still have your doubts about using the cloud? In the white paper "Harnessing the Potential of Digitalization" you can learn more about the advantages of cloud solutions, illustrated by the example of workflow management. You can download the white paper here.