Addressing Cloud Security
In this video blog, our CTO Mark Teter, addresses cloud security. The security requirements don’t really change much in the cloud, it’s still imperative to have key standard computer network security protections in place, including:
- Multi-factor authentication. Your server should authenticate every user for their username, password and the company-specific domain customers are logging into.
- Protection against cross-site request forgery and cross-site scripting. Your server should scramble passwords, so that if a hacker opens your password database, the passwords would be indecipherable.
- Next generation firewalls that focus on Layer 7.
- Good encryption. Web browser and desktop access should be encrypted over SSL to protect from sniffers. Data at rest should also be encrypted.
- Segregation of customer data by accompanying every request with tamper-proof user identity credentials, even for offline sessions.
- Proactive security measures. The system should detect and log unsuccessful login attempts for monitoring by the administrator. The cloud provider should be proactive about monitoring network activity, retaining all log files and analyzing them in real-time.