The cloud doesn´t take over your responsibility
Nov 19th, 2019 by Jesper Kråkhede
One of the most common misunderstandings I meet in board rooms is that moving to the cloud means moving the security responsibility as well. ‘Microsoft takes care of that now.’ Well, partly.
The cloud provider takes care of the physical datacenter, the hardware and, depending on the service, a good part of the platform. That is a lot and they do it better than most of us could ever afford. But who has access to your data, how your users logon, how the services are configured and what happens to the information is still your responsibility. It always was.
This is called the shared responsibility model and every manager signing a cloud contract should understand it. Not in detail, but enough to ask the right questions. Who in our organisation owns the security of our cloud services? Do we have the competence or do we need to buy it? Do we have the same governance for the cloud as for our own datacenter? Are the security functions we pay for in our licenses actually turned on?
The last one is my favourite. I have seen more than one company pay for advanced security features that nobody activated.
You can outsource the datacenter. You can never outsource the accountability.