User:Shawndouglas/sandbox/sublevel1
"The public cloud services market has more than doubled since 2016," found International Data Corporation (IDC) in 2020, noting that "the worldwide public cloud services market, including infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS), grew 26.0% year over year in 2019, with revenues totaling $233.4 billion."[1] In November 2020, Gartner predicted global public cloud computing spend would increase more than 18 percent in 2021, with PaaS growth leading the way due to remote workers needing more powerful, scalable infrastructure to complete their work.[2] Gartner added that "survey data indicates that almost 70% of organizations using cloud services today plan to increase their cloud spending in the wake of the disruption caused by COVID-19."[2]
These statistics highlight the continued transition and investment into the public cloud for organizations, and recent surveys of IT professionals appear to find a matching level of increased confidence in the public cloud.[3] But as reliance on the public cloud continues to grow, organizations inevitably discover new security and networking challenges, including difficulties keeping services seamlessly available and scalable, and network costs more affordable while limiting complexity upticks[3], which makes security more difficult.[4]
As of April 2021, the bulk of public cloud market share is represented by 10 companies: Alibaba, Amazon, DigitalOcean, Google, IBM, Linode, Microsoft, Oracle, OVH, and Tencent. From a security perspective, we have to ask at a minimum four questions about these companies:
- What are their compliance offerings?
- Where is their SOC 2 audit report?
- What is their shared responsibility model?
- What is their architecture framework based upon?
In this context, compliance offerings are the documented compliance certifications, attestations, alignments, and frameworks a public CSP boasts as part of an effort maintain security and compliance for their cloud services. Each of the seven public CSPs has a landing page introducing customers to those compliance offerings (Table 5), though some vendors' pages are more clearly organized than others. Each offering then links off to another page, document, or related certificate explaining compliance. In particular, the SOC 2 audit report should be viewed, though most providers require you to be a customer or inquire with their sales department to obtain it. The SOC 2 audit results outline nearly 200 aspects of a CSP's security, as audited by an independent third party, providing the closest look one can get to a CSP's ability to assist with regulatory compliance (more on this in Chapter 4).[5][6] As previously discussed, a shared responsibility (or shared security) model is the common approach to clarifying who's responsible for what portions of security, and each CSP has indicated somewhere what that model is. (In the case of Tencent, it's unfortunately buried in a 2019 white paper.) Public CSPs also provide some sort of "architecture framework," though this varies from provider to provider. For example, AWS and Google Cloud provide a framework that allows customers to stably and efficiently deploy in the cloud based on both best practices and the organization's unique requirements. Linode, Oracle, and Tencent don't seem to offer this type of framework for customers but still discuss their overall cloud architecture in a broad manner. See Table 5 for links to these four security research aspects for each public CSP.
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Chapter 1 noted that for public cloud services, organizations tied to strong regulatory or security standards ... must thoroughly vet the cloud vendor and its approach to security and compliance, as the provider may not be able to meet regulatory needs. For example, public CSP will allow you to enter into a HIPAA-compliant business associate agreement (BAA) with them, as required by the U.S. Department of Health & Human Services[7], but that does not mean you'd be running in a HIPAA-compliant fashion. If your organization is handling PHI protected by HIPAA, that organization is still responsible for having internal compliance programs and documented processes that support HIPAA, while also using the CSP's services in ways that align with HIPAA.[8][9] That includes ensuring that the services your organization will utilize are indeed in-scope with HIPAA and other such regulations; not all services offered by a CSP are in-scope to a specific regulation. The BAA should make clear which services are covered for handling PHI and other sensitive or critical information. Additionally, your organization will still need to ensure the correct technical security controls are implemented to ensure compliance.[9] Remember, you're working under the shared responsibility model.
References
- ↑ International Data Corporation (18 August 2020). "Worldwide Public Cloud Services Market Totaled $233.4 Billion in 2019 with the Top 5 Providers Capturing More Than One Third of the Total, According to IDC". International Data Corporation. https://www.idc.com/getdoc.jsp?containerId=prUS46780320. Retrieved 21 August 2021.
- ↑ 2.0 2.1 "Gartner Forecasts Worldwide Public Cloud End-User Spending to Grow 18% in 2021". Gartner, Inc. 17 November 2020. https://www.gartner.com/en/newsroom/press-releases/2020-11-17-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-grow-18-percent-in-2021. Retrieved 21 August 2021.
- ↑ 3.0 3.1 Barracuda Networks, Inc (14 January 2021). "New research reveals IT professionals' growing confidence in public cloud despite security concerns". PR Newswire. Cision. https://www.prnewswire.com/news-releases/new-research-reveals-it-professionals-growing-confidence-in-public-cloud-despite-security-concerns-301208046.html. Retrieved 21 August 2021.
- ↑ Bocetta, S. (9 July 2019). "Problem: Complex Networks Getting Harder to Secure". Network Computing. https://www.networkcomputing.com/network-security/problem-complex-networks-getting-harder-secure. Retrieved 21 August 2021.
- ↑ Hemer, N. (18 December 2019). "Trust Services Criteria (formerly Principles) for SOC 2 in 2019". Linford & Company IT Audit & Compliance Blog. Linford and Co. LLP. https://linfordco.com/blog/trust-services-critieria-principles-soc-2/. Retrieved 21 August 2021.
- ↑ Tiller, D. (2019). "Is the Cloud a Safe Place for Your Data?: How Life Science Organizations Can Ensure Integrity and Security in a SaaS Environment" (PDF). IDBS. https://storage.pardot.com/468401/1614781936jHqdU6H6/Whitepaper_Is_the_cloud_a_safe_place_for_your_data.pdf. Retrieved 21 August 2021.
- ↑ Office for Civil Rights (24 November 2020). "Guidance on HIPAA & Cloud Computing". Health Information Privacy. U.S. Department of Health & Human Services. https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html. Retrieved 21 August 2021.
- ↑ "Health Insurance Portability and Accountability (HIPAA) & HITECH Acts". Microsoft Documentation. Microsoft. 17 February 2021. https://docs.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech. Retrieved 21 August 2021.
