Top 10 Cloud Content Management Security Issues

By Author: Dave Ruschel
Total Articles: 5
Comment this article

If you are considering implementing a cloud-based document maangement solution utilizing cloud computing, there are 10 major issues to consider for finding the right partner.

Part 3

If you are considering implementing a cloud-based document maangement solution utilizing cloud computing, there are 10 major issues to consider for finding the right partner. This article is Part 3 of 3.

Issue 7: Is security verified on a regular basis by an independent 3rd-party?

While outsourcing is frowned upon for security infrastructure management, it is preferred for security verification. Someone is always trying to attack every system on the internet. Therefore, any vendor or company with an internet presence should be employing a third party to attempt to hack into systems and verify immunity to the latest exploits. If possible, they should use an industry-leading vulnerability and compliance management service to scan their network and validate security on a daily basis.

Issue 8: What physical security protects the data storage system?

People, fire, power failures, natural disasters and terrorist ...
... attacks are risks for data centers and companies alike. Physical protection can be the first line of defense and one of the most important factors in information security. More physical security equals better protection, and dependable storage systems improve information reliability and availability. Don’t be alarmed that vendors outsource physical security responsibilities, such as video surveillance. Here are some basic security and reliability measures to look for as well as some additional ones.

The Basics

Physical access should be restricted to only required personnel who have proper clearance and photo identification. All activities inside and outside the facility, including utility entry points, should be monitored and videotaped. Numerous provisions should be taken to protect against environmental dangers and power outages.

Preferred Physical Security and Reliability Measures

Multiple network entry points

On-site generators for emergency power

Battery backups for external power sources

Redundant data centers in a different geographic location—preferably on separate continental power grids

Advanced HVAC system to ensure constant temperatures

Fire detection system and, preferably, an early smoke detection system

Network administrator and engineer access is secured by RSA SecurID® two-factor authentication devices (both an ID number and a computer-generated authentication code, which changes every 60 seconds, are needed to gain access)

Issue 9: Where are the “single points of failure” within the system?

Although most vendors will immediately respond that they have no single points of failure, it is always good to ask them to explain that statement. Both in-house and outsourced ECM systems should be engineered for reliability so that they withstand multiple failures before services become unavailable. In the best case scenario, engineers should monitor every piece of equipment in the network 24 hours a day, 365 days a year. Monitoring should never be outsourced to a third party.

Additionally, the data system should have multiple redundant systems and multiple data sites to avoid data loss and service interruptions. If service is interrupted, the customer should have the option to be notified. Most importantly, when something does go wrong, data integrity should never be sacrificed for availability.

Issue 10: What is your disaster recovery plan as it applies to data restoration?

Backup frequency and storage methods are critical elements of disaster recovery and information reliability. Local tape backups provide a good safeguard, but restoring large volumes of information stored on tape can take days, weeks or even months. A better practice for vendors and companies that implement ECM in-house is to use multiple, fully redundant storage systems and mirror all data (including backup files) synchronously. Within seconds, the vendor should be able to synchronize data between sites.

Activating the secondary site to become the primary site should take only a matter of minutes, and, ideally, no data restoration should be required.

Accidents happen. Make sure you’re comfortable with how frequently your information is backed up and the amount of time needed to recover your data and restore information access.
Resource: http://www.datamationis.com/software/document-management