Plan ahead for cloud computing breaches in cloud contracts, experts say

Marcia Savage, Site Editor

SAN FRANCISCO -- What do you do in case your cloud provider is breached? Well, hopefully you've already planned for it before time on your cloud contract.

At the RSA Conference 2012 on Tuesday, a session offered advice to cloud users on tips on how to plan for cloud computing breaches of their cloud computing contracts. Contracts “are a vital initial defensive line in facing breaches inside the cloud,” said James Shreve, an attorney within the Washington, D.C. office of BuckleySandler LLP.

Organizations should ensure their cloud contracts cover costs to the business from a breach similar to data corruption, and still have a demand that the cloud provider notify them of a probable breach, he said. A cloud user needs the aptitude to see whether a breach has actually occurred and whether customers should be notified.

“Your ability to fulfill your personal obligations is expounded to what [breach information] they provide you,” Shreve said.

He advised cloud users to have a separate incident response plan to address cloud computing breaches. Breach notification laws have varying rules for when affected individuals need to be notified, and the cloud lengthens that process, he said.

It always takes time to unearth what happened in a breach â€" a process that becomes much more complicated with a cloud provider, said Christopher Pierson, chief compliance officer and CSO at LSQ Holdings LLC. “The issue of time turns into more crucial,” he said.

Pierson, who's also an attorney, stressed the significance of due diligence before getting into a cloud contract. “Kick the tires on the front end, when people are very pleasant… and when law enforcement isn't involved.”

Organizations should transcend the SAS 70 report, SSAE16 or SOC reports a cloud provider offers, Pierson said. “A SAS 70 is something to watch, but it surely might not match your whole goals,” he said. “No one document can be enough.”

Companies also needs to consider downstream risks â€" what contracts a cloud provider may need with other cloud providers, he said. They need to also consider the impact of European privacy laws on those downstream risks.

Typically, cloud contracts are short â€" around six pages with only a quarter of a page dedicated to security, Shreve said. “It's a good suggestion to have your individual attachment ready… as opposed to amending cursory language,” Shreve said.

Cloud computing contracts: The due diligence process
Performing due diligence before signing on with a cloud provider was also a subject matter at another RSA Conference 2012 session on cloud privacy issues. In the course of the panel discussion, Nils Puhlmann, CSO at Zynga, said security teams have to understand technically what they're stepping into with a cloud provider and make sure the provider has the safety controls they want.

The due diligence process isn't easy, though. He said he's had cloud service providers reply to questions on security with answers like, “You ought to trust us,” or “Nobody else has asked this.”

The goal of a safety department seriously isn't to make certain “nothing happens” but to cope risks appropriately, Puhlmann said. The price savings is luring companies to the cloud but they have to think about the chance, he said. Security pros ought to analyze the residual risk and the price of managing the chance to an inexpensive level before contracting with a cloud service. “Does it still make business sense?” he asked.

Puhlmann also advised security pros to be reasonable when considering cloud services and knowledge security. “Not everything needs a similar level of protection.”

View all of our RSA 2012 Conference coverage.

Dig Deeper

• Folks who read this also read...