Storage, Compliance, and Regulations in the Age of Cloud

The Government Cloud. Ever hear of FedRAMP? If not, it’s time to take a look. Basically, FedRAMP is the result of close collaboration with cybersecurity and cloud experts from GSA, NIST, DHS, DOD, NSA, OMB, the Federal CIO Council and its working groups, as well as private industry. Already, cloud providers like IBM, HP, Microsoft, and Akamai are FedRAMP certified cloud service providers. Amazon is in the mix as well. For example, AWS GovCloud (US) allows US government agencies and customers supporting the US government to move more sensitive workloads into the cloud.

PCI/DSS and the Hybrid Cloud. E-commerce in the cloud has always been a bit of a challenge. The passing of sensitive information caused serious issue for cloud providers. And so, providers like Rackspace decided to get creative. By intelligently controlling data through the cloud, the organization’s servers, and the payment gateway you’re able to continuously control the flow of sensitive information. According to Rackspace, when you host your infrastructure in their cloud, you can also sign up with a separate payment processor to provide tokenization, which occurs when you replace credit card data with meaningless numbers or “tokens.” When you accept a payment, non-PCI data is routed to your Rackspace-hosted environment, while the tokenized credit card data is routed to your payment processor. Since your customers’ credit card data is not routed to your Rackspace hosted infrastructure — only to the payment processor — your Rackspace environment stays out of the scope of your PCI requirements.

Cloud for Healthcare. File and data collaboration, also known as the “Dropbox challenge,” has really crept up on the healthcare industry. In fact, HIPAA compliance in general can be a cloud nightmare. And so, a recent change to HIPAA (the Omnibus Rule) now allows for the creation of a business associate (BA). This is any organization that has more than just transient access to data (FedEx, UPS, USPS, for example).

It’s all about the use case. When you’re working with some kind of a cloud workload make sure to understand the impacts on your IT environment, your users, and your business. In some cases compliance isn’t the only barrier to a cloud storage deployment. Applications and data sets might have some very strict delivery profiles.

Work with your provider. It’s good to be in the data center business. More providers are offering various kinds of compliance-ready cloud services and there are even more eager customers. Through this kind of growth, make sure to work with your provider when deploying specific kinds of compliance-bound workloads. There are a lot of new options around multi-tenant segmentation and control.

Keep security at the forefront. As cloud computing continues to boom, there will be more data stored and more targets created. In creating a complaint-ready cloud architecture, next-gen security technologies can keep data flowing safely. This includes application firewalls scanning for anomalous traffic patterns and even port-specific security policies.