to be able to control the various services offered and the corresponding elements, and to
solidify auditing mechanism to ensure meeting the control requirements in operation. If a fair
and transparent operation mechanism and standards are in place, supplemented by cloud
services management mechanism, a sound cloud service industry environment should be
able to be quickly promoted.
Organizations interested in cloud services can use the cloud control matrix proposed by the
Cloud Security Alliance (CSA) to assess various service models, or reference the white
paper “Security for Cloud Computing: 10 Steps to Ensure Success” by the Cloud Standards
Customer Council (CSCC). For organizations that have already deployed cloud services, the
focus can be to deepen and strengthen proper information security mechanism, by
referencing the security related standards like ISO 27001, Key Management Interoperability
Protocol (KMIP)
1
,
IEEE P1619 etc.
In addition, the exploration of cloud topics on information protection and privacy can be
considered from the angle of IT governance. Consider the competence and cognition of
personnel to lower the probability of man-made illegal or malicious accidents; and consider
the user and application software interfaces, technology and data security of operation and
business processes, to ensure the appropriateness of physical resource sharing and
interaction when virtualized. Finally, enterprises or organizations and service providers
should consider the life cycle of the capacity and sustainability requirements of any link,
disaster recovery and incident response capabilities, and the risk of legal jurisdictions. They
need to understand the existing business processes, the service provider's ability and
certification, and the customer expectations and requirements. They need to set relevant
policies and regulations on data protection and privacy, communicate with stakeholders, and
perform regular compliance checks, to strengthen their abilities in data protection and
privacy in the cloud environment.
1
KMIP (Key Management Interoperability Protocol) is the standards agreement developed by OASIS (Advancing Open
Standards for the Information Society) for communication between enterprise or organization key management
systems.
