Aug - Sept - 20188Availability and RecoveryBy Michael Stoeckert, CTO, ProAssuranceI am consistently surprised when cloud service providers do not require Service Level Agreements (SLAs) with financial penalties in their contracts. Privately held cloud vendors seem to have a pattern of not including mutual indemnification, data breach motivation and SLAs in their standard Master Services Agreements. Unless buyers hold them accountable by requiring standard safeguards in contracts, we won't see improvement until the state and federal regulatory bodies take action. Recoverability timeframe SLAs should be included in the cloud services contract. Every company needs the full assurance that their entire data environment is recoverable. To do that, an effective disaster recovery plan must lay the groundwork for creating a robust, multi-form system of back-ups and redundancy. A recovery plan must be comprehensive enough to cover on-the-ground data centers and the cloud. Additionally, the recovery strategy needs to be supple enough to have online and offline capabilities at another cloud site. Offline capabilities help remediate the risk of paying ransom after a ransomware attack.Providers must build these four service levels into a dependable recovery plan:1. Availability: A company's business will grind to a halt if connections to the cloud are severed. Therefore, it is vital that a vendor provide an SLA outlining availability, reliability, and redundancy. This usually includes the Recovery Time Objective (RTO), or the time it takes from the point of disaster to fail, to the secondary operation and resumption of production processing. The Recovery Point Objective (RPO), or the maximum time that data could be lost should also be included.2. Capacity: One of the greatest benefits of cloud computing is its elasticity; capacity can be expanded and contracted on demand. To ensure this benefit, the SLA should articulate how much added capacity is guaranteed to be available for periods of peak usage--along with the accompanying tiered pricing model.3. Storage: Managed storage with integrated backup and restoration capabilities is critical. Understanding the replication architecture of the storage is also required to assess the offline capabilities which help remediate the risk of paying ransom after a ransomware attack.4. Logs: The expanding regulatory environment includes logsof successful and unsuccessful access to systems with nonpublic data. Thus, specifying access to logs which are located in the cloud providers' infrastructure, along with verbosity (level of detail within the logs) is an important SLA. Solutions known as Cloud Access Security Brokers (CASB) can help log how the end-consumer is accessing the cloud providers' solutions. However, a log from the cloud providing accessible via an admin portal is always preferred. If a portal does not exist, an SLA that provides verbose logs upon request is a good substitute.Roles and ResponsibilitiesIt can be a confusing forensic nightmare if there is not a clear understanding of responsibilities in all types of infrastructures. This is especially true in hybrid cloud environments which include on premise and private or public cloud. All critical parties must know their specific roles and responsibilities and these should be managed according to your control structure. Reviewing and approving the SLA will clarify who is responsible at every point in the network. To aid in this effort, the Michael StoeckertIN MY OPINION
< Page 7 | Page 9 >