What to Ask a Prospective Cloud Service Provider
The cloud is here to stay. It offers great benefits -– significant savings, low start up, operational and maintenance costs, scalability, flexibility. Many companies are embracing it, but others are still sitting on the sidelines, unsure about trusting outsiders (cloud service providers) with their critical data, and with maintaining their hardware and software. As IT departments grow increasingly frustrated trying to keep up with the needs of the business and at the same time contain costs, and business grows more frustrated with their limited options for keeping the business competitive, more and more companies will turn to cloud computing.
One thing that hasn’t changed with the uptake of cloud-based applications is access management. As with any enterprise application, you need to provide and manage access for your cloud applications. Here are a few common questions to ask a prospective cloud service provider to ensure your data is secure:
- When the cloud application stores sensitive data, how do I, the customer, limit access to that data? How do I, the customer, get information about who has access to that data?
- Does the service provider supply a standards-based method (such as SCIM) to automate the process to provision users and access? If not, do they provide a proprietary method for automatically provisioning users and access, or can it only be done manually? Do the methods they provide for provisioning users and access support a bulk action capability? Or will I need to perform each action separately?
- How do they provide audit reports around the provisioning actions that are taken? Do they provide reports to do forensic analysis around these actions? Do they provide compensating controls to let me know when these are actions are taken?
- How does the service provider manage access, create new users, and assign rights and roles within the application? Do they provide enough granularity to support the levels of access my organization wants to provide?
A cloud service provider who has a well-thought-out user access management strategy for their solution will be able to offer your organization the capabilities you need to take your existing Identity and Access Management (IAM) strategy and extend it to the applications that you’re putting in the cloud.
Courion has been provisioning access to cloud applications such as salesforce.com and Microsoft Office 365 for years. While many other vendors also claim the ability to provision cloud access, just having the ability to provision a basic user isn’t enough. You need to give unique access rights to each user depending on their role within the organization. And we work with both on-premise and cloud apps, with multiple vendors using numerous technologies to solve the problems that the cloud providers, themselves, can’t deliver.
Click here to learn more about how Courion can help solve your IAM challenges – both on premise and in the cloud.