Do cloud service providers offer insights on their security issues?

Question

Should someone want a highly secured cloud environment, having the whole infrastructure managed by a third party could be quite stressful I guess.

There are things you can't manage yourself in a cloud environment, like collecting every needed log everywhere, or controlling each security device.

Thus I wondered, do cloud host providers inform in real time some privileged customers of any security related event ? Do such services exists ?

That's the kind of thing which would be helpful for highly regulated environments, which must be compliant to a crap ton of different norms.

Answer 1

Those services absolutely do exist in the best Cloud platforms.

Microsoft's Azure, for example, not only has some of the best security (people processes, services and hardware) on the planet, they prove it by getting all manner of recognised security certifications. Azure has a number of services that allow you to monitor for events in real-time and they apply a number of machine learning techniques to help prevent information overload and only surface real issues.

It is hard to be more specific since there are so many services and each may require a slightly different approach. However, Microsoft are trying to centralise reporting and monitoring into a single event platform.

I'm not so familiar with other global Cloud platforms so I can't comment on those.

The other issue is that "cloud" means a lot of different things to different vendors. At the "low" end, it might just be some shared infrastructure - clearly security is going to be more of an issue there since, while you can very easily implement your own log aggregation and event management tools, the server and network hardware may be open to physical inspection. With the big global public Cloud providers, this is not an option since your data will be encrypted at rest and spread over multiple, random devices in the datacenter.

Obviously, it isn't possible to give specific answers without understanding how sensitive the data is and you absolutely must do a risk assessment on any cloud platform against the data and services you wish to run on it. But suffice it to say that there are many examples of regulated industries using global public Cloud infrastructure.