Perhaps that is the point the CSA is trying to get across to the purveyors of cloud services with STAR, which is open to all cloud providers. STAR allows cloud providers to submit self-assessment reports that document compliance to CSA published best practices. According to the CSA, the searchable registry will allow potential cloud customers to review the security practices of providers, accelerating their due diligence and leading to higher quality procurement experiences.
The CSA claims that STAR will offer a major leap forward in industry transparency, encouraging providers to make security capabilities a market differentiator. Ideally, STAR can become another metric for customers to validate if a cloud service provider meets their internal security needs, especially in the world of compliance, where security practices are often dictated by law.
For those looking to build private clouds or internal clouds, the results of the assessment process could provide valuable guidance and clues on how to implement security for internal cloud services. What’s more, the best practices offered by the CSA will further speed the security planning process for those building clouds.
CSA STAR will be online in the fourth quarter. Cloud providers can submit two different types of reports to indicate their compliance with CSA best practices:
In preparation for the public launch of the CSA STAR, providers are encouraged to select their compliance option and prepare a report for submission. CSA volunteers will be available to answer questions about report content. CSA strongly encourages all IaaS, SaaS and PaaS providers, large and small, to complete a self-assessment for publication. In doing so, they will address some of the most urgent and important security questions buyers are asking, and can dramatically speed up the purchasing process for their services.
In addition to cloud provider self-assessments, CSA STAR will provide listings to solution providers that have integrated CAIQ, CCM and other GRC stack components into their compliance management tools. This will help customers extend their GRC monitoring and reporting across their enterprise and in concert with multiple cloud provider relationships. Providers interested in submitting should monitor https://www.cloudsecurityalliance.org/star/ for more details and updates.
CSA STAR shines a light on cloud security practices; some may find this a bit disconcerting, and will worry that transparency will expose them to attacks and breaches. However, transparency also leads to better understanding and improvements in security by exposing possible flaws and weaknesses--in effect, strengthening security.
See more on this topic by subscribing to Network Computing Pro Reports Return of the Silos (subscription required).