Selecting a cloud provider is an important and quite
risky step for an organization.
Therefore, it is often good to look at some of the ways to evaluate
the different cloud providers so that hopefully we select the one
that's the best fit for our organization.
During this course, we've looked at three different areas,
cloud computing concepts and architecture,
security principles of cloud computing, and now we're going to
look at the evaluation of those cloud providers.
One of the most important things to remember from the perspective of the
exam is that everything to do with this external relationship with a cloud
provider should be protected through contracts,
service agreements, and service level agreements.
These allow us to have, formally, a recognition of what are the
responsibilities of the two parties in the contract towards
providing, paying for, and of course, supporting services. When
we evaluate cloud providers,
it's important that we look at it from the perspective of our business.
Each business is a bit different.
We have different security needs, different laws,
different expectations, so the first thing is to look at which of
the cloud providers will provide the services that we need in
order to support business operations.
We may even choose to go to a cloud where we're having a hybrid
that we have a combination of different cloud providers
providing different services as well.
We have to look at what are the choices available for us. Do we go with one
of the big companies? Do we go with a smaller firm? And each of those has
advantages and, of course, disadvantages as well.
We need to ensure that we've gone through a good evaluation process, maybe
a matrix that compares the different cloud providers so we can choose which
is the one that has the services we require.
These should be listed in the various requests for proposals
that we actually prepare, and in that request for proposal we
should always specify what are our requirements as far as
security and as services provided, but certainly at what cost as well.
When we go to the cloud,
there are a number of new legal considerations that come in as well.
We have concerns, for example,
about things like jurisdiction, where is my data being kept, and ensuring
that that cloud provider has the same attitude towards the protection of my
data as I would require, and that of course is very often based on the
sensitivity and criticality of that data.
Many companies are restricted.
They cannot enter into a relationship with a cloud provider that will
store their data outside of their local region or country.
One of the things we should always look at is the ability to audit
and review to make sure that each party to the contract is living
up to their terms and obligations.
So, this could allow a cloud consumer the right to audit some
type of, should we say, cloud relationship.
They can review the contract to make sure that all the things
in the contract are being done, and the right to audit can be
built into that contract as well.
The ability to review and audit may be done as a scheduled process, and could be
done with external parties that have the skills necessary,
for example, to do various types of penetration testing.
One of the things with all of this is to make sure that we
don't have unrealistic expectations and that everything is
specified in the contract properly.
That is why the contract also should always say where any dispute
would be heard if there was to be a problem.
We conduct an audit, we don't believe that the cloud provider is living up to
the terms of the contract, where will that dispute then be resolved? In the
courts of our local area or maybe even another country? This ability to evaluate
cloud providers is important, and something we'll look at some of the ways to
evaluate them in the next section.