Cloud security guidance

When assessing the suitability of a given cloud service, you will need to decide on the service model and deployment model you adopt. This is an essential first step towards determining whether the separation measures needed for your intended use are in place.

Your choice of service model is determined by how much of the service you will build and run for yourself, and how much the provider will do for you.

In general, we recommend that you take the minimum amount of responsibility for yourself, preferring that the service provider manage as much as possible. This is covered in greater depth in the section on the cloud’s shared responsibility model.

The deployment model is all about where your service will store and process your work.

The final issue is cloud key management services. This will be more relevant to those building services (than those consuming them) but in all cases you should understand that your data is being suitably protected.