Cloud data security

Security of data means protecting it from unauthorised access, loss or damage. When data is kept in the cloud it sits on hardware in a data centre run by the provider, not on a machine you can see, so protecting it becomes a job shared with the provider.

What to check before you commit

An organisation should know where its data will be stored, including whether it is held in another country, because the laws and safeguards around it may not be the same as at home. It should also check the provider's security procedures and features to make sure they are adequate for the data being handed over. A provider holding records for thousands of customers is a tempting target for cyberattacks, so strong security from the provider is essential.

For example, a chain of dental surgeries moving patient appointments and treatment records to a cloud service would ask which country the servers are in and what security procedures the provider follows before signing up.

What the organisation still owns

Once the data is in the cloud the organisation has no direct control over how the provider stores and manages it: it cannot walk into the data centre or change settings on the servers. That does not hand over every responsibility. Data in the cloud is only as secure as the accounts used to reach it, so the organisation must still set access controls (who may view, edit or delete each record), enforce strong passwords, and set rules for how staff use the service. Choosing a provider therefore means balancing the provider's protection against the organisation's own duties for accounts and staff behaviour.

Responsibility	Provider	Organisation
Where data is stored	Chooses and runs the data centres	Checks the location and accepts it
Security procedures	Puts them in place	Checks they are adequate
Who can get in	Supplies the account system	Decides which staff get access
Staff behaviour	Sets terms of use	Sets and enforces its own rules

accounts = {"Priya": "admin", "Tom": "staff", "Ali": "staff", "Nina": "admin"}

admins = []
for name in accounts:
    if accounts[name] == "admin":  # only these accounts can change access rights
        admins.append(name)

print("Accounts with full control:", admins)

Output:

Accounts with full control: ['Priya', 'Nina']

What to check before you commit

What the organisation still owns

Practise this