October 26, 2009

After Sidekick disaster, Microsoft talks security for cloud

ISO 27001 could boost confidence in hosted services

By Jaikumar Vijayan

Microsoft wants to get its suite of hosted messaging and collaboration products certified to the ISO 27001 international information security standard, part of an effort to assure customers about the security of its cloud computing services.

Google, which has made no secret of its ambitions in the cloud computing arena, is currently working on getting its services certified to the government's Federal Information Security Management Act (FISMA) standards for much the same reason.

It's unclear how much value customers of either company will attach to the certifications, particularly because they were not designed specifically to audit cloud computing environments. Even so, the external validation offered by the standards is likely to put both companies in a better position to sell to the US government market.

Speaking with Computerworld this week, Bill Billings, chief security officer of Microsoft Federal, said the company is currently in the process of taking its Business Productivity Online Suite through the ISO 27011 certification process. The hosted service includes Exchange Online, SharePoint Online, Office Live Meeting and Office Communications Online. He declined to say just when Microsoft hopes to achieve the certification.

The goal is to offer customers, particularly in the government, a higher level of assurance about Microsoft's cloud services than FISMA-certification alone provides, said Teresa Carlson, vice president of Microsoft Federal.

"FISMA is outdated. It is largely a paper-based exercise. We want to take it up a notch" by getting ISO 27011 certification, Carlson said. At the same time, Microsoft is also working to get its cloud services certified to the standards prescribed under FISMA; it hopes to complete the task by year's end, Carlson said.

The ISO 27001 standard is managed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission. To get certified under the standard, Microsoft will need to show that its physical, logical, process and management controls for protecting its suite of cloud services meet a rigorous set of audit criteria.

Though the ISO 27011 standard is widely recognized internationally, it has failed to gain much traction in the US, said Chenxi Wang, an analyst with Forrester Research in Cambridge, Mass. "Most US companies don't pay much attention to ISO 27001. They don't know quite what to make of it."

Newsletters

Sign up to our Weekly Round-Up for the past week’s not-to-be-missed news analysis and insight delivered straight to your inbox.