Fri, October 23, 2009 — Computerworld — Microsoft wants to get its suite of hosted messaging and collaboration products certified to the ISO 27001 international information security standard, part of an effort to try and assure customers about the security of its cloud computing services. It comes amid broad and continuing doubts about the ability of cloud vendors in general to properly secure their services.

Cloud Computing Definitions and Solutions
Cloud Security: Danger (and Opportunity) Ahead

Google, which has made no secret of its ambitions in the cloud computing arena, is currently working on getting its services certified to the government's Federal Information Security Management Act (FISMA) standards for much the same reason.

It's unclear how much value customers of either company will attach to the certifications, particularly because they were not designed specifically to audit cloud computing environments. Even so, the external validation offered by the standards is likely to put both companies in a better position to sell to the U.S. government market.

Speaking with Computerworld this week, Bill Billings, chief security officer of Microsoft Federal, said the company is currently in the process of taking its Business Productivity Online Suite through the ISO 27011 certification process. The hosted service includes Exchange Online, SharePoint Online, Office Live Meeting and Office Communications Online. He declined to say just when Microsoft hopes to achieve the certification.

The goal is to offer customers, particularly in the government, a higher level of assurance about Microsoft's cloud services than FISMA-certification alone provides, said Teresa Carlson, vice president of Microsoft Federal.

"FISMA is outdated. It is largely a paper-based exercise. We want to take it up a notch" by getting ISO 27011 certification, Carlson said. At the same time, Microsoft is also working to get its cloud services certified to the standards prescribed under FISMA; it hopes to complete the task by year's end, Carlson said.

The ISO 27001 standard is managed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission. To get certified under the standard, Microsoft will need to show that its physical, logical, process and management controls for protecting its suite of cloud services meet a rigorous set of audit criteria.

Though the ISO 27011 standard is widely recognized internationally, it has failed to gain much traction in the U.S., said Chenxi Wang, an analyst with Forrester Research in Cambridge, Mass. "Most U.S. companies don't pay much attention to ISO 27001. They don't know quite what to make of it."

Even so, in the absence of any cloud-specific certification standard, ISO 27001 remains one of the best security benchmarks available. "There's nothing specific to cloud-computing in it. But it has been used in traditional outsourcing for years and is the best standard there is" for information security, she said.