CMS Cloud Security Terms and Standards, Defined

The concept of security is nothing new, and has long captured the American imagination. In many popular books and movies, whether set in the old west or in a modern office building, someone has something of value that someone is trying to take.

In Westerns, bad guys rob banks and trains. In modern movies, terrorists and thieves bypass sophisticated electronic security systems to stage high-tech heists. Even real-life stories that still haven’t been resolved, such as a daring escape from Alcatraz or an unknown man stealing money and jumping out of a jet with a parachute, continue to fascinate the public.

And in the business world, security issues are just as important, if not as theatrical. Data has become more valuable than ever, meaning that there are people who will try to steal it. But the bad guys aren’t wearing six-shooters and riding a horse or grabbing stacks of bearer bonds at the Federal Reserve. Rather, they’re sitting at computer desks and looking for ways into business systems.

Luckily, cloud security has grown, evolved, and become more sophisticated than ever. In this article, we’ll define some important security terms and standards, including the most essential features for a good contract management software system.

Taking Advantage of the Cloud

“Cloud” computing is defined as the use of software or other services on the internet, rather than on a local computer. Similarly, the associated data is stored in locations other than the enterprise’s computers. This allows employees to work from anywhere that they have a computer and access to the internet.

In the beginning, as with most new technologies, many people feared the cloud. However, that phase of fear is passing us by as professionals recognize the security advantages of cloud computing. A Tripwire article notes that the majority of IT professionals now believe that cloud security exceeds security in legacy systems. There are a number of reasons, but we’ll briefly touch on a couple.

For one thing, cloud providers usually have better physical protections for their servers. While a business may have a locked door at its facility, cloud providers offer layered security with walls, barbed wire, security personnel, and cameras. Physical access is tightly controlled.

Additionally, cloud providers often have greater cybersecurity expertise than normal businesses. ContractSafe contract management software leverages these cloud security advantages by hosting on Amazon Web Services (AWS) AMS ISO 27001 – certified data centers.

This certification is a best-practice framework that has international recognition. Audits of data centers ensure compliance with the Amazon certification, as well as with FedRamp, DoD CSM, and PCI DSS certifications. Finally, a web application firewall rounds out the servers’ security.

But there are plenty of other aspects of cloud security that merit discussion. We’ll break down some key terms below:

Encryption of Data

Most of us are familiar with the term encryption, even if we’re not quite sure what it means. Essentially, encrypted data is data that’s been encoded or “scrambled” to make it harder to penetrate or use, but there are countless ways to do that.

All ContractSafe passwords and data are encrypted, both at rest (if it is stored in our system it’s stored as gibberish unless you have the key) and in transit (it’s protected from snoopers as it makes its way to you over the internet), with AES (Advance Encryption Standard) 256-bit encryption. In a nutshell, this means that the number of combinations that would have to be tried to break an encrypted message is mathematically represented by the number 2, raised to the 256^th power. Exactly how many combinations is that? We would be more precise, but to write the number here would require 78 digits!

According to Hashedout, no supercomputer on earth could crack it.

Malware and Virus Detection

Malware is software that attempts to damage, disrupt, or gain improper access to a computer. A computer virus, something with which most of us unfortunately have personal familiarity, is a form of malware.

ContractSafe puts up with neither! We have malware detection software that is constantly updated so that you can rest easy.

Vulnerability and Penetration Testing

What’s the best way to make sure something is truly secure? See if you can break in! And that is exactly what we do at ContractSafe. We use daily vulnerability scans to look for any weaknesses, thereby maximizing security. We also have continuous intrusion detection.

But we go the extra mile by having hackers try to penetrate the system. That way, anything a bad guy tries to think up, we’re already a step ahead.

Backups and Redundancy

How many times have you told yourself you need to back something up? Well, with ContractSafe you can spend your time worrying about something else. We constantly backup our database. Of course, if you like making backups, you can do it, too!

We also have a 60-second failover to a fully redundant server - in other words, an offline server that can take the place or “share” the load with the active server.

SOC 2 (System and Organizational Controls) Compliance

In very general terms, SOC 2 is a system of controls that measures how well service companies secure data. When a cloud-based company achieves an SOC 2 certification, you are further assured that the provider has a system with top-notch cloud security, designed to secure your data. This certification is provided by an auditor, similar to a financial audit. It helps prove that a company actually has the security in place that it says it does.