In reply to Gary Haney.

Hi, Gary -

I agree 100%. Not all cloud service providers deliver services that meet your (or our) security requirements for confidential (or highly confidential) information. Some do, but its very hard to tell them apart, and its not possible to trust the vendor's own assessment of the security of their service.

One option that helps a lot is to find a cloud service provider that has partnered with a good Cloud Access Security Broker (CASB) to provide security and other services (e.g. performance analysis) for your cloud services. But that doesn't cover a lot of CSPs.

Cisco IT has had to build our own internal Cloud & Application Service Provider Remediation team (CASPR), to identify the many hundreds of cloud services we use inside Cisco (an order of magnitude higher number than I'd expected), and then analyze and remediate their security limitations. Its a highly manual and time-intensive process, but its enabled us to find and help improve over 500 cloud services that are safe for Cisco employees to use.

For more info, see
http://blogs.cisco.com/ciscoit/b-c-07132015-finding-secure-cloud-services
and
http://blogs.cisco.com/datacenter/qa-cisco-its-lessons-learned-in-assessing-the-risk-of-new-cloud-services

- Rich