What about Authentication and Authorization

Of all the problems covered in this article, cloud authentication and authorization has the greatest number of commercial solutions available. This does not mean the issue is easily solved, however. Every organization has its own way to manage authentication and authorization.

First, it must determine if its current authentication system could also work in a secure and reliable way for users in a cloud environment. If the answer is yes, the follow-up question is whether that is also the best way to authenticate cloud services.

Also worth considering: Does every cloud service the organization uses need to be authenticated by the same system?

There is a lot of policy that a company must define to settle the cloud authentication and authorization issue.

Policy aside, any authentication system must be very flexible—whether it integrates with an enterprise's active directory or is standalone, security administrators must be able to easily add support for new services, which may have different authentication schemes and group memberships.

It is crucial that the authentication system fits into the company's aforementioned visibility plan. There's no reason not to know very quickly of a series of failed authentication attempts.

Discussing how to respond to those failures will be left for another day.