monitoring, application penetration testing, and risk  management. So, if you’re using a Platform as a Service (PaaS) to develop applications, be concerned  about application security. Likewise, if you’re running  your application in the cloud or using a SaaS provider, application security will be an issue. ✓ Identity and access management:  Controls and maintains  access to computer resources, applications, data, and  services ✓ Encryption and key management:  Ensures that only  intended recipients receive data and can decrypt it ✓ What security policies does it have in place? Are they  consistent with a recognized framework and control standard? ✓ Does the provider have any industry certifications? ✓ How does the provider meet audit standards? ✓ Does the service provider have documented policies and  procedures, including escalation procedures in the event  of an incident? ✓ How does the provider handle identity and access management? ✓ How does the provider protect data? These materials are the copyright of John Wiley & Sons, Inc. and any  dissemination, distribution, or unauthorized use is strictly prohibited.  Chapter 5: Improving Security, Governance, and Cloud Reliability 47  In a traditional data center, you may use a directory service for authentication and then deploy the application  in a firewall safe zone. The cloud often requires multiple  forms of identity to ensure that access to resources is  secure.  Data encryption refers to a set of algorithms that  can transform text into a form called cyphertext (an  encrypted form of plain text that unauthorized parties  can’t read). The recipient of an encrypted message uses  a key that triggers the algorithm to decrypt the data and  provide it in its original state to the authorized user. Develop a thoughtful approach to cloud security to succeed  in mitigating security risks. Part of this involves asking your  cloud provider some tough questions. It may also include a  visit to the provider’s facility. Here are a few suggestions for  questions to ask your potential provider: