Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am doing some investigation on hosting sensitive data. Mostly finance and fund data but at a personal level. This will be a secure website where users will be able to login and view their fund data. Backups are needed but source data will reside in offline database and will be transfered to this site on a monthly/quarterly basis (not sure at the moment how). Credit card data storage is not required at this time.

I'm trying to figure out what I need to look for when selecting a host from physical security to data security. What are some considerations to take into account when looking for a host? SAS 70? Any others?

share|improve this question
    
What exactly do you mean by hosting in this context? Storing in the cloud so you can get to it from multiple machines? Or making the data available for other people to download? Or backing up off-site? I notice a PCI-DSS tag, are you putting other people's credit card data there? –  Graham Hill Mar 1 '12 at 15:39
    
Sorry. I guess I should have been more specific. This will be a secure website where users will be able to login and view their fund data. Backups are needed but source data will reside in offline database and will be transfered to this site on a monthly/quaterly basis (not sure at the moment how). CC is not required at this time. I'm trying to figure out what I need to look for when selecting a host from physical security to data security. Thanks in advance –  Joshua Mar 1 '12 at 16:09
    
@Joshua - popped your comment into the question and removed pci tag, as it won't be appropriate if you aren't doing anything with CC data –  Rory Alsop Mar 1 '12 at 19:06
add comment

1 Answer

You will want to make sure that all associated vendors have either a SAS70 type 2 or SSAE16 that is up to date. This should provide you with a list of the physical and technical security controls in place, and their effectiveness.

share|improve this answer
1  
whatever you do, however - do not rely on these: they can be mis-scoped or limited in what they give you. Treat them as a good indicator, but no more. –  Rory Alsop Mar 1 '12 at 20:29
    
any reco's on company? rackspace? –  Joshua Mar 1 '12 at 21:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.