Safeguarding Your Most Valuable Data: Five Key Criteria to Assess Cloud Provider Security

Digital transformation has made IT environments more digitalized, interconnected, and complex, pushing many organizations toward cloud adoption for elasticity, cost reduction, automation, and improved security. Despite these perceived benefits, companies worry about network latency, availability, and vendor lock-in. A majority of IT specialists nonetheless view cloud as more secure than on-premises, especially for smaller firms with limited security staff, because cloud service providers invest heavily in security and compliance and offer extensive security services. Still, provider selection and assurance must be governed deliberately; otherwise security can become a “cargo cult” driven by compliance checklists rather than risk reduction.

A central challenge is complexity: data sprawls across environments and silos, hybrid IT becomes the norm, and consistent protection is difficult to maintain. Many incidents trace back to human error—misconfigurations, missing patches, and negligence—while insider risk expands in cloud contexts to include provider personnel and multi-tenant “nosy neighbor” threats, amplified by platform vulnerabilities. Data breaches carry direct costs (a 2019 global average of $3.92M), indirect losses (trust erosion and reputational damage), and regulatory penalties (including GDPR and recurring PCI DSS-related fines). Under the shared responsibility model, providers are rarely accountable for customer losses; customers remain responsible for securing data, including discovery, classification, access governance, monitoring, and risk management.

Five security-focused cloud selection criteria are proposed: capabilities aligned to shared responsibility across IaaS/PaaS/SaaS; defense-in-depth controls with redundancy and unified visibility; secure-by-design architectures; secure-by-default configurations to reduce skills-gap-driven mistakes; and automated security that augments humans while minimizing human-caused risk. Oracle positions itself as a “secure vendor,” emphasizing built-in, always-on, automated security and second-generation cloud design choices (isolation, least privilege, off-box virtualization, encryption, and identity controls) intended to reduce both external and insider access risks.

• Digital transformation has profoundly changed society, especially in the last decade.
• Many companies cite cloud benefits such as elastic scale, reduced costs, automation, and security.
• Some organizations perceive cloud risks including added network latency, availability problems, and vendor or platform lock-in.
• A surprising majority of IT specialists see cloud as more secure than existing on-premises infrastructure.
• A 2019 Ponemon Institute study put the global average cost of a data breach at $3.92 million.
• The GDPR fine record holder mentioned is British Airways with a $230 million fine issued last year.
• PCI DSS violations can accrue monthly penalties until an organization returns to a compliant state.
• Under the shared responsibility model, responsibility differs across IaaS, PaaS, and SaaS, but responsibility for data always remains with the customer.
• Oracle Corporation is headquartered in Redwood City, California.
• By mid-2020, Oracle Cloud reportedly had as many regions as AWS.

• “Cloud provider selection and assurance should be a major part of every organization’s IT governance.”
• “Otherwise, security can devolve into a ‘cargo cult’, its only purpose being another checkbox in a compliance audit form.”
• “Unfortunately, humans continue to be the weakest link in the chain of IT security.”
• “Instead, a multitude of security controls deployed at every level of the cloud application architecture is required.”
• “Most cloud service provider security tools are still just tools and add complexity.”
• “The notorious skills gap is real – only the largest enterprises can afford to hire enough real pros.”
• “However, the ultimate holy grail for automating cybersecurity nowadays, at least according to the press, is Artificial Intelligence.”
• “Still, it must be stressed that artificial intelligence… was never intended to replace humans, but rather to augment their powers…”
• “Security is only efficient when it’s always-on.”
• “Even though Oracle never positioned itself as a security vendor, security is core to everything the company does for its customers as every truly secure cloud vendor should.”