|By Tommy Petrogiannis||
|July 7, 2014 08:45 AM EDT||
As the number of companies adopting cloud-based solutions continues to increase, security remains top of mind for vendors, companies and their customers. Organizations of all types and sizes are opting for cloud e-signatures for many reasons including speed-to-market, agility and a lower total cost of ownership. What organizations concerned with cloud security may not know is that all e-signature solutions are not created equal; enterprise-class cloud e-signatures enable security that is beyond simply passing a security audit or obtaining certification. There are four areas organizations should keep in mind when considering SaaS e-signatures.
1. Data Protection
Recent large-scale data breaches and general concern over personal privacy in digital spaces have understandably left many wondering if their customer data is secure. E-signature solution vendors have the responsibility to ensure data is safe, which includes protecting against privacy breaches or malware attacks and ensuring that data is encrypted in transit and at rest.
In order to demonstrate that the organization has adequate controls for data protection, including technology and processes, the e-signature service host should meet the strictest certification standards like Service Organization Controls (SOC) 2, which reflects that the organization has adequate controls for data protection, including technology and processes.
The good news is that cloud computing has matured over the years and now offers trustworthy infrastructure solutions with stringent security protocols in place. However, the infrastructure used not only needs to ensure high availability, but also that the data is securely backed up and is protected against unauthorized access. The e-signature provider should be leveraging a mature, trusted and certified cloud infrastructure solution such as Amazon Web Services rather than relying on in-house servers. Finally, when evaluating an e-signature vendor, it's important to ask what security protocols and controls are in place to ensure it is keeping data safe and secure.
2. Strong Identification, Authentication & Attribution
Security and user identification, authentication and attribution are important considerations for organizations wanting to embrace cloud-based technologies. Identification is the progress of verifying someone's identity either in person or remotely, whereas authentication is the process of verifying user credentials (most often user name and password) prior to giving access to a system - in this case, e-signing. Many financial services, insurance, healthcare and government organizations require advanced authentication methods to validate the identity of signers. Examples of identification can include email, SMS text passcode, Q&A and third-party authentication services. The e-signature solution should offer a variety of ways to authenticate signers depending on:
- The legal and compliance risk
- The likelihood of fraud
- The value of the process being automated
3. Tamper-Evident E-Signatures
With tamper-evident controls, all parties involved in a transaction can trust the integrity of a signed document. If the document has been adjusted even slightly, it will invalidate any signatures and alert signers to the fact that it has been tampered with.
In order to ensure these controls are properly in place, digital signature technology should be applied at each signature location, creating a digital fingerprint of the document (called a hash) that can be used at any point to verify the integrity of the electronic record. This verification should take place in the document rather than sending the use to the vendor's website to validate the signature. Since e-signatures are only as good as the security that protects them, it's important that any attempt to tamper with any part of the document, for example adding or deleting words or replacing pages, should be visible. An enterprise-class e-signature solution should demonstrate this tampering by invalidating all the signature areas within the document.
4. Detailed Evidence Through an Embedded Audit Trail
The hashing of information into the document not only secures a document but it also creates a reliable and consistent audit trail of who signed, in what order, at what time and in what locations. Further, using e-signatures built on digital signature technology, the audit trail is securely embedded into the document. That means that all electronic signatures, the time stamping and the audit trails would be embedded directly within the document and not stored separately in the cloud or ‘logically' associated in a vault or proprietary database.
Organizations should have access to this data without having to depend on a vendor or its systems for access. This type of vendor independence is a concern for many organizations looking at cloud applications and gives users peace of mind that their valuable business records will remain in their control for as long as their retention policies require. An embedded audit trail means your e-signed records will work seamlessly with your content management systems or your chosen system of record.
When it comes to electronic signatures, taking a multi-pronged approach will ensure the highest level of security for documents and data that pass through a cloud e-signature solution. At the same time, it's important to choose an enterprise-class e-signature solution that offers additional security measures like embedding all data associated with the transaction into the document, reliably reproducing that data as evidence in the event of a dispute and enabling the reduction of risk around non-compliance. Ultimately, this multilayer approach to cloud e-signature security will foster customer confidence and protect an organization's reputation.
As organizations ponder these security features and requirements, it is highly recommended that they apply a level of controls and safeguards comparable to the paper process. Some organizations have a tendency to believe that putting a process online requires stricter security, however security and usability can at times be opposing forces. Organizations must strike the right balance so to manage risk while ensuring maximum adoption.
- Mainstream Business Applications and In-Memory Databases
- Findly Enhances Recruiting Efficiency With New Single Sign-on Portal
- Ukraine Has Potential in Midst of Chaos
- “Entisys 02” Finishes in Top 20 at the 2014 NASCAR K&N Pro Series West Race at the Sonoma Raceway
- Complete Surface Pro 3 Review - 3 days later
- Flexera Software Increases Commitment to Europe with Germany-based Datacenter to Host FlexNet Manager Suite Cloud for European Customers
- CORRECTING and REPLACING Android and the Open Automotive Alliance Shift into the Next Gear
- June 2014 Server and StorageIO Update newsletter
- Research and Markets: Global Industrial Control Systems (ICS) Security Market 2014-2018 with Cisco, Fortinet, General Dynamics, Juniper Networks, McAfee, Raytheon & Symantec Dominating
- MongoDB World in NY City this week
- Book Review: Learning Mobile App Development
- Grabbing the Supply Chain Bull by the Horns
- Mainstream Business Applications and In-Memory Databases
- The Odd Couple: Marrying Agile and Waterfall
- Fanning the Flames of Agile
- Big Data, Cloud and Mobile - Converging Technology Trends
- April and May 2014 Server and StorageIO Update newsletter
- WSO2 Introduces Industry’s First Enterprise Identity Bus With the Launch of WSO2 Identity Server 5.0
- Big Data Expo 2014 Silicon Valley Call for Papers Now Open
- Jim Miller at ImageWare Systems, George Romas at HP, Jody Ross at AMAG, + March Networks and StrikeForce Featured in SecuritySolutionsWatch.com Interviews
- Microsoft SharePoint at a Crossroads – Opportunities & Challenges Abound
- The Butterfly Effect Within IT
- The Linux Foundation's Core Infrastructure Initiative Announces New Backers, First Projects to Receive Support and Advisory Board Members
- Setting the Bar for Agile Architecture
- Google Maps and ASP.NET
- Converting VB6 to VB.NET, Part I
- How to Write High-Performance C# Code
- Where Are RIA Technologies Headed in 2008?
- Crystal Reports XI & How It Has Changed
- Creating Controls for.NET Compact Framework in Visual Studio 2005
- Programmatically Posting Data to ASP .NET Web Applications
- Implementing Tab Navigation with ASP.NET 2.0
- AJAX World RIA Conference & Expo Kicks Off in New York City
- The Top 250 Players in the Cloud Computing Ecosystem
- i-Technology Viewpoint: "SOA Sucks"
- .NET Archives: Getting Reacquainted with the Father of C#