A New Approach to Cloud Computing Security
Arguably the greatest barrier to businesses taking full advantage of cloud computing is the issue of security
By: Alf Pilgrim
Dec. 9, 2009 11:00 PM
Arguably the greatest barrier to businesses taking full advantage of cloud computing is the issue of security. Recent high-profile breaches of the cloud (the attack on Twitter being perhaps the most publicized) have only served to heighten concerns.
It's true; the potential consequences of a breach of cloud security are catastrophic, and this knowledge has served to make the debate rage even more fiercely. A cloud security issue within an organization has the potential to be a major business crisis, and against a backdrop of heightened public awareness of data loss and privacy issues such as ID theft, it's understandable.
But there's no denying that cloud computing is gaining momentum and will continue to become more and more mainstream. This year, for example, the UK government announced that it would be developing a cloud infrastructure (the ‘G-Cloud'), and the offer of flexible, low-cost and easily scalable IT means that many businesses are relying more and more heavily on cloud-based applications, storage and security.
The result is that the industry must get to grips with the security concerns. Fast.
It's a bit of both in my opinion. First, there's certainly a lot of confusion. A recent report by Gartner  suggests that most organizations don't fully understand their business' existing security provision and therefore cannot accurately pinpoint exactly where the gaps are when it comes to working with a cloud-based provider.
Furthermore, a lot of the confusion - and concern - arises from the (largely incorrect) assumption that cloud security is a complex issue. Security of the cloud is not necessarily as complex as some would have you imagine.
Combine this with the often large numbers of potential cloud providers with whom an organization may have a relationship at any one time and the greater level of data sharing inherent in many cloud services, and the issues become clear.
One of the key issues that arises from a security perspective as a result is the greater transfer of data in and out of a company's own IT infrastructure. Cloud computing differs from other similar IT services by moving data further from its original owner. As data storage and email outsourcing become two of the most popular modern cloud-based services, security fears over the transfer of data, and later, over who has access to this data, remain significant concerns.
However the numbers of cloud providers involved and the level of sharing that is inherent with many cloud-based services may well prove to make the task of securing the cloud itself an almost impossible one.
The key problem is that by the time data has reached the cloud, it's normally too late. As soon as a company's data leaves the relatively safe confines of its own IT infrastructure, the potential is there for it to get into the wrong hands. For this reason, it's at the boundary between the organization and its external environment that security has to be the key priority for those looking to use cloud-based services.
Confidence in the Cloud
While security is an important consideration, let's not forget that security must essentially be about enablement. It's no good having security that operates by preventing access, clamping down etc.
Security in this day and age must be about giving businesses the confidence to take advantage of new technology. This in turn, will lead to better communication, connectivity and innovation.
For Your Eyes Only
In the case of highly sensitive material, the best course of action in most instances is to prevent it from leaving your organization in the first place. (It is classic psychology that sensitive or confidential material is considered less so the further away it gets from the original creator.) What is therefore needed is highly sophisticated automated checking of outbound data to ensure that data that shouldn't leave the organization does indeed remain there.
For this reason, the key priority for improving the security of cloud computing lies not in the security of the cloud itself but in the routes in to and out of the cloud. Consider the analogy of tangible security risks to homes and business premises; it's the access points that are always the weak point. Therefore it's vital to ensure the ‘windows' and ‘doors' of cloud computing are made as secure as possible. Addressing the security of your company's specific cloud entry and exit points is the best - and simplest - way to get a grip on the potential issues involved to enable businesses to take advantage of all that the cloud has to offer.
Inbound from the Cloud
Advances in appliance-based technology now mean that non-cloud based email security applications are as effective at reducing spam and malware with similar efficiencies to cloud-based services, but without the risk of handing all email data to a third party.
Keeping It Simple
Collaboration and openness (both key cloud computing premises) are great attributes for many types of technology, and security nowadays must shift to focus on enablement rather than prevention. But collaboration and sharing is one thing when it's just you and your home PC and you are taking individual responsibility for the potential consequences of your actions. The same is not true for a company IT system where this way of working and engaging with customers and suppliers, though often commercially advantageous, carries far greater risks and therefore needs a level of corporate governance.
While it's easy to assume, when looking to adopt cloud-based services, that a third party may be a safer pair of hands, the reality is that there are no guarantees, and even if there is someone else to blame, the potential damage to your business could be catastrophic The only way to ensure your data is not compromised by the cloud is to control what is going to and from it in the first place, and make sure your control over what goes to and from the cloud is watertight.
Reader Feedback: Page 1 of 1
Latest Cloud Developer Stories
Subscribe to the World's Most Powerful Newsletters
Subscribe to Our Rss Feeds & Get Your SYS-CON News Live!
SYS-CON Featured Whitepapers
Most Read This Week