The State of Cloud Computing Security

One of the most heated debates in all of enterprise computing these days centers on the security of cloud computing. One IT camp argues that cloud computing is inherently more secure because of the ability to invest in all the policies and expertise required to make the overall IT environment secure.

The other camp argues just as vociferously that the centralization of IT into a few cloud computing platforms makes it easier for the bad guys to focus their efforts and that, once breached, hundreds of thousands of records will be as risk because of all the shared infrastructure inherent to the cloud computing model.

Into the midst of this debate comes a new study from the Ponemon Institute that was funded by CA Technologies. The study of 642 IT executives in the U.S and another 283 from Europe, the Middle East and Africa finds that about half of worldwide IT organizations said that no one in their organization evaluates cloud computing providers for security. Worse yet, half said they were pretty sure that no one in their organizations knew about every cloud computing service that end users in their company were storing data on.

Larry Ponemon, chairman of the Ponemon Institute, says the study clearly shows that at the moment the risk factors with cloud computing are high because not all cloud computing providers have the same level of security. In addition, there is no security rating system in place for cloud computing, so business users can’t even rely on third-party security validations.

Lina Liberti, vice president of marketing for security management at CA Technologies, said the real issue is the total lack of transparency between cloud computing providers and internal IT organizations. The end result is that IT organizations don’t want to take responsibility for things like external cloud computing providers that they can’t manage. Of course, business users have lots of good reasons for wanting to use cloud computing services, but with those decisions they also need to be fully cognizant of the associated risks that they are taking responsibility for.

Longer term, Ponemon notes, there is a potential for cloud computing to actually result in more secure enterprise computing environments because as both public and private cloud computing platforms evolve, IT organizations will get a second chance to rethink their entire approach to security, especially as awareness of cloud computing security issues heighten and the work being done by the Cloud Security Alliance continues to evolve.

In the meantime, Ponemon advises both IT organizations and the end users they serve to proceed with caution.

Click through to see key finding from a survey from the Ponemon Institute, sponsored by CA Technologies.

Roughly half the time they are not.

Faith in cloud security practices appears to be lacking as well.

IT security people are theoretically responsible for cloud computing providers.

But there seems to be a disconnect over just who really is responsible for security.

In fact, it looks like internal IT is not accepting responsibility for actions of business users.

Adoption may be moving faster than security people can keep up.

Cost is the single biggest driver.

About half appear to not have as much control over IT as needed.

Clearly most feel that on-premise security is superior.

Top three are neck-and-neck.

The risks grow as the amount of data in the cloud increases.

All that’s left is data that’s of little to no use.

Identity and access management is always the biggest problem.