Report calls for businesses to wake up to the security challenges of using Internet-based computing services

June 2008 was an important month in the advancement of so-called ‘cloud computing’ – the delivery of scalable IT applications and other services by third-party providers via the Internet.

Firstly, the examples of the adoption of cloud services started to emerge. Construction firm Taylor Woodrow announced it had moved its 1,800 staff from legacy desktop applications to the Google Apps collection of office services, saving it an estimated £1 million.

At the same time, the New South Wales Department of Education and Training dropped its Microsoft Exchange email server software serving 1.3 million students in favour of Google’s Gmail product. The switch cut the cost of three years’ service from AUS$33 million down to AUS$9.3 million while increasing the capacity of each mailbox from 35MB to 6GB.

Another endorsement came in the form of a report from analyst company Gartner, which declared that cloud computing would be “as influential as e-business”.

But no sooner had the ink dried on that document than another report from Gartner emerged warning businesses of the dangers. “Cloud computing is the least transparent externally sourced delivery method,” warned analysts Jay Heiser and Mark Nicolett.

“It not only introduces the same risks as any externally provided service, it also includes some unique risk challenges.”

The risks they identified include reduced visibility, the complication of compliance, and the loss of control over the location of the data. Reliability and recoverability become a concern when outsourcing to a commodity provider, as does the viability of that supplier.

The analysts recommend using third parties to assess the risks of using any cloud computing provider, and to demand greater transparency than many are currently willing to offer.

The experts' response

Guy Bunker, chief scientist for security vendor Symantec, believes that awareness of the risks must be improved if cloud computing is to become a viable IT strategy

At the moment, we have implicit trust, within our organisations and with the people we do business with. But the various high-profile cases of data loss have proven we can no longer rely on implicit trust.

We are living on a good buzz of the benefits of cloud computing but we are being naive. The security concerns surrounding cloud computing can be resolved, but we need to ask the questions early and air our concerns up front.

Robert Whiteside, head of enterprise for Google, UK and Ireland, says Gartner’s report signifies a natural step in the maturation of the cloud computing model

As more and more businesses embrace cloud computing, it is natural that new challenges and questions would arise. We applaud Gartner for identifying some of those challenges.

At Google, we take the security of our customers’ data very seriously and have multiple levels of safeguards in place, making the cloud both reliable and secure. The strongest validation we have is our customer base.