Information Age: News, analysis & insight for IT & business leaders

The information security concerns holding back the adoption of cloud computing must be addressed with selective adoption, supplier strategy and service level negotiation

Information security concerns consistently rank as the chief barrier to the adoption of cloud computing services – whereby computing functions are sourced from third parties over the web on a highly scalable, utility-billing basis.

A recent survey by IBM is one of many to have reflected this: it found that 80% of CIOs listed security as their chief concern in assessing the viability of cloud services.

And many of those companies that have already adopted cloud computing still have security concerns. A study published by security association ISACA in March 2010 showed that 40% of UK organisations have deployed some of their IT infrastructure into the cloud, but also that a quarter of cloud adopters still feared that information security risks – in the broadest sense, ranging from the danger of data theft through availability and uptime to data protection and compliance issues – may outweigh the potential advantages.

Despite the widespread concern, the issue of cloud security is far from cut and dried. Some organisations even see the cloud as a security benefit: an investigation by standards body The Open Group found that some members had adopted cloud services as a way to overcome the lack of security of their own infrastructure.

Much of the discussion surrounding cloud security is based on supposition; there have been few public examples of cloud computing data breaches. One example is a ‘technical glitch’ at a subsidiary of Microsoft in October 2009 that resulted in the deletion of thousands of users’ mobile phone contact books hosted in external data centres.

But cloud computing services are still young, and high-profile data breaches and privacy scares have made business and public sector IT leaders a cautious breed. The widespread concern surrounding cloud security, combined with often contradictory views and opinions, represents a stumbling block for what many see as the natural evolution of the IT industry.

“There is a lot of fear, uncertainty and doubt surrounding cloud and the risks of security,” says Ray Stanton, head of global business continuity at BT Global Services. He adds that this must be resolved if businesses are to take full advantage of the available benefits: “We have to demystify this.”

Securing the cloud

Many security experts agree that, while it always pays to be cautious, there is nothing inherently insecure about handing data to a third party via the web. Indeed, some argue that the large cloud computing providers are more likely to have developed dependable security procedures than their customers.

“The risk of data theft is fairly minimal,” says John Colley, EMEA director of security professionals association (ISC)2, who explains that it is in a vendor’s best interests to enforce data security. “In terms of protection, the cloud provider has more riding on its services not being compromised than any one individual customer has.”

Continued...