Security in the Cloud Is All About Visibility and Control

CIO - It's an oft-repeated mantra: Organizations engaged in or investigating cloud computing in any of its many flavors are concerned about security. In fact, concerns about security, data privacy and data residency are often cited as inhibitors to cloud adoption. But are the concerns justified? Some security experts say visibility and control are the missing elements.

In a recent study of IT and business executives, CompTIA, the IT industry association, found that 50 percent of respondents cited greater reliance on Internet-based applications like cloud computing and software-as-a-service as a driving factor in their cyber security concerns. But a number of cloud experts say that in many ways data in the cloud is more secure than in an on-premise installation--or at least rapidly becoming that way--especially for smaller organizations that don't have the resources to dedicate to security technology and expert staff.

Security Staffing Issues?

Access to enough IT staff with security expertise may be particularly tricky for organizations of all sizes. CompTIA says 41 percent of organizations reported moderate or significant deficiencies in security expertise among IT staff. On average, CompTIA says organizations were about 30 percent short of their headcount devoted to security. According to the Bureau of Labor Statistics (BLS), which adds the category of Information Security Analyst in 2011, unemployment for people employed in the category stands at 0 percent.

Christopher Primault, co-founder and managing director of GetApp.com, a business software marketplace that vets cloud-based apps and organizes information about them for small businesses, says that cloud services help organizations get around this problem because they provide professionals dedicated to safeguarding your information.

"Your data is probably safer with the vast majority of vendors than if you keep it on your premises," Primault says. "I really believe it's true."

He adds, "We only use cloud services, so we were born in the cloud. The cost for me to keep data in-house and protect that data would be high. Frankly, by having my data in the cloud, I feel more secure."

Primault is not alone. According to CompTIA, 85 percent of organizations using cloud services are confident or very confident in their cloud service provider when it comes to security. But those same organizations are reluctant to put certain types of data or applications in the cloud.

"There is a slight paradox among users of the cloud right now," says Tim Herbert, research vice president with CompTIA. "They convey very strong confidence in cloud service provider security. At the same time, many companies are very reluctant to put certain types of data or applications into a cloud environment. Companies have moved some of the non-critical systems into the cloud, but they are not there yet in terms of moving their most critical systems to the cloud."