Is the Cloud Secure
Obviously, the answer is it depends … on your security needs … on what you are comparing it with … on which cloud offering you are looking at.
Therefore, instead of providing a one word “Yes” or “No” answer let me ask you a set of questions that will help you answer the question for yourself. These questions will help you in identifying, for your given context, if the cloud application that you are evaluating is more or less secure compared to status quo or the alternatives that you are considering. The important point is to decide what threats are more significant than others and what can become a show stopper. In short:
- What am I comparing?
- What threats are relevant and I need to consider seriously?
- Are there any show stoppers?
- Do I have the necessary facts?
- Is lack of knowledge clouding my perception?
Q1. What are you comparing it with…?
- …in-premise infrastructure
- …data centre owned and managed by you
- …data centre owned by you but managed by third party
- …data centre hosted on a third party infrastructure but managed by you
- …data centre hosted on a third party infrastructure but managed by somebody else
Q2. What cloud services are you looking at…? (Here is a detailed discussion)
- …virtual machine instances (IaaS) like Amazon AWS or Rackspace Cloud Servers
- …cloud platform (PaaS) like Google GAE or Microsoft Azure
- …hosted Email like Gmail
- …hosted CRM like Salesforce.com
- …hosted ERP like SAP Business By Design
- …office suit in the cloud like Google Apps
- …any other
Q3. Which of the generic security threats do you consider very important? Threats that…
- …attempt to steal sensitive information
- …comes from inside, from disgruntled employee
- …exploit existing software bugs and vulnerabilities with the intent of crashing a system
- …are intended to overwhelm critical system resources such as CPU and RAM
- …convert compromised computers into a network of bot-nets in order to mount additional attacks
Q4. Is there any cloud specific security threat that needs to be considered? Threats like…
- …software bug leading to accidental exposure of information to other parties sharing the resources
- …sensitive data retrieved and leaked out from released resources
- …insecure interface and API exposed by the cloud provider
- …losing control over their ability to ensure strong authentication at the user level
Q5. Do you need to comply with any government regulation like…?
- …Data location restriction
You can see from this Google Trends chart how cloud security concerns are growing.
Here are some relevant links:
- Top Threats to Cloud Computing V1.0
- Gartner: Seven cloud-computing security risks
- Cloud Security Threats and Countermeasures at a Glance