cloud concerns

Gartner outlines 7 primary security concerns with Cloud Computing:

1. Privileged user access
2. Regulatory compliance
3. Data location
4. Data segregation
5. Recovery
6. Investigative support
7. Long-term viability

Important issues? Absolutely. Any different than concerns with current on-premise solutions? No.

A common objection to Cloud Computing solutions is, "we don't want to trust someone else with our data." I understand this concern, but the reality of the situation is that every firm is already doing this a thousand times per day.

For example, on-premise software - it's from a third party and you're trusting your data to it. Anyone paying any attention knows that these third party on-premise solutions fail all the time - storage fails, servers crash, security trimming fails, regulations are not followed, data location is not know (not that you even know what all data you have), data is not segregated enough or it's too segregated depending on whom in the org you're talking to, your DR plans vary by application (and day) and your teams' expertise, investigative support (really? Ask any vendor about this one, you're not getting anywhere), long-term viability - SANs, servers, laptops, apps, users, your boss, your job, your car, your marriage, your body - indeed.

While we've gotten pretty good at convincing ourselves we have real control over our data or at least have so much documentation and doublespeak available we know we're covered when something DOES happen, it's still just an illusion. We live in an increasingly connected society - we're only going to get more connected, not less. The corporate firewall has become as much a burden as a safeguard. Your banking institutions know everything about your firm; company sales orders are emailed across the globe, saved to millions of thumb drives, copied to desktops, opened on mobile devices, IM'ed, added to file shares, edited by partners, emailed to their distributors, etc. Employee SSN's and bank accounts are provided to payroll providers and other partners; a vast majority of employees have no idea how to safeguard their personal laptops, phones, or thumb drives - that is never going to change. Data just moves too fast between too many people who don't really care about you to truly be controlled.

So what? So the concerns with Cloud Computing are not unique to Cloud Computing but are the price of computing and networking regardless of the choice of architecture. The important distinction is not if these issues are important or not (they are) but in who makes the required on-going capital investment in seeing that these issues are continually addressed to the degree that is possible. On the one hand you have a global technology services delivery systems firm (a Cloud Vendor) and on the other you have a company that manufactures boxes, or brakes (or software products).

When I hear someone say they don't trust Cloud Computing all I can picture is some crazy old lady with a bunch of shoe boxes full of money buried in the backyard. Data is important, but not as important as money and we sure as heck aren't building banks onsite. Eventually the debate of "To Cloud or Not To Cloud" will seem as silly as Grandpa's cash hidden all over the house.

We live in a risky world, but the only thing a business will have more of when embracing Cloud Computing is money and that's all the justification that's required. Mr. Peter Drucker said it best, "Do what you do best and outsource the rest."