How Safe is Cloud Computing?

Everyone's talking about cloud computing. Some proponents even claim cloud computing will eventually take over the IT world and consolidate most technology departments under a few remaining CIOs who will be left to run the cloud. National Public Radio even proclaimed we may soon think about this new "utility computing" in the same way we think about using electricity - with all the information we need made available to businesses, homes and mobile workers by simply plugging into the cloud.

Meanwhile, skeptics point to a host of problems, including security. How can we trust the cloud, Net or whatever "it" is if we can't know where our data resides? Even if the bandwidth is available and the total cost of ownership is appealing, who will be in control? Isn't this a recipe for more breaches? What about legal compliance?

Both sides have good arguments. My initial take: Anything with the power of Google behind it had better be taken seriously. Even Microsoft's getting onboard, albeit somewhat reluctantly. But don't go look for another job just yet.

There are so many different definitions of cloud computing that answering today's questions can be difficult. No doubt, the potential benefits are immense - if not somewhat hard to believe. The promises of eliminating the pain of an operating system, automatic integration between services, instant 24/7 access, scalability on demand, total redundancy and no more worry about application development are certainly desirable.

While it's easy for technology professionals to mock such claims, be careful. There are real benefits and new opportunities that likely will make skeptics eat some crow over the next few years. Many U.S. organizations already outsource functions domestically or overseas, and many of those services are secure and working well. There's little doubt that more functionality will be delivered to us over the Internet, but here's the real question: How far will this pendulum swing back toward the centralized mainframe days versus staying local?

I was surprised by a recent presentation at ITEC Detroit that demonstrated a complete "virtualized Web desktop" available right now over the Internet using Web 2.0 technology built on Ajax (asynchronous JavaScript and XML). This vendor boasted that all desktop functions, which were running on faraway servers, were easy to manage from one administrative console. All that was needed for an end-user device was a browser.

The security advantages to this approach are vast. They include a single logon for Web, Windows and hosted applications. This company also claimed "better application access control by user, group, organizational role, time, date, IP address, subnet browser or operating system."

This model seems appealing because of the threats hitting laptops currently that also will soon be infecting powerful cell phones (that are actually multifunction minicomputers). If we move security threats to centralized servers and secure them well, we can improve the situation by reducing risk on access devices. With an exploding number of mobile devices now showing up, support costs could be reduced.

So what am I advising?
No. 1: Educate your team about cloud computing. Don't just ignore this topic as hype - the future is in this direction. Go to Cloud Security and other reputable online resources to learn more about cloud computing security implications.

No. 2: For now, the cloud consists of your outsourced vendor relationships. The required security and trust comes in terms of good contract language, the payment card industry and the National Institute of Standards and Technology 800-53-compliant solutions, and ensuring data privacy. You can do this by always knowing where your data is, encrypting when needed, knowing who has access and who doesn't, and ensuring good management of your outsourced vendors - which isn't easy.

No. 3: Try new technologies but be careful with new startups and know who you're really dealing with "in the cloud." Get compliance guarantees with your data - even on short-term pilots.

In conclusion, one IT analyst from Data Monitor said, "Cloud computing is a way of delivering services independent of applications - and I hope it works."