Published:
June 25 2010, 05:34 AM
|
2 Comment(s)
by
Shirief Nosseir
There are many analogies that can be used to highlight the effects of cloud computing, but on a lighter note, any followers of Star Trek would be aware of the Borg. The Borg represents a major threat to the Federation. They are a race of cybernetic humanoids, organized as an interconnected collective (somehow just like a cloud!). The Borg used a phrase that became quite popular -- actually considered one of the 100 Greatest TV Catchphrases:
"Strength is irrelevant. Resistance is futile. Your culture will adapt to service ours."
Today, businesses that are considering cloud computing can say the same thing about security:
"Security is irrelevant. Resistance is futile. Your culture will adapt to service ours."
Cloud computing offers a compelling business case, whether for enterprises or IT vendors alike. And I don't want to add more fuel to the cloud hype, but the irresistible value proposition here is not just about improving costs and quality of service. More importantly I think, it's about the orders of magnitude in agility to deliver and consume IT services in support of evolving business environments. Enterprises are able to change more rapidly, while being truly enabled by IT, to capture business opportunities and avoid risks. And it becomes a lot easier and quicker for vendors to deliver new innovative and competitive IT solutions that meet market needs. In today's constantly changing and ever competitive economy, the words of Charles Darwin are more relevant to businesses than ever: "It is not the strongest of the species that survive, nor the most intelligent, but the one most responsive to change."
The point I'm trying to get to here is that business executives will often not stop from consuming cloud services that they need, just because these services were not vetted enough for security - A statement that should raise few eye brows from risk, security and compliance professionals. However, this is a trend that many of us already see happening in organizations. For instance, CA Technologies recently announced the results of a cloud security survey that it sponsored and was conducted by the Ponemon Institute. Over 900 IT practitioners, who are already cloud computing users, from large enterprises in Europe and USA were interviewed. Some of the key findings show:
- 49% of respondents said their organization uses cloud computing applications without thoroughly vetting them for security risks.
- Also, 68% of respondents said that their security leaders are not the most responsible for securing the cloud computing resources in their organisations
Business supporters of cloud computing often highlight business's ability to buy IT services themselves, bypassing their IT organization altogether. IT organization that will resist the move to the cloud will ultimately be made irrelevant. Resistance is not an option.
In security, we are often the people who historically have been saying no to things. We are the people that are seen as being a bit of a break on the system. Where as in fact in this case, there's an opportunity for us to be a real differentiator and enabler of the business. We can educate the stakeholders on the value we can add, we can show that the risk can be managed, we can implement policies and controls that secure the cloud as part of our overall enterprise architecture and not as a silo, and we can make sure that all the organization's critical assets are controlled and protected (It's much easier said than done I know... but maybe the ‘how' is a topic for another post... or feel free to leave comments to start a discussion).
You can download a copy of the Ponemon Institute study entitled "Security of Cloud Computing Users." If you're interested in cloud security (if you're still reading this post then I assume you are!), it's surely worth a browse.