Security is major barrier to adoption of cloud computing.

Security is playing a key role in the willingness of organizations to adopt cloud computing solutions, according to  a study recently released by Launchpad Europe, a business accelerator outfit based in London.

The study based on a survey of 105 IT security experts across the globe found that more than 50 percent of them identified security concerns as the primary reason their organizations were shying away from embracing the cloud.

Asked what their highest priority was when considering a cloud services provider, 37.9 percent cited security of the cloud infrastructure. Another 12.6 percent identified security procedures to protect their data centers as their highest concern.

The data collected by the researchers also suggests there is considerable doubt about whether those security worries can be met by a cloud vendor. Some 49.5 percent of the respondents told the pollsters their companies neither use nor plan to use the cloud in the next 12 months.

Other significant items when choosing a cloud vendor cited by the survey respondents were due diligence and track record of service provider (18.4 percent) and ease of migrating data from vendor’s service to a new service.

Among the companies participating in the survey who do have cloud deployments, 16.5 percent said they used public deployments; 16.5 percent, private deployments; 10.7 percent, hybrid; and 6.8 percent managed.

Although most of the survey participants were from North America (39.1 percent), the United Kingdom (29.9 percent) and Mainland Europe (12.6 percent), there were also respondents from Australasia (6.9 percent), the Middle East (5.7 percent), Far East (4.6 percent) and South America (1.1 percent).

“While cloud computing remains high on the corporate agenda, organizations’ concerns about cloud security will not go away overnight,”  Launchpad Europe Technical Director Mike Burkitt said in a statement. “Before businesses will feel comfortable transitioning to cloud-based services, they first need to be convinced that the business benefits of the cloud outweigh the security risks–and that goes for both service providers and the cloud infrastructure itself.”

“For organizations with in-house technical capabilities and a good financial situation, the answer to their security fears may lay in the private cloud,” Burkitt added. “Developing your own cloud-based system gives you choice, power and flexibility.”

Similar findings were released last month in a report from the European Network and Information Security Agency.

Admittedly, the benefits of the cloud for businesses are compelling, the report noted. Content and services are available 24/7. Costs can be controlled by better management of capacity demands on the data center. Scalability is smoother. Internal IT resources can be unleashed to do more mission critical and strategic chores.

Those benefits are the reason that the cloud market is expected to become a $44.2 billion market by 2013, from its current level of $17.4 billion.

Nevertheless, as the ENISA report’s editor Giles Hogben points out:

“The picture we got back from the survey was clear. The business case for cloud computing is obvious–it’s computing on tap, available instantly, commitment-free and on-demand. But the number one issue holding many people back is security–how can I know if it’s safe to trust the cloud provider with my data and in some cases my entire business infrastructure?”

The reservations that organizations have with the cloud are similar to the ones they’ve had with outsourcing  any important business activity. You’re at the mercy of the vendor; if its servers go down, you go down with them. If you want to cut the cord with a vendor, migration of services and content could be a problem. Will failing to maintain certain data internally cross regulatory boundaries? Is your data being properly deleted by the vendor?

Before ascending to the cloud, the ENISA recommends that a careful analysis be done to determine the advantages of the cloud to your organization versus handling matters internally. When choosing a vendor, service levels need to be defined in the agreement with the provider, as well as a clear delineation of responsibilities for the vendor and your internal IT people.

The cloud need not be a security conundrum, maintains ENISA Executive Director Udo Helmbrecht.

“The scale and flexibility of cloud computing gives the providers a security edge,” he asserts. “For example, providers can instantly call on extra defensive resources like filtering and re-routing. They can also roll out new security patches more efficiently and keep more comprehensive evidence for diagnostics.”

Liked this post? Get more email management and administration related news from TheEmailAdmin.com!

Security tempers zeal for cloud computing

The increasing popularity of cloud-based solutions has resulted in many new offerings of cloud platforms as well as numerous as-a-service software solutions. We also have storage-as-a-service, to alleviate in-house storage demands; and even supercomputing-as-a-service. Are all of these cloud services robust enough for mainstream, daily use?

Computing is seldom a one-size-fits-all proposition, and what works for one company won’t work for another. The same is true with the cloud. What’s clear though, is that it is here to stay. There are two things that have led more companies to face the cloud question head-on: Available technology in the form of cloud services and solutions, and greater availability of cheap, high-speed connectivity; and simple economics. These two factors have converged nicely.

On the economic side, the struggling economy, and the need for more companies to maintain or improve the bottom line by cutting costs, has led to increased reliance on outsourcing. Cloud computing services can be seen as a type of outsourcing; for example, if you’re running anti-spam or another type of security, or all of your email for that matter, through a cloud-based service, then you’re no longer burdening your in-house staff with it (or if you have no in-house IT staff, your office manager, secretary, file clerk, or whoever else may have gotten tasked with it in the past). The administration, provisioning, installation, and maintenance of the physical infrastructure is handled by somebody else. Of course, none of this would even be possible were it not for ubiquitous broadband, which allows even the smallest businesses to connect to the Internet (and all of those cloud services) at incredibly high speeds and with increasing reliability.

The most obvious time when in-the-cloud security is appropriate, is when your company doesn’t have in-house security-specific expertise. Is security being tasked to an IT generalist, or worse, to a non-IT office manager? In the case of small companies, these tasks often get delegated to the office guy who “seems to know a lot about computers” rather than a real IT person, and the result is often disastrous. The advantage to cloud services in this case is that cloud providers tend to employ experts with relevant experience. Those experts can be expensive to hire on your own, but by using the cloud services, you benefit from their expertise without having to pay their full-time salaries.

If your company is considering cloud-based security services, or any cloud service for that matter, the first thing to consider is the reliability of the company. Cloud-based security services are best offered by a company that is well-versed and experienced in security, and has been in business for some time. Second, take a good look at the service level agreement and make sure it has very specific details about performance promises. And lastly, realize that cloud security, like any type of security, while it should be easy to use, is never meant to be a “deploy it and forget it” proposition. Make sure it has good reporting facilities and an intuitive management portal that still affords you some control over the security features.

Liked this post? Get more email management and administration related news from TheEmailAdmin.com!

When is in-the-cloud security appropriate?

Hosted email and hosted security services have gained attention recently, as the Software-as-a-Service model catches on. But is SaaS always the best option? Clearly, no. A recent Business Week article, entitled “Beware the Hype for Software as a Service“, dispels a few myths about this popular option–breaking open several common myths and explaining that SaaS is not always cheaper, it does not necessarily reduce hardware investment, it is not always quicker to set up, and data are not always secure and backed up.

When looking at managed security solutions, it appears that the cost is lower than in-house solutions, although this is not always the case–it seems lower, because the cost is spread out over the entire duration of use, as opposed to a single up-front license, but this won’t fool the CFO.

There is of course, a great temptation to see SaaS as a panacea, with its promoters arguing that it is by design both cheaper and easier to use. While in some cases this may be true, it’s by no means a slam dunk. In fact, the perception that it is an easy-to-use, turnkey solution can be dangerous, because in fact, it is not. Many services–in particular, security services–delivered as a hosted service do come with several configuration options, and managing that service still requires the customer to have hands-on involvement. There are also likely to be integration challenges to bring the solution in sync with the rest of the enterprise. Believing that this is not necessary for hosted security services is an open door to trouble.

Businesses are only just recently coming to accept Software-as-a-Service and other types of hosted services, and they are gaining ground rapidly—particularly as major players such as Microsoft and Google move into this market. The growth in hosted email solutions is part of the changing attitude about hosting in general and a greater interest in “cloud computing.” There have been some high-profile outages in recent months however, which may give one reason to have second thoughts about it and stick with the in-house solution. The Amazon S3 service went down for a total of eight hours—an outage that was totally unacceptable to anyone using the service. Outages have also happened with Google Apps and Gmail.

One must not get lulled into a false sense of security by assuming that the hosting organization will take care of all the security and archiving matters. Hosting companies will very likely have some sort of filtering mechanism, but is it adequate for your needs? Not always. In the world of security, two levels of protection are always better than one, and in-house filtering should also be applied.

For those who are required by policy or by law to archive emails, don’t count on the hosting provider to take care of this, either: Make sure that the hosting provider offers this service, or use an alternative archiving solution to do it in-house.

Liked this post? Get more email management and administration related news from TheEmailAdmin.com!

Hosted services don’t always fit the bill