Menu
The dangers of cloud computing

The dangers of cloud computing

On-demand apps and services have several security risks that IT should address up front

A best practice guideline for cloud computing

Ultimately, the consumer of the services is responsible for maintaining the confidentiality, integrity, and availability of data, agrees Kristin Lovejoy, director of IBM's security, governance, and risk management division.

Lovejoy cites by way of example the fact that the HIPAA (US Health Insurance Portability and Accountability Act) makes no specific statements regarding outsourcing or offshoring. Instead, the act's sections 164.308 and 164.314 simply require that a company get assurance from any third parties handling its data that the data will be safeguarded, she notes.

As far as placing limitations on when to deploy the cloud, Lovejoy advises that companies adhere to Geoffrey Moore's consideration of "context versus core." (Moore is a business strategist and managing partner of TCG Advisors.)

Core business practices provide competitive differentiation. Context practices deliver business activities that are typically internal, such as HR services and payroll. Both core and context can be divided into mission-critical applications and non-mission-critical ones. "If a non-mission-critical application goes offline, the company can survive," Lovejoy says.

The rule of thumb Moore comes up with, notes Lovejoy, is this: If the business practice is context and non-mission-critical, then always put it in the cloud. If it is context and mission-critical, it is likely you should make it cloud-enabled. However, if it is core and non-mission-critical, you may want to think about keeping it behind the firewall; if it is core and mission-critical, then definitely keep it behind the firewall, she says.

Good security takes time

The cloud approach doesn't map naturally to how good security is typically designed, says John Pescatore, Gartner's chief security analyst and a man whose resume reads like it came from a James Bond movie, including a stint with the FBI, the National Security Agency, and the Secret Service.

The area that worries Pescatore most is how quickly cloud-based services are updated and changed. He cites Microsoft's painstaking development of the SDLC (Software Development Life Cycle) initiative that assumes mission-critical software will have a three- to five-year period in which it will not substantially change.

"In the cloud, every two weeks we add a new feature, changing the app all the time. But the secure SDLC is not built to do that. We are going back to the old Netscape days of pushing out new features real quick, and nobody has a security cycle that moves that fast," Pescatore says.

What makes matters even worse is that the business user can't say he wants to stay on the old version. "In the cloud you have to accept the next version, possibly nullifying any security that was built into the old application or assumed through integration at the customer site.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Malwarebytes shoots the breeze with channel, prospects

Malwarebytes shoots the breeze with channel, prospects

A Kumeu, Auckland, winery was the venue for a Malwarebytes event for partner and prospect MSPs - with some straight shooting on the side. The half-day getaway, which featured an archery competition, lunch and wine-tasting aimed at bringing Malwarebytes' local New Zealand and top and prospective MSP partners together to celebrate recent local successes, and discuss the current state of malware in New Zealand. This was also a unique opportunity for local MSPs to learn about how they can get the most out of Malwarebytes' MSP program and offering, as more Kiwi businesses are targeted by malware.

Malwarebytes shoots the breeze with channel, prospects
EDGE 2019: Channel forges new partnerships during evening networking

EDGE 2019: Channel forges new partnerships during evening networking

Partners, vendors and distributors reconnected during a number of social gatherings during EDGE 2019. The first evening saw the channel congregate for a welcome party at the Hamilton Island yacht club, while the main poolside proved to be the perfect stop for a barbecue on the final night.

EDGE 2019: Channel forges new partnerships during evening networking
Show Comments