Cloud Computing Security: IT's Take on State of Play

CIO — I came across a very interesting cloud computing security study from the Ponemon Institute (sponsored by CA, but independently carried out by Ponemon). The study is based on a survey the Institute carried out, responded to by around 900 people.

The survey results are as one might expect: IT professionals trust the security of on-premise computing more than that of cloud computing providers. But buried within the detail of the survey are some pretty interesting stats, to which I will turn momentarily.

Regarding what the respondents considered the top security issues for cloud computing, here are the top five responses from the survey takers (NOTE: the ranking is based on the difference in the confidence that these issues are addressed in on-premise vs. cloud environments; the percentage listed is the difference between confidence that the area is being addressed well by on-premise vs. in the cloud):

• Ensure the physical location of data assets are in secure environments (33%)
• Restrict privileged user access to sensitive data (29%)
• Ensure compliance with all applicable privacy and data protection regulations and laws (13%)
• Ensure long-term viability and availability of IT resources (12%)
• Ensure recovery from significant IT failures (10%)

Traditional Security Problems Persist

What is really interesting about this list, to me, is the fact that the level of confidence in how well these areas are being addressed today in on-premise environments. For example, on the topic of ensuring that the physical location of data assets are in secure environments, the respondents only gave cloud providers a 33% positive ranking. However, and here is the kicker, the respondents only gave the on-premise alternative a 56% positive rating! In other words, nearly half the respondents believe that their own internal data centers do not do a good job of securing the physical environments of their data centers — not exactly a vote of confidence in current security procedures.

In fact, if one goes through the report comparisons of cloud versus on premise security, it's a strong indictment of the current state of security practices. For example, on the topic of "restricting privileged user access to sensitive data," only 29% of respondents believe that cloud computing providers do a good job; on the other hand, only 48% believe that their internal data center practices do a good job. Similar numbers are associated with other security-oriented topics like "ensure proper data segregation requirements are met" and "investigate inappropriate or illegal activity" — in fact, on the latter item there is only a 7% difference between on-premise and cloud.

Continue Reading