Cloud security from a user’s point of view

As more and more of us begin to rely on cloud services, security is definitely one of the topmost concerns on our mind. From the user’s perspective, whether it’s an individual or an organization, cloud security translates to protecting the information that you’re storing on the cloud. You want the information to be available when you want it, and not be shared with anyone that you don’t want to share with, and make sure that nobody changes that inform ation without your permission or knowledge.

When you use cloud services the cloud provider has a lot of responsibilities for security, but you also share the responsibility of making sure that your login information is secure and you use any security features that are available to you. For example, if the cloud provider offers 2-step verification, as Google does, then you must make sure that you turn on this extra security feature.

As a user, you know that the same cloud services are used by many other users, so you definitely want your cloud service to offer good walls between you and your neighbors so that information cannot maliciously or inadvertently be shared with your neighbors. You’d also want the cloud provider to back up your information and protect it from loss due to technical or natural disasters.

In a nutshell, cloud security is a shared responsibility, where you take care of using all the security features available to you for the login process and the provider carries a much larger burden of protecting your information from other users as well as from outsiders. in particular you’d expect the cloud provider to employ the best security personnel available, follow the latest security procedures,  and adopt the latest technology to keep users separate from each other and to keep any outside attackers away from your information. From my perspective, I think this is what users expect from cloud security.

Here's some more information to help you...

For my earlier videos on cloud security, please see:

Cloud computing from a user’s point of view

Why public cloud

What are some of the risks of Cloud Computing

Why you should consider cloud computing as an opti...

What is Cloud Computing

Why public cloud

In previous videos I discussed what is cloud computing, why it’s important to consider as an option, and what are some of the risks.

Because of the risks, especially those relating to security and loss of control over where data resides, your organization may prefer the private cloud option, which, as I have said previously, is still a good option that provides you with the benefits of reduced number of physical machines along with lower electricity and cooling needs, as well as needing fewer staff to administer the machines.

However, unless your organization has hundreds of thousands of employees, a private cloud is not going to give you the cost savings that come from the economies of scale that public clouds enjoy.

To implement the private cloud, you’ll need upfront investment to virtualize your servers and add the software needed to operate it as a cloud. You are not going to just pay for what computing resources you need - - you basically still have to maintain the systems you need for your worst-case computing load.

Some go as far as to say that a private cloud is not a cloud at all because a cloud should have “elasticity” - - meaning you can create new virtual machines on demand and shut them down when you don’t need them. A private cloud cannot easily provide this elasticity, unless it’s for a huge number of employees.

With a public cloud, you can truly pay for computing as you go - - just buy what you need, when you need it. That’s why, unless you have hundreds of thousands of employees or information that’s very sensitive (like military information), you have to consider public clouds to get the benefits of cloud computing. If that’s not acceptable, you can consider a community cloud suitable for your organization. For example, government agencies could opt for a government community cloud where you could at least get some economies of scale.

Here's some more information to help you

Please see my previous blog posts on what is cloud computing, why you should consider it, and some risks of cloud computing.

Here are some books on cloud computing that you may consider:

Tags: cloud+computing, virtualization, public+cloud, private+cloud 

What are some of the risks of Cloud Computing

In other videos I explained what cloud computing is and why it’s useful. In this video, I want to mention some of the risks of cloud computing - - things that could potentially go wrong and affect your organization when you use cloud computing. Of course, if you implement a cloud in your own data center for your organization’s use, then the risks are similar to ones you already have - - security, privacy, disaster recovery, etc.

However, if you are planning to use cloud services provided by a third party, then you need to think of any new risks that may apply to your situation and that’s what I’ll cover.

First, the obvious risks - - security and privacy risks because of not knowing whether the vendor’s cloud is secure, that the staff who manages the facilities are trustworthy, that privacy protections are up to the level required by law.

Second, we have some management and oversight risks - - relating to potential lack of control in figuring out where data is stored and processed and how to get it back, if you change provider. The oversight risk is the possibility that your auditor cannot get access to the cloud provider’s systems to check them out.

Third, there are some technical risks, relating to lack of standard definitions of what a cloud service is, how are fees set, how to move data from one cloud to another, whether you can get reliable performance...

And, finally, a fourth set of risks may be relating to potential foreign laws and regulations that apply to your data because of where the cloud service is located.

Anyway, this is not an exhaustive list, but the point is that you should think what risks apply to you and then manage them, as is the prudent thing to do. Some risks already have mitigation approaches such as putting things in the contract and some have ongoing activities to help business mitigate those risks.

And, even if there is no mitigation for some, you may still decide to accept the risks and forge ahead with cloud computing. After all, that’s how we get the good things in life... by taking risks.

Here are some more things to help you...

Please see my previous post on "What is Cloud Computing" - - there I have a slide presentation on cloud computing that I used when I gave a talk in Seoul, Korea in Nov 2010 and the 30-minute video of the talk as well.

You may also want to read my post on "Why you should consider Cloud Computing as an option"


Tags: cloud+computing, virtualization, public+cloud, private+cloud