“If you don’t know the classification or sensitivity of information, how do you judge what goes in the cloud and what doesn’t? How does the cloud service provider back up and destroy the information? Is there proof that everything they do happens?” Davis said.

While the issue at hand seems to be that most people disagree with the assumption that cloud services are another form of outsourcing – like David Lacey, who also attended (ISC)2, disagrees in his own IT Security blog – there is another aspect of assumptions and fear-mongering happening here. While I would agree with the caution that Davis is strongly suggesting the enterprise exercise, it seems more users would benefit from being educated on the ways to avoid his seven deadly sins rather than having a finger wagged at them. Mike Vizard blogged about one motivation for raising security concerns related to the cloud:

In face, most of what gets ascribed to security in the cloud are really data management and compliance issues, or simply deliberate attempts to create concern over security as part of an effort to protect jobs that might be threatened by cloud computing.

Is that a fair assessment? Is there simply a lack of understanding surrounding the technology that has spun off into a misunderstanding of security surrounding that technology? How do you respond when you hear negativity toward cloud security: Do you run away or desire to learn more about how to avoid common pitfalls?

Let us know in the comments section or send me an email at Melanie@ITKnowledgeExchange.com.

Melanie Yarbrough is the assistant community editor at ITKnowledgeExchange.com. Follow her on Twitter or send her an email at Melanie@ITKnowledgeExchange.com.

James Urquhart, Market Strategist for Cloud Computing and Data Center Virtualization at Cisco, was recently traveling in Australia. What struck him the most, he said, was how they were equating cloud computing with outsourcing. “They’re not the same thing,” he assured me. “Though they do have a loose relationship with one another. They have the same concerns: service levels, security, liability, legal concerns and all that. They’re still there.”

So, what can cloud computing offer the enterprise?

There are the obvious financial appeals, or what Urquhart referred to as the ability squeeze costs. But that just gets the customer on the lot, the “extreme agility” that cloud computing offers is the great gas mileage. Citing one of his favorite quotes from a CIO, “We came for the cost savings, but stayed for the agility.” Urquhart stressed that CIOs aren’t just looking for a way to cut costs, they’re interested in innovation.

The concerns surrounding traditional IT are interwoven. Complaints that IT has become a “cost center” is partly attributed to IT becoming a buy-over-build arena where “80 percent to 90 percent of IT and telecom budgets are spent with outside vendors.” Innovation in the traditional IT model is too risky, too costly.

Urquhart puts it this way: In the traditional IT model, a lot of new projects get the boot because of the risk factors. The traditional IT cash flow model has changed, thanks in large part to SaaS and the cloud. Whereas before there was a big spend and outpouring of budget followed by an effort to minimize depreciation, the cloud offers a pay-as-you-use model that’s more appealing. IT budgets can be spread out, allowing CIOs to dip their toes experimentally without fear of losing millions of dollars.

The pressure to “plan for success” has been loosened a bit; the cloud has created some wiggle room for trial and error, where innovation and exploration are feasible possibilities rather than pipe dream luxuries. In the end, companies are willing to pay more for the cloud and agility, said Urquhart. Though altogether the bill may add up to more, the appeal of spending more slowly and with an elastic commitment often wins out.

The appeal or the downfall of cloud?

Is this noncommittal, curious attitude toward cloud risky in itself? Are CIOs really willing to give up the option of customization? Cloud may force enterprise introspection, picking out which applications are unnecessarily customized at what cost, and stripping down to the bare bones. If a standard offering were available, enterprises could get what they needed without the temptation of over-customization and over-allocating their budget.

What’s next for IT professionals?

When asked about how IT professionals should approach the changing market, Urquhart was optimistic. IT has long been viewed as a drag rather than an innovation center, he said, so maybe these changes and “threats” to traditional IT are a chance to reinvent your career and career path along with the whole infrastructure.

“The nature of operations is changing,” says Urquhart. “We’re transitioning from server-centered operations to more application-centered.” Whereas previously you’d buy a server, install an OS, give it an IP address, then install the application, these days your deployment is the application, he said. This creates an opportunity for new cocktails of skills to remain competitive in the changing market. The old: Network/storage skills. The new: Service-level skills based around applications, middleware, and the data center. He stressed the importance of beginning to “understand what it means to manage from the perspective of the application,” focusing your skills and knowledge on the application rather than everything else.

Melanie Yarbrough is the assistant community editor at ITKnowledgeExchange.com. Follow her on Twitter or send her an email at Melanie@ITKnowledgeExchange.com.

If you opt for a fixed-pricing model, ask whether maintenance contracts and warranties are included, as well as management of contracts and interactions with equipment suppliers. Check that your pricing is transparent and watch out for any hidden extras.

Go for a one-stop shop that offers hardware, software, networking and support. This will avoid the need for multiple suppliers and finger pointing.

Go for a medium-sized supplier that offers breadth and depth of skills.

The rest of his Q&A, with some other great tips, is up at SearchVirtualDataCentre.co.uk, and is likely worth a look even if you’re not specializing in virtualization.

I’d love to hear your thoughts: When choosing a partner for a large project, what are the qualities you value most? Do you get the best luck with personal recommendations, or just trust your own instinct? Let me know if you have any advice to share at Michael@ITKnowledgeExchange.com, on Twitter at @Morisy or @ITKE, or right in the comments. If requested, I’m happy to keep your information private.