Are Cloud Security Concerns Overplayed?

Ron Miller — Wed, 14 Sep 2011 15:34:51 +0000

For as long as I’ve been hearing the term “Cloud Computing” the biggest concern has always been security, especially if you are handing the keys to the kingdom over to an external vendor, but I’m wondering if these concerns are overplayed to a large extent — and so is former US CIO Vivek Kundra.

The story goes if you want to secure your content, you need to keep it inside the confines of your firewall because anything less is exposing your precious data to outside forces. Now I don’t mean to minimize these concerns because certainly some companies, regulated industries in particular, have to keep these concerns top of mind, but are security concerns really valid?

It’s a question Kundra asked recently during an exchange with Salesforce.com CEO Marc Benioff at Dreamforce 11, Salesforce.com’s huge user conference. According to a report on CIO.com, Kundra, who has been a big advocate for cloud solutions in the government, belittled the idea that security was a reason to stay away from the cloud.

In fact, he sees the security argument as a red herring:

In other areas, what you get is a false choice; people erect these barriers around security and privacy, which in some ways are very unfounded. And the reason I think they’re unfounded and ridiculous in a lot of ways is because the United States government already has outsourced over 4700 systems.

And it’s a valid point. He goes onto suggest that these systems are often built by highly paid systems integrators — some of whom might have a lot at stake to spread FUD (fear, uncertainty and doubt) about cloud computing.

Yet how many private companies outsource many of their own services? How many companies for instance do their own payroll anymore? Even very small companies tend to outsource this kind of activity because it’s easier to have someone else do it. Yet that means these payroll companies have access to your employee’s names, addresses, salaries, social security numbers and a lot of other highly confidential information outside your firewall.

And yet we rarely if ever hear anyone getting up and claiming its crazy to outsource your payroll data because you could be compromising your employee’s privacy and crucial company information.

Heck, what better example of cloud computing is there than Salesforce.com. When it launched in the late 90s, did you think it would be common place a decade later to store your most important customer information on another company’s servers? Now thousands of companies, big and small, do just that.

My favorite cloud security story comes from the MIT CIO Conference in 2009. As I explained in a post on DaniWeb at the time, Rear Admiral Elizabeth Hight, vice director of the Defense Information Systems Agency fully embraced the cloud, and in fact described the first private cloud I had ever of at the time, used by military personnel in the field to access services they needed quickly and relinquish them when no longer needed.

What was interesting though was not just that the military was on the cutting edge of cloud computing, but that a drug company executive on the same panel complained the cloud wasn’t secure enough for her. As I wrote:

Panel moderator, Erick Brynjolfsson of the MIT Center for Digital Business did not miss the irony that the military, which requires perhaps the most secure network in the world was not afraid to engage in cloud computing, but the private sector company CIO claimed she was handcuffed by regulations around security.

The point being that 2 years later, we’ve come a long way, and cloud computing has matured remarkably quickly. Yet we are still being subjected to what Kundra sees as misleading arguments about security, and he may be right that it’s time to move on.

Dreamforce reinforces cloud vision

Ron Miller — Mon, 06 Dec 2010 11:39:16 +0000

It seems appropriate that I’m launching this blog the same week as Salesforce.com is holding its annual Dreamforce conference because Salesforce was the first company to truly bring an enterprise application into the cloud (even though nobody really called it cloud back then).

Word has it that billionaire businessman Marc Benioff was a starving entrepreneur in 1999 when he came up with the idea for Salesforce.com in a rented apartment in San Francisco. At the time, if you asked most IT professionals if they would be willing to put all of the details of their company’s customer data on somebody else’s servers they would have looked at you like you were daft.

Sure, maybe it was possible such an idea could work for small businesses who don’t have to deal with the sensitive security matters of a larger enterprise, but the big boys would never go for it.

Yet Salesforce.com grew into a billion dollar business, and not just with those small businesses, but with plenty of big ones too. Turns out the idea of putting a service up on a web site and charging far less than the comparable installed software made a lot of sense for a lot of companies.

In the introduction to Benioff’s book, Behind the Cloud, Dell CEO and chairman Michael Dell writes that much like how his company, Dell Computers, had done with PCs, Salesforce rooted out the inefficiencies inherent in traditional enterprise software design. As Dell wrote:

“Enterprise software was exorbitantly expensive and onerous to implement, and, in the end, it didn’t work very well.”

When you add to that the ridiculously long upgrade cycles that took up to several years, and that when you did upgrade, it tended to break what you had in place, you might be wondering why IT wasn’t looking for a better way.

Once Salesforce proved the model could work without the sky falling (if you’ll pardon the expression), other IT pros had to at least take notice (or at least you would think they would). And if you could put your customer data in the cloud, why not other sensitive data?

Yet even today in 2010, more than 10 years after Benioff launched Salesforce.com, we have lots of push-back about cloud computing. There are of course some legitimate concerns around governance, data ownership and security, and I don’t mean to minimize them, but the fact is that there are many rock-solid cloud businesses out there today managing lots of data beyond just customer information including files, content, project data, and more.

It’s surely not a perfect solution (but show me one that is), but if offers regular upgrades (sometimes weekly or monthly) behind the scenes for free without breaking what’s in place (most of the time). That alone in my view makes cloud computing worth considering.

You still have a neck to throttle as the folks in IT are fond of saying because if that service goes down or has a security breach, the whole model is at risk. Salesforce and Google and Box.net and so many others understand that better than anyone.

Whatever your feelings about cloud computing or Salesforce.com at this moment in time, you have to admit that it pioneered the idea of storing enterprise data outside the firewall, and what was once considered a radical notion is a mainstream concept today.

View From Above » Marc Benioff

Are Cloud Security Concerns Overplayed?

Dreamforce reinforces cloud vision