Cloud Users' Security Concerns

Storm clouds pouring rain and hail over a French canal.

A summary of the survey "Security of Cloud Computing Users"

CA Technologies funded a survey carried out by the Ponemon Institute in May 2010, "Security of Cloud Computing Users."

The survey was about cloud security, specifically asking security practitioners at organizations currently using or migrating applications to the cloud.

Please click here to download the full original report. This page is my summary of the main points I found interesting and my comments on some of the statistics. Reading this report could help you select the best cloud storage solution for your organization's needs.

They surveyed 642 and 283 cloud computing users in the U.S. and Europe, respectively, the result of a 5.9% response rate for 15,733 surveys sent. The survey asked about their perceptions regarding the security of cloud computing; how they are using the various cloud service models; their division of responsibility for information security; how security of the cloud compares to on-premises; what they see as their primary cloud security risks; and more.

Recall the cloud computing service models: SaaS, PaaS, and IaaS for Software, Platform, and Infrastructure as a Service.

The specific service model defines who has responsibility for the hardware and software at the cloud provider or service end; the customer is always responsible for everything at the client end.

Use Rates for SaaS, PaaS, and IaaS

I would guess that the high rates for SaaS are largely Google Apps, GMail, and Salesforce, and IaaS is largely Amazon AWS followed by Rackspace.

Percentages of business-critical applications or services run in SaaS, PaaS, and IaaS

These rates are approximately a third those of the simple use rates. So, about a third of those using cloud technology do so for business-critical purposes, about two-thirds of the cloud use is not business-critical.

Percentage believing that the cloud provider is most responsible for ensuring security

I do not understand this. In an IaaS model, the provider runs the facility, hardware, and virtualization as always. The provider gives the customer an operating system at deployment time, along with a VLAN and router  / firewall, but then everything else including OS maintenance is the responsibility of the customer.

With PaaS, the supplier also maintains the operating system and the programming environment.

The supplier's responsibility in SaaS is the same except with the addition of maintaining the application itself, everything at the cloud end.

The only correct answer that I can see is that the cloud provider is most responsible in SaaS. And, in IaaS, the least responsible. I would expect these numbers to be something more like 85%, 15%, 5%. I looked at the details in the second half of the report, and found that they agreed with the charts and graphs in the summary and discussion of the first half. Since they typically list the service models in the order PaaS, IaaS, SaaS, I wonder if there is some systematic misunderstanding in their survey.

Reason for migrating corporate IT to a cloud environment

This is much as I would expect: the main reasons are economic and there is little expectation of increasing security by a move to the cloud, despite the fact that in many ways the cloud can be more secure.

Percentage confidence level for 25 security features

This also makes sense: everyone realizes that nothing is perfect (or perfectly awful), but the cloud seems a little riskier. The biggest surprise to me is that there isn't a significantly larger difference between perceptions of on-premise and cloud security.

Technologies believed to be most important for securing a cloud environment

This is interesting to see, but I'm not sure what I would have expected here...

Differences in confidence levels for properly managing specific risks

The numbers have been rounded off, so the differences are not necessarily what you would expect.

It seems quite reasonable that the greatest diffence has to do with physical location. The surprising thing to me is that the confidence in on-premise location is so low!

As for restriction of privileged user access, I'm sure this is worry that someone on the provider staff will start snooping around. Here is where we can benefit from what I think of as "the anonymity of the crowd".

If your data is stored somewhere similar to Amazon AWS, buried among who knows how much data belonging to random other customers, residing at randomly deployed storage locations accessed by randomly deployed compute instances, I can't imagine someone stumbling across it. It seems like it would take a threat inside the provider staff modifying the deployment processes in advance to notice when your organization deployed instances and focus on those data sets.

Types of sensitive information too risky for the cloud

This varies significantly by location. For the U.S.:

• 68% financial information
• 68% intellectual property
• 55% health information
• 50% non-financial business confidential
• 43% credit card information

For Europe:

• 68% intellectual property
• 66% health information
• 65% employee records
• 55% financial information
• 50% non-financial business confidential

It appears to me that the concern in the U.S. is focused slightly more on protecting the business, while in Europe it's in protecting the individual.

An Overview of Cloud Security

Secure Distributed Logging with Syslog, TLS, and Amazon EC2 Cloud Servers

How To Set Up Encrypted Storage On Amazon EC2

Back to the Security Page

Home Unix/Linux Networking Cybersecurity Travel Technical Radio Site Map Contact

Tweet