Third-Party Clouds Can't Be Trusted, Users Say

Haha, well said, Chuckgregory! Your comment that no online solution can really be trusted was basically echoed in the message thread that inspired my blog. The truth seems to be that many IT folk don't fall for reassurances, but they are willing to take calculated risks, perhaps first with data that isn't completely mission critical or confidential.

I pretty well agree that third party clouds can't be trusted, but I plan to use them anyway. Why? Because I don't think there is any solotion that can be trusted. I don't think the public clouds are much, if any, worse than just about any other place we store private data. So, I say, do your best to protect it but don't ever think it is really secure. If random hackers, disgruntled insiders, or 'anonymous' don't get to it, the NSA probably will...

All true. But he still does not come out and say what he thinks about whether public clouds are or aren't sufficiently secure. Otherwise, why do we need standards? Do enterprise CIOs simply need them for reassurance?

I don't buy it.

I think the following statement sums up the arguement the writer;

"It is this mindset, in my opinion, that places so many large organizations at odds with public cloud. No matter which major form of public cloud you are considering, the internal cultures and processes of large organizations are poorly suited for extension into the cloud."

In essence the author is just alluding to the fact that even though some of the concerns about public clouds are legitimate, most of them are just the product of an organizational mindset of corporate IT that is at variance with the basic propositions of public clouds.  So in other words even if cloud providers can make public clouds as securely as is technologically possible,corporate IT distrusts with Third-Party Clouds won't go away anytime soon.

With all due respect, I can't figure out what the author is really saying. It seems he echoes what a lot of vendors and consultants say, to wit: "Public clouds ARE just as secure as anything else right now. Try it!"

Without SLAs and security standards nailed down, though, public cloud providers will be viewed by IT as giving empty promises.

Not sure I agree, Paul. Security risks are great on or off site, but if IT can see it and visit the equipment and software at will, it's likely to inspire a bit more confidence. Also, it doesn't help if public cloud providers aren't able to meet SLA requirements and/or supply guarantees about the level of security they provide.

Actually, I think enterprises have fears that don't result from security news stories, though they are strengthened by them. The truth is, IT doesn't like to cede control to any third party, since IT is always accountable and it's "safer" to be able to deal directly with the equipment and software that houses and handles one's data. Some in IT even feared virtualization because they couldn't associate it with a specific location in a system or server.

All that said, I think the situation is likely to improve as public cloud providers continue to prove themselves trustworthy, and IT gets used to the idea of working with them.

I came across this article that explains why the cultutal mindset of large organization will always distrust the cloud:

"Any finger-pointing, however, appears to be equally directed toward both legitimate potential risks and the very vendors that supply a large organization's IT needs. It is this mindset, in my opinion, that places so many large organizations at odds with public cloud. No matter which major form of public cloud you are considering, the internal cultures and processes of large organizations are poorly suited for extension into the cloud."

I think we are just trying to heap unrealistic expectations on Third-Part Cloud service Providers with this constant talk on security. The truth is that even private clouds are not as secure as we are made to believe. The basic axiom of these third-part cloud servivces is that the providers of these services are better equipped to secure our data than what we can individually do for our networks.

There is always an inherent risks associated with cloud services be it in-house or third-party. People who are still skepticalofthe viability of cloud computing are still holding to these parochial fears that public clouds are not to be trusted.