Mary - I have been surprised that some of the security concerns have not seen more innovation.  When enterprises' networks have no connectivity, security was easy.  But as Internet access grew security became an entreprise concern with most mid to large size enterprises doing at least annual penetration testing.  Essentially white hack testing that tries to find the security holes.

As enterprises have adopted more and more cloud based services, there has not been a growth in a way to actively test the security of these services. 

I've always viewed the cloud as an extension of the enterprise - not a replacement for and as such the same security testing you do internally needs to be considered for these cloud providers.

Freeze-dried beer and liquid steak? Man, you are making me hungry.

Indeed, these are the things low-carb dieters are seeking! =)

I'm also wondering what steps you would recommend to fixing the problem. Are standards to little, too late? Should early adoptors stop what they are doing until its better tested?

As for the issue of Standards, I'm SURE this is the way to go... but REAL STANDARDS not 'industry best practices' developed by the keepers of the keys, such as those the SNIA developed for storage or that the CSA is considering for cloud (storage), or even those the CCHIT is working on for healthcare information.

REAL Standards are those with an IEEE, ANSI, or ISO pedigree... developed in an open environment, consensus based, publicly reviewed, and able to be used and met by ANY and ALL interested parties, not just the select few that agree to "pay to play". 

This second step is a tough call, but I think it may be the best course of action. There are no SLAs in place yet that put the blame for data exposure or loss of access strictly on the service providers, which means the clients had better have a SERIOUS dose of 'caveat emptor' in their toolkit, and they better be willing to shoulder all of the costs related to the impacts of one/both of the aforementioned possibilities.

As I've said before, I feel the cloud is too ethereal still

Freeze-dried beer and liquid steak? Man, you are making me hungry.

That said, I admit that the industry is not there yet when it comes to fully realized cloud computing, but it seems to me that it took us awhile to adopt TCP-IP.

I'm also wondering what steps you would recommend to fixing the problem. Are standards to little, too late? Should early adoptors stop what they are doing until its better tested?

I'm not convinced of all the cloud hype either, but it does seem like a logical progression of networking. It's at least a great testing ground for the future data delivery and storage systems.

Whatever the industry, standards will have to exist before the full benefits of Cloud Computing will be realized.  There will need to be business process standards that encapsulate the various processes, message format standards that define minimum message content, and minimum service level standards that define performance requirements.  Just as a computer is constructed by combining the services of a hard drive, video card, cpu, etc. and connecting them all with a motherboard, IT services must be stitched together in order to meet the needs of an organization.  It is naïve to believe a bunch of individually developed services without a common vision will arbitrarily meet the business requirements.  Then again, it is said if you throw a million monkeys in a room with typewriters and let them bang away for a million years you will recreate all the great works.

Liquid steak might be easier to consume and digest, and MAY even taste similar, but it would take a HELLUVA marketing campaign to get folks to do more than just look at it though =)

Having drawn swords and done some intellectual sparring with the CSA folk, I can tell you they are all about the model but not about the detraction from it.  And no matter how many people openly shriek that the Emperor has no clothes, they continue to parade down the street.

Give some thought to a range of clients from any number of industries, regulated and not, private and public, small to medium (and larger) all placing their information assets into this 'cloud'.  Now, given the physical nature of storage devices (SAN, NAS, RAID, whatever) how do you develop a model that isolates everyones information from that of others... not virtually, but PHYSICALLY and ensures no data will be commingled in storage, in replicated sets, or in an offline backup?

And when any one (or more) of these clients get involved in some form of a lawsuit, and someone presents them with a discovery request to "produce all data related to..." and they have their meet and confer between parties and are rerquested to provide an ESI data map of their assets... how do they describe their 'cloud' stored assets and how they are managed?

Will the cloud providers be willing to come into these meetings and describe their structures and show how data is logically isolated and can be placed on a destruction moratorium to satisfy a legal hold?  How it will not be further manipulated once notice is given? What about any other data in those clouds that occupies adjacent sectors, blades, whatever?  And what about backups (possibly to off line tape repositories) that are sequentially generated to take advantage of real time capture and mix data belonging to multiple clients?

Next thought? Freeze dried beer.... it'll be easier to carry, you can just put it in your pocket, and it'll take a lot less room to store and also do away with that pesky refrigeration concern. =) 

Power outages, from natural causes (system overload, transmission line failures, power grid issues, etc.)  or disasters (earthquakes, floods, tornadoes, terrorist attack, etc) and the impact on clients being able to gain access to their information in the cloud.  What would be worse... an unintentional exposure of your information to others or a complete loss of access to it for some unspecified amount ot time?

And the natural disaster scenario also comes with snacks to go with that freeze dried beer... communications failures.   If by sattelite/tower/wireless, high winds or an earthquake can result in changes to the telemetry of physical devices involved in the transmission of signals, if by fiber optics or other cable services, earlier this year when someone sabotaged the fiber optics system in Silicon Valley it resulted in chaos for some financial clients and other high tech firms. Even 911 services were down.

I'm not saying never, or not in some cases, but the models have a long way to go before they are ready for prime time.  Still a pipe smoke dream to me, and I'm not too sure what's in that pipe right now...

Both of you have valid concerns about security. Like all networks, there is no 100% way to prevent breaches and there are still a lot of unknowns.

The recently formed Cloud Security Alliance (CSA) seems to be on the right track. The group has about 25 members and is working with SACA, OWASP and the Jericho Forum. Earlier this month they teamed with the established Distributed Management Task Force (DMTF) to come up with best practices. We'll hear a ton more about it at the Open Group Conference in Seattle in 2010, I'm sure. The recommendation now, however is to use the cloud at your own comfort level.

I've spoken with startups, mid-tier and enterprise architects who have a strategy for cloud use and are definately taking steps to ensure pandemonium does not negatively impact their business.

That said, whether IT is ready for it, this elephant is walking. I see companies already taking off their blindfolds and making sure they're not stepped on.

...if organizations will ACTUALLY be adopting or will simply continue considering the vaporous technology.

While wikipedia and other sources have posted their definitions of cloud storage, cloud computing, etc. it's still a lot like the "Blind Men and the Elephant" in the real world.

As Mary mentioned, security is a real concern, especially when it comes to a "public cloud" or a "quasi-public cloud", but there are even similar concerns in a "private cloud" when it comes to applying access controls to certain content.

Other issues starting to rise to the surface include how e-discovery is handled in a cloud, and the proper management of legacy data in a cloud environment.

As you said, CIOs are giving consideration to it, but this is only one leg of the stool when it comes to managing an organization's information assets.  The three primary legs are Records Management, Legal, and IT... and the fourth leg is the user community.  Services, Rules, Tools and Access are the respective roles these functions serve in.  Even Legal is starting to realize the need to form a team when establishing rules for managing information stored electronically.

The CIO is typically responsible for the IT function and services, but not for the information as an asset to the organization.  This is why I prefer to see organizational structures more appropriately have a CTO, which is a more accurate title when it comes to describing the role this individual serves.

Certainly next year will be decisive in terms of cloud adoption. But that depends on whether the year will also be a watershed for solving the security concerns many execs have had surrounding this technique.

Once enterprises start demonstrating en masse that the security profile is as solid for clouds, particularly hybrid clouds, as it is for internal networks, wider adoption will accelerate, IMHO.