Cloud Security

Cloud computing appeals to startups, even well funded ones such as Recurrent, for a list of reasons: They don’t have legacy, on-premises applications; they would rather not invest capital in equipment; and they don’t have the economies of scale that larger companies can get from running their own data centers.

Cloud computing’s been a tougher sell for large enterprises – though that attitude is changing fast, as the recession is making some of the downsides of cloud computing seem more palatable. Cloud operating standards will help ease concerns as well, since they allow for more predictable integration, more auditable security processes, and more confidence that companies could move their data elsewhere if a cloud contract goes south. Work on such standards, however, is just beginning. (See next page: Cloud Standards Are a Work in Progress.)

In terms of security, large enterprises are generally more comfortable with their own security personnel and policies than they are handing data to a service provider. Rackspace’s Otto likens it to a time when “individuals felt more comfortable putting their money under the pillow than handing it over to a bank.”

Gartner’s Nicolett predicts that companies in industries such as healthcare and pharmaceuticals, which tend to handle a lot of personal information, will be slow to adopt cloud computing. Yet even there, companies are breaking the mold. Eli Lilly is an early adopter of Amazon Web Services LLC ’s cloud services for pharma research. IBM Corp. (NYSE: IBM) offers on-demand, high-performance computing aimed at industries such as aerospace, automotive, and life sciences.

Some share the view of Aon Consulting’s Patel, who keeps records related to its client work and employees on site, not in the cloud. “We are not yet convinced that the service providers’ procedures for dealing with items, such as disposing of outdated customer information, are as robust as they need to be,” Patel says.

Vendors acknowledge the fear. “A lack of trust about cloud service security is evident in some large companies,” says Otto. Paul Simmonds, an IT pro who’s a member of the Jericho Forum , a group led by IT security professionals that’s working on cloud security standards, says it will be two to three years before cloud services are “robust enough” that large companies will consider using them on a widespread basis.

They’re already on their way. Over one quarter of companies are using or planning to use cloud services, and another quarter are considering them, according to the InformationWeek Analytics survey:

That means IT and business leaders are gaining experience with cloud models and learning where the real security risks lie. Cloud vendors, meanwhile, are developing best practices and standards for security and interoperability. Security fears are the biggest drag on cloud computing today, but the benefits look big enough to outweigh the concerns.

Next Page: Cloud Standards Are a Work in Progress