|
Videos
March 24, 2010 By Dan Lohrmann
I recently received an e-mail advertising an upcoming online seminar. The intriguing title was Cloud Computing -- Faster, Better, Cheaper, Greener and More Secure. I paused, reread the session description and thought, "Oh, dear." If this premise is true, let's just move everything onto the cloud right now. We can save beaucoup bucks in government and sleep better at night at the same time. But while I can buy the first four outcomes, I'm not buying the last -- that it's more secure -- at least not yet. Here's why.
First, I want to offer the obligatory praise for cloud computing in general and the undeniable efficiencies available to state and local governments in particular. Yes, Michigan -- the government I work for -- has an exciting cloud strategy, like many other states. In fact, most technology vendors I know have one or more game-changing cloud offerings.
But this is about cloud security and specifically whether cloud computing is more secure than whatever your government is doing now. If you currently have weak security controls, you may be tempted to hand over your sensitive data to a cloud provider -- but read on before you do.
Proponents argue that the "big boys" like Microsoft and Google can secure systems better than most companies or government employees. At a recent panel discussion in Grand Rapids on this topic, I was challenged by other panelists with one-liners like: "Do you really think your security team is better than Google's?"
"Perhaps not. But that's not my point."
So what are a few of the most pressing cloud security problems?
I could go on, but you get the picture. The more you specify unique security requirements, the harder it becomes to obtain the benefits of cloud computing. I do believe that new offerings will emerge in the coming years to address the essential requirements that most governments must address. However, I think we're a few years away from those opportunities becoming reality.
So what's a government technology leader to do in the meantime? First, you can start piloting the technology and create an internal government cloud. This will allow new flexibility to provision the infrastructure and software you need while maintaining more control over sensitive data within your environment.
Second, utilize cloud computing for publicly available data that's already accessible via the Freedom of Information Act. Large amounts of our government information can be placed in the cloud without risking breaches or many of the other issues identified.
Third, start talking with your vendor partners about new ways to secure your data in the cloud. There are many innovative technologies that are coming soon. I believe that the opportunities are huge over the next decade, and we need to build legal compliance into our plans.
Finally read about Google's recent experiences in China, which showcase some of the challenges that everyone faces as cloud computing progresses. Meanwhile, for the time being, our government technology future looks partly cloudy.
You may use or reference this story with attribution and a link to
http://www.govtech.com/pcio/Is-Cloud-Computing-More-Secure-Opinion.html
Collaborative Justice: Transforming Criminal Justice Services Through Unified Collaboration
Cloud-Based Services Accelerate Public Sector Adoption of Video Collaboration
Hi Dan, thanks for an interesting governmental viewpoint on cloud security concerns-- whereas I am sympathetic with James Hamilton's blog "Private Clouds are not the future" (http://perspectives.mvdirona.com/2010/01/17/PrivateCloudsAreNotTheFuture.aspx) for many corporations due to economies of scale, governmental (and regulated) entities must also consider the costs associated with risk reduction (e.g. your points regarding having an understanding of how/where data is stored and protected). In such a case, a private cloud may be more than just the starting point you have indicated-- a "conglomerated municipalities cloud" could address many of your concerns (esp. regarding transparency in operations) and possibly be a cost-effective substitute for public clouds if the "value of knowledge/risk-reduction" is included in the calculus. That said, municipalities and regulated entities have a lot to gain by participating the the public cloud economies of scale-- looking at the membership roster of cloudsecurityalliance.org indicates clearly-described security goals have market interest. Now, about reducing the attack surface of the underlying cloud architectures.... -E
Hi Dan, thanks for an interesting governmental viewpoint on cloud security concerns-- whereas I am sympathetic with James Hamilton's blog "Private Clouds are not the future" (http://perspectives.mvdirona.com/2010/01/17/PrivateCloudsAreNotTheFuture.aspx) for many corporations due to economies of scale, governmental (and regulated) entities must also consider the costs associated with risk reduction (e.g. your points regarding having an understanding of how/where data is stored and protected). In such a case, a private cloud may be more than just the starting point you have indicated-- a "conglomerated municipalities cloud" could address many of your concerns (esp. regarding transparency in operations) and possibly be a cost-effective substitute for public clouds if the "value of knowledge/risk-reduction" is included in the calculus. That said, municipalities and regulated entities have a lot to gain by participating the the public cloud economies of scale-- looking at the membership roster of cloudsecurityalliance.org indicates clearly-described security goals have market interest. Now, about reducing the attack surface of the underlying cloud architectures.... -E
Hi Dan, thanks for an interesting governmental viewpoint on cloud security concerns-- whereas I am sympathetic with James Hamilton's blog "Private Clouds are not the future" (http://perspectives.mvdirona.com/2010/01/17/PrivateCloudsAreNotTheFuture.aspx) for many corporations due to economies of scale, governmental (and regulated) entities must also consider the costs associated with risk reduction (e.g. your points regarding having an understanding of how/where data is stored and protected). In such a case, a private cloud may be more than just the starting point you have indicated-- a "conglomerated municipalities cloud" could address many of your concerns (esp. regarding transparency in operations) and possibly be a cost-effective substitute for public clouds if the "value of knowledge/risk-reduction" is included in the calculus. That said, municipalities and regulated entities have a lot to gain by participating the the public cloud economies of scale-- looking at the membership roster of cloudsecurityalliance.org indicates clearly-described security goals have market interest. Now, about reducing the attack surface of the underlying cloud architectures.... -E
Hi Dan, thanks for an interesting governmental viewpoint on cloud security concerns-- whereas I am sympathetic with James Hamilton's blog "Private Clouds are not the future" (http://perspectives.mvdirona.com/2010/01/17/PrivateCloudsAreNotTheFuture.aspx) for many corporations due to economies of scale, governmental (and regulated) entities must also consider the costs associated with risk reduction (e.g. your points regarding having an understanding of how/where data is stored and protected). In such a case, a private cloud may be more than just the starting point you have indicated-- a "conglomerated municipalities cloud" could address many of your concerns (esp. regarding transparency in operations) and possibly be a cost-effective substitute for public clouds if the "value of knowledge/risk-reduction" is included in the calculus. That said, municipalities and regulated entities have a lot to gain by participating the the public cloud economies of scale-- looking at the membership roster of cloudsecurityalliance.org indicates clearly-described security goals have market interest. Now, about reducing the attack surface of the underlying cloud architectures.... -E