The more you specify unique security requirements, the harder it becomes to obtain the benefits of cloud computing.
I recently received an e-mail advertising an upcoming online seminar. The intriguing title was Cloud Computing -- Faster, Better, Cheaper, Greener and More Secure. I paused, reread the session description and thought, "Oh, dear." If this premise is true, let's just move everything onto the cloud right now. We can save beaucoup bucks in government and sleep better at night at the same time. But while I can buy the first four outcomes, I'm not buying the last -- that it's more secure -- at least not yet. Here's why.
First, I want to offer the obligatory praise for cloud computing in general and the undeniable efficiencies available to state and local governments in particular. Yes, Michigan -- the government I work for -- has an exciting cloud strategy, like many other states. In fact, most technology vendors I know have one or more game-changing cloud offerings.
But this is about cloud security and specifically whether cloud computing is more secure than whatever your government is doing now. If you currently have weak security controls, you may be tempted to hand over your sensitive data to a cloud provider -- but read on before you do.
Proponents argue that the "big boys" like Microsoft and Google can secure systems better than most companies or government employees. At a recent panel discussion in Grand Rapids on this topic, I was challenged by other panelists with one-liners like: "Do you really think your security team is better than Google's?"
"Perhaps not. But that's not my point."
So what are a few of the most pressing cloud security problems?
I could go on, but you get the picture. The more you specify unique security requirements, the harder it becomes to obtain the benefits of cloud computing. I do believe that new offerings will emerge in the coming years to address the essential requirements that most governments must address. However, I think we're a few years away from those opportunities becoming reality.
So what's a government technology leader to do in the meantime? First, you can start piloting the technology and create an internal government cloud. This will allow new flexibility to provision the infrastructure and software you need while maintaining more control over sensitive data within your environment.
Second, utilize cloud computing for publicly available data that's already accessible via the Freedom of Information Act. Large amounts of our government information can be placed in the cloud without risking breaches or many of the other issues identified.
Third, start talking with your vendor partners about new ways to secure your data in the cloud. There are many innovative technologies that are coming soon. I believe that the opportunities are huge over the next decade, and we need to build legal compliance into our plans.
Finally read about Google's recent experiences in China, which showcase some of the challenges that everyone faces as cloud computing progresses. Meanwhile, for the time being, our government technology future looks partly cloudy.