Security concerns are frequently cited as a potential inhibitor to the adoption of Cloud Computing . According to experts at the RSA 2009 security conference in San Francisco, those concerns may not be entirely unfounded.
"Cloud Computing is a challenge to security, but one that can be overcome," said Whitfield Diffie, chief security officer at Sun Microsystems. "I believe Cloud Computing will get to that status where no program or major industrial design will ever be done anymore on the computers of the company that's doing it.”
The kind of massive data centres built and run by Cloud Computing providers represent irresistible targets for hackers. "We're more likely to suffer a digital 9/11," said Diffie. "I think we could suffer some astounding event. I get asked all the time about what is the worst that can happen, but the bigger risk is what's likely to happen, and it is not going to be the extreme catastrophic thing, it is going to be cybercrime.”
Real danger?
"When a large fraction of computing is handled by a small number of data centers, I think we're facing a real danger that hackers will be able to take one of those data centers out of commission, which would have catastrophic effects," said Adi Shamir, a computer science professor at Israel's Weizmann Institute of Science. "I'm worried about Cloud Computing. I think we are facing real danger that hackers will be able to take one of those data centres out of commission and then we would have a catastrophic effect."
But there is also the view that the security challenges in The Cloud are no different from those of traditional computing. "I'm kind of bored with Cloud Computing. It's presented as a new paradigm, but fundamentally, I don't see a lot of differences between it and client-server and dumb terminals,” said Bruce Schneier, chief security technology officer at BT Counterpane. "It's still all about trust. We still have to trust our vendors.”
Mary Ann Davidson, chief security officer at Oracle, took a similar tack. "One of the things that will happen is that services will evolve depending on people's appetite for risk. There's going to be a continuum of what these services are and what they offer - that means you will have more options in terms of how much risk you want to take,” she said. "You can outsource the provision of the service but you can't outsource the responsibility - you have to do a good job of vetting the service. You are never going to be 100% certain that things are perfect but you don't have that in your own organisation.”
