Industry View

Forrester: A Close Look At Cloud Computing Security Issues

Chenxi Wang examines security, compliance and contractual issues in cloud computing

By Chenxi Wang, Ph.D., Forrester Research

Page 2

While cloud computing is able to deliver many benefits, organizations should not jump on the "cloud" wagon without a compelling business driver and a clear understanding of the security, privacy, compliance, and legal consequences. An effective assessment strategy covering these items will help you reach the ultimate goal: Make the cloud service work like your own IT security department and find ways to secure and optimize your investments in the cloud.

The security and legal landscape for cloud computing is rife with mishaps and uncertainties. In the long run, however, cloud operators will continue to find economies of scale, not only in their core services, but also in their treatment of security.

To take full advantage of the power of cloud computing, end users need to attain assurance of the cloud's treatment of security, privacy, and compliance issues. To that end, we need an industry with open standards, clearer regulations, and community-driven interoperability. A standards-based approach will make it easier for vendors to support flexibility, agility, and expanded cloud service offerings such as collaboration, and it will also make it easier for customers to evaluate cloud vendors and build trust in its privacy and security promises.

With the rising popularity of cloud computing and the emergence of cloud aggregators and integrators, the role of an internal IT security officer will inevitably change—we see that an IT security personnel will gradually move away from its operations-centric role and step instead into a more compliance and requirements-focused function. ##

Chenxi Wang, Ph.D., is a principal analyst at Forrester Research where she serves Security & Risk professionals. For more information on Forrester's upcoming Security Forum, to be held September 10-11, 2009 in San Diego, Calif., please visit www.forrester.com/securityforum2009.