Bill Strain, CTO iomart, looks at cloud computing in the wake of recent outages

Hackers and outages have certainly made sure it has rained on the cloud parade in recent months. Repeated attacks on Sony’s Playstation network have rekindled the debate about the security of the cloud as have cloud failures at Amazon, Google and Microsoft.

So, has the padlock come off? Is the cloud inherently insecure? Should we go back to the old days?

The answer is no, no and no.

The Cloud approach continues to offer a unique opportunity to business. Managing and maintaining complex hosting environments in-house can be time consuming and costly so handing that over to a company that specialises in hosting services not only reduces a big burden on management, it can also be an effective way of reducing costs. The key comes when that handover takes place. Like handing over your new born baby to someone else for the first time, can you trust them to protect it from harm?

Good cloud services are intrinsically secure. They are built by experts from the ground up with scalability and reliability at the fore. Security plays a big part in that built environment.

What we need to do is reassure and educate our end users and work with them to create trust around the cloud.  The key to this is “shared responsibility” between cloud providers and cloud users, according to organisations like the Cloud Security Alliance.

Industry analysis suggests there are six perceived risks around the cloud that need to be addressed:

Vendor Trust
If a business is seeking cast iron guarantees over the security and location of its data assets then it needs its cloud provider to meets those requirements via the Service Level Agreement and contract. At iomart Hosting we only deal with suppliers who provide best of breed hardware and software layers backed by the most stringent Service Level Agreements. We can then offer our own SLAs confident that our suppliers are singing from the same hymn sheet.

Legislation and compliance 
Retention of data within geographical boundaries is becoming far more important so there is a need to comply with local standards. In the UK, ISO accreditations give clear signs to customers about the management of data and the physical infrastructure being used.

Distributed infrastructure
The key issue here is that customers must be convinced that all architecture is engineered with no single point of failure. Maintaining resilient infrastructure for all areas of the service across the data centres and cloud platforms provided is vital.

Web threats
These can only be countered with appropriate access control and management at the network and hypervisor level. What weakens defences is clients with code issues or poor internal policies on the storage and utilisation of critical system information.

Data leakage    
This should be handled by Hypervisor technology. Guest operating systems within the hypervisor should be kept separate through the fundamental aspects of the hypervisor technology itself.

Shared infrastructure
There is an additional onus on service providers to ensure proper segregation of user data in other shared technologies such as the SAN and backup platforms.

Recent research by Pearlfinders has shown a big increase in the number of ICT decision-makers showing an interest in buying cloud-based solutions. At iomart Hosting we’ve seen enquiries about our cloud services jump from 1% in 2008 to 25% last year and climbing. With the maturity phase of cloud adoption now predicted to be within 3-5 years by Gartner we are perfectly positioned to help companies into the cloud.

For all that we can do to reassure businesses though, they must realise that they have a responsibility to ensure that their own internal systems and processes are safe and secure and comply with the regulatory and audit requirements of their own sectors.

As Tier1, the US-based technology research specialist, concludes: “Moving to the cloud does not absolve an organization of its responsibility to defend itself against the inherent risks of pushing workloads beyond its own walls.”

The rules and policies for data protection don’t change because a company opts for using the cloud over other methods.

By demonstrating that we can provide a safe environment and emphasising to customers that they share that responsibility, we can banish the storm clouds and make hosting in the cloud a more attractive proposition over the next few years.