A new study by Symantec Corp. and the Ponemon Institute LLC reveals an alarmingly low number of organizations have procedures in place for approving cloud applications that use sensitive information. But one security expert warns the study assumes cloud computing is not secure when, really, the jury is still out.
The study shows that only 27 per cent of IT professionals surveyed said their organizations have procedures and policies for using cloud computing. The sort of rudimentary process typically seen is based on word of mouth, said Larry Ponemon, chairman and founder of Traverse City, Mich.-based Ponemon Institute. “If your friend at company X tells you this is a really good product for sales force automation because I see their name on the side of the building, they must be good,” said Ponemon.
The Cupertino, Calif.-based security vendor, in tandem with the research firm, released the study on Monday. It is based on surveys with IT professionals regarding cloud computing procurement practices.
The study also revealed that only 20 per cent of those surveyed said information security teams are regularly involved in the decision-making process. And, 68 per cent said end users and business managers are made responsible for evaluating cloud computing vendors.
Ponemon said the issue has moved from the conventional world of people, process and checklists to the new cloud computing world where the usual due diligence is often bypassed. “Now we have end users making business decisions and procuring technologies that may be in the sensitive and confidential arena,” he said.
Francis Ho, security expert and executive committee member of the Toronto-based Federation of Security Professionals (FSP) points out that the stats are initially alarming if one assumes cloud computing is fraught with security risks. “But if you are presupposing that cloud computing is secure, then (the numbers) don’t surprise me,” said Ho.
Ho said many large companies he’s come into contact with don’t even have an approval process for traditional applications.
As for the high percentage of line of business users tasked with cloud vendor assessments, Ho said cloud computing vendors will naturally push the technology by touting how secure it is. And if line of business people are drawn into that vendor marketing, then naturally they won’t think to liaise with the information security folks. “Why would I involve the IT folks if I want to buy laundry services for my shirts?” said Ho.
As for the high percentage of line of business users tasked with cloud vendor assessments, Ho said cloud computing vendors will naturally push the technology by touting how secure it is. And if line of business people are drawn into that vendor marketing, then naturally they won’t think to liaise with the information security folks. “Why would I involve the IT folks if I want to buy laundry services for my shirts?” said Ho.
Brian O’Higgins, a Toronto-based security consultant, said the lack of procedure could also be a result of cloud computing being relatively easy to use without the usual hassle of implementation and training. “It’s like if you want to plug in a toaster you buy a toaster and plug it in the electrical outlet. But if you have to wire in the outlet you wouldn’t do it,” said O’Higgins.
A new security issue that comes with cloud computing, said O’Higgins, is one of classifying or labelling data. If it’s sensitive information then it must have a policy dictating how it’s treated.
The cloud is forcing organizations to rethink the processes and people involved with data storage and management, said John McGee, vice-president of product marketing with Cupertino, Calif.-based security software vendor Symantec.
McGee suggests organizations ensure they have the right employees and security approaches, and give attention to compliance issues when dealing with the cloud. “It’s making sure the right people are involved in the process early on. It’s not just an upfront process but an ongoing management of that cloud vendor,” said McGee.