A panel of IT security experts gathered at a round table event, held by hosting specialist UKFast, to inform businesses of the different security issues associated with various cloud platforms. They warned business owners not to rule out a move to an internet-based IT infrastructure because of inaccurate generalisations about the safety of cloud that are hyped by the media.
Ian Moyse, IT security expert and EMEA channel director at Webroot said: “There have been stories dominating the press recently, including that of Sony’s leaked client data, that have suggested the use of cloud technology has contributed to the security blunder. In fact, in many of those cases, it wouldn’t make a difference if it was a cloud service provider or an on-premise system. Issues arise in organisations without the right security processes not just in those with a cloud-based infrastructure.”
Neil Lathwood, UKFast’s IT director continued: “Typically security incidents occur either because someone is gaining access to credentials illegitimately that allow them to get into a system in the first place or because they hack through inadequate security on the perimeter. Outsiders might also intercept traffic in transit because it’s not going through secure pipes. These issues exist whether you run your own data centre or you’re in the cloud.”
Panellists described the fundamental difference of a cloud-based infrastructure to a traditionally hosted set-up. Lathwood said: “The cloud is run across the internet so arguably that presents other points of vulnerability but the level of security in the cloud depends on the type of cloud you choose. With a dedicated private cloud you can lock it down securely and be confident that your data is safe.”
Lawrence Jones, UKFast’s managing director added: “With anything else there are question marks around the definite security of data. In a public cloud or a hybrid cloud where more data is aggregated and there are multi-tenancy issues, there are different levels of risk.”
“The benefits of cloud technology for businesses are huge but outside of a wholly dedicated cloud, it’s certainly not risk free,” he said.
Andy Burton, chairman of the Cloud Industry Forum (CIF), cited the forum’s research into the main barriers that prevent businesses adopting cloud.
When asked to name their chief worries about cloud adoption, data security and privacy stood out above all others in the sample used by the CIF. The physical location of data was another area of concern for cloud users, with 75 per cent saying it was important that data is stored either solely in the UK or within the EU.
Burton said: “Data security, privacy and sovereignty, I would say, are barriers to the pace of adoption rather than barriers to adoption. It’s our responsibility to educate customers so that they can overcome those issues if it’s appropriate for them to do so.
“Understandably, users want to know how well their data will be protected and they want to be confident that it won’t be misused by the people they are trusting to look after it. They are also concerned about data sovereignty – where their data will physically reside and under what jurisdiction because there is more of an emotional concern about it going offshore at the moment.”
The panel agreed that the popularity of cloud technology is likely to give rise to unscrupulous vendors and suppliers who exaggerate their level of expertise in cloud.
Moyse continued: “Like in any industry, there will be good and bad players out there. It’s very easy to become a cloud vendor because of the nature of the technology. There will be lots of innovative companies springing up and customers will be dealing with someone they haven’t heard of before.”
Zen Internet’s Andrew Saunders said: “It’s important in that situation that the business owner thinks about his due diligence in the same way that he would ask tough questions of his own IT department to make sure they are doing the correct job and to make sure steps were being taken to protect his business."
However, the round table experts highlighted the physical security issues that cloud technology can eradicate.
Saunders said: “Cloud technology certainly reduces the physical security issues. I’ve worked in businesses where people have managed to get past the front desk and steal a server. You wouldn’t get that in a data centre where the cloud is hosted.”