Click here to close now.


@CloudExpo Authors: Liz McMillan, Jayaram Krishnaswamy, Janakiram MSV, Jason Bloomberg, Carmen Gonzalez

Related Topics: Containers Expo Blog, @CloudExpo, Cloud Security

Containers Expo Blog: Article

A New Approach to Cloud Computing Security

Arguably the greatest barrier to businesses taking full advantage of cloud computing is the issue of security

Security Pavillion at Cloud Expo

Arguably the greatest barrier to businesses taking full advantage of cloud computing is the issue of security. Recent high-profile breaches of the cloud (the attack on Twitter being perhaps the most publicized) have only served to heighten concerns.

It's true; the potential consequences of a breach of cloud security are catastrophic, and this knowledge has served to make the debate rage even more fiercely. A cloud security issue within an organization has the potential to be a major business crisis, and against a backdrop of heightened public awareness of data loss and privacy issues such as ID theft, it's understandable.

But there's no denying that cloud computing is gaining momentum and will continue to become more and more mainstream. This year, for example, the UK government announced that it would be developing a cloud infrastructure (the ‘G-Cloud'), and the offer of flexible, low-cost and easily scalable IT means that many businesses are relying more and more heavily on cloud-based applications, storage and security.

The result is that the industry must get to grips with the security concerns. Fast.

Concern...or Confusion?
One of the key questions is whether or not security concerns are justified. Is it the case that unnecessary fears are preventing organizations from getting the most from the wealth of benefits that cloud-based services can offer?

It's a bit of both in my opinion. First, there's certainly a lot of confusion. A recent report by Gartner [1] suggests that most organizations don't fully understand their business' existing security provision and therefore cannot accurately pinpoint exactly where the gaps are when it comes to working with a cloud-based provider.

Furthermore, a lot of the confusion - and concern - arises from the (largely incorrect) assumption that cloud security is a complex issue. Security of the cloud is not necessarily as complex as some would have you imagine.

Detached Data
One of the key ways in which cloud computing differs to other IT services is that the relationship between cloud service provider and client is detached, often with significant geographical separation between parties. In addition, the ‘on-demand' nature of the relationship means that the client has very little influence on the operational practices of the provider. The cloud business model has moved far away from nurturing long-term partnerships, focusing instead on ease of initiation (and termination!) of relationships.

Combine this with the often large numbers of potential cloud providers with whom an organization may have a relationship at any one time and the greater level of data sharing inherent in many cloud services, and the issues become clear.

One of the key issues that arises from a security perspective as a result is the greater transfer of data in and out of a company's own IT infrastructure. Cloud computing differs from other similar IT services by moving data further from its original owner. As data storage and email outsourcing become two of the most popular modern cloud-based services, security fears over the transfer of data, and later, over who has access to this data, remain significant concerns.

However the numbers of cloud providers involved and the level of sharing that is inherent with many cloud-based services may well prove to make the task of securing the cloud itself an almost impossible one.

The key problem is that by the time data has reached the cloud, it's normally too late. As soon as a company's data leaves the relatively safe confines of its own IT infrastructure, the potential is there for it to get into the wrong hands. For this reason, it's at the boundary between the organization and its external environment that security has to be the key priority for those looking to use cloud-based services.

Confidence in the Cloud
With all this talk of risk and security, it's easy to forget the rewards of cloud services. Cloud computing is responsible for offering some of the greatest efficiencies within IT for decades. Furthermore, cloud computing forms the basis for a range of cutting-edge communication tools that not only provide new ways to engage with customers and colleagues, but demonstrate that your business is agile and forward-thinking.

While security is an important consideration, let's not forget that security must essentially be about enablement. It's no good having security that operates by preventing access, clamping down etc.

Security in this day and age must be about giving businesses the confidence to take advantage of new technology. This in turn, will lead to better communication, connectivity and innovation.

For Your Eyes Only
The key premise on which the foundations for safe and effective use of the cloud is this: That there will always be data that is so sensitive that it simply cannot be allowed to leave the confines of your business.

In the case of highly sensitive material, the best course of action in most instances is to prevent it from leaving your organization in the first place. (It is classic psychology that sensitive or confidential material is considered less so the further away it gets from the original creator.) What is therefore needed is highly sophisticated automated checking of outbound data to ensure that data that shouldn't leave the organization does indeed remain there.

For this reason, the key priority for improving the security of cloud computing lies not in the security of the cloud itself but in the routes in to and out of the cloud. Consider the analogy of tangible security risks to homes and business premises; it's the access points that are always the weak point. Therefore it's vital to ensure the ‘windows' and ‘doors' of cloud computing are made as secure as possible. Addressing the security of your company's specific cloud entry and exit points is the best - and simplest - way to get a grip on the potential issues involved to enable businesses to take advantage of all that the cloud has to offer.

Inbound from the Cloud
Many believe that cloud-based email is the only way to attain the best levels of efficiency and cost reduction. Indeed, although cloud-based email offerings can be compelling, it isn't the only way of doing things. In fact, when you consider the often quite significant issues regarding trust of a third-party cloud provider, cloud-based email can lose its shine. Allowing a third party to have unfettered access to all your incoming mail has major security implications, and requires complete trust and reliance on the organization providing the service.

Advances in appliance-based technology now mean that non-cloud based email security applications are as effective at reducing spam and malware with similar efficiencies to cloud-based services, but without the risk of handing all email data to a third party.

Keeping It Simple
Security of the cloud does not need to cause concern, nor should it be a barrier to using cloud services. Businesses simply need to ensure they have fully understood the risks their particular organization faces through using cloud-based services, and ensure that their security will enable them to use cloud services with confidence.

Collaboration and openness (both key cloud computing premises) are great attributes for many types of technology, and security nowadays must shift to focus on enablement rather than prevention. But collaboration and sharing is one thing when it's just you and your home PC and you are taking individual responsibility for the potential consequences of your actions. The same is not true for a company IT system where this way of working and engaging with customers and suppliers, though often commercially advantageous, carries far greater risks and therefore needs a level of corporate governance.

While it's easy to assume, when looking to adopt cloud-based services, that a third party may be a safer pair of hands, the reality is that there are no guarantees, and even if there is someone else to blame, the potential damage to your business could be catastrophic The only way to ensure your data is not compromised by the cloud is to control what is going to and from it in the first place, and make sure your control over what goes to and from the cloud is watertight.

More Stories By Alf Pilgrim

Alf Pilgrim is CTO of content security company, Clearswift. He joined Clearswift in 2006 as vice president, engineering where he is responsible for the product portfolio and technology development strategy and leads Clearswift’s drive to deliver policy-based security solutions. He was previously chief technology officer and director of product development and support at Northgate Information Solutions plc, the premier supplier of software and services to the UK public sector and human resource markets. He was part of the team that oversaw a 400% increase in shareholder value and corporate entry into the FTSE250. Alf holds a Ph.D. from the University of Leeds, is a chartered engineer, chartered IT professional and a member of the British Computer Society.

Comments (1) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

Most Recent Comments
rlebherz 11/20/09 03:42:00 PM EST


Interesting article. I think the Cloud services and cloud infrastructure lines are a bit blurred, but I agree with most of what you are saying.

Dont underestimate the SLA's role in accountability. For companies that have dynamic requirements and no down time can be afforded, make sure you have very tight SLAs. For example, OpSource provides a 100% SLA in the cloud and 100%SLA around production application environments. Now 100% is ideally perfect, it comes down to accountability, you put you faith in us, we should do what we say we will do. And if something happens, you should be paid back. We also have 24x7 phone support where you can actually talk to a real person and you get account managers when you sign up who can help you work through business related issues. Imaging that, people in charge of the relationship and accountability.

Also, A New Approach To Cloud Security Is Already Her! From a Cloud Infrastructure and operations perspective
Check out and

If you want to move everything need for delivering your production environments into the cloud check out

If you want to move your infrastructure into the clouds, check out

Also, RLE01 will get you 20% off.

@CloudExpo Stories
For almost two decades, businesses have discovered great opportunities to engage with customers and even expand revenue through digital systems, including web and mobile applications. Yet, even now, the conversation between the business and the technologists that deliver these systems is strained, in large part due to misaligned objectives. In his session at DevOps Summit, James Urquhart, Senior Vice President of Performance Analytics at SOASTA, Inc., will discuss how measuring user outcomes –...
As-a-service models offer huge opportunities, but also complicate security. It may seem that the easiest way to migrate to a new architectural model is to let others, experts in their field, do the work. This has given rise to many as-a-service models throughout the industry and across the entire technology stack, from software to infrastructure. While this has unlocked huge opportunities to accelerate the deployment of new capabilities or increase economic efficiencies within an organization, i...
The Internet of Everything is re-shaping technology trends–moving away from “request/response” architecture to an “always-on” Streaming Web where data is in constant motion and secure, reliable communication is an absolute necessity. As more and more THINGS go online, the challenges that developers will need to address will only increase exponentially. In his session at @ThingsExpo, Todd Greene, Founder & CEO of PubNub, will explore the current state of IoT connectivity and review key trends an...
SYS-CON Events announced today that IBM Cloud Data Services has been named “Bronze Sponsor” of SYS-CON's 17th Cloud Expo, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. IBM Cloud Data Services offers a portfolio of integrated, best-of-breed cloud data services for developers focused on mobile computing and analytics use cases.
As the world moves towards more DevOps and microservices, application deployment to the cloud ought to become a lot simpler. The microservices architecture, which is the basis of many new age distributed systems such as OpenStack, NetFlix and so on, is at the heart of Cloud Foundry - a complete developer-oriented Platform as a Service (PaaS) that is IaaS agnostic and supports vCloud, OpenStack and AWS. In his session at 17th Cloud Expo, Raghavan "Rags" Srinivas, an Architect/Developer Evangeli...
The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data...
Today air travel is a minefield of delays, hassles and customer disappointment. Airlines struggle to revitalize the experience. GE and M2Mi will demonstrate practical examples of how IoT solutions are helping airlines bring back personalization, reduce trip time and improve reliability. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Dr. Sarah Cooper, M2Mi's VP Business Development and Engineering, will explore the IoT cloud-based platform technologies driv...
Overgrown applications have given way to modular applications, driven by the need to break larger problems into smaller problems. Similarly large monolithic development processes have been forced to be broken into smaller agile development cycles. Looking at trends in software development, microservices architectures meet the same demands. Additional benefits of microservices architectures are compartmentalization and a limited impact of service failure versus a complete software malfunction....
As a company adopts a DevOps approach to software development, what are key things that both the Dev and Ops side of the business must keep in mind to ensure effective continuous delivery? In his session at DevOps Summit, Mark Hydar, Head of DevOps, Ericsson TV Platforms, will share best practices and provide helpful tips for Ops teams to adopt an open line of communication with the development side of the house to ensure success between the two sides.
The last decade was about virtual machines, but the next one is about containers. Containers enable a service to run on any host at any time. Traditional tools are starting to show cracks because they were not designed for this level of application portability. Now is the time to look at new ways to deploy and manage applications at scale. In his session at @DevOpsSummit, Brian “Redbeard” Harrington, a principal architect at CoreOS, will examine how CoreOS helps teams run in production. Attende...
Developing software for the Internet of Things (IoT) comes with its own set of challenges. Security, privacy, and unified standards are a few key issues. In addition, each IoT product is comprised of at least three separate application components: the software embedded in the device, the backend big-data service, and the mobile application for the end user's controls. Each component is developed by a different team, using different technologies and practices, and deployed to a different stack/...
Redis is not only the fastest database, but it has become the most popular among the new wave of applications running in containers. Redis speeds up just about every data interaction between your users or operational systems. In his session at 17th Cloud Expo, Dave Nielsen, Developer Relations at Redis Labs, will share the functions and data structures used to solve everyday use cases that are driving Redis' popularity
SYS-CON Events announced today that Sandy Carter, IBM General Manager Cloud Ecosystem and Developers, and a Social Business Evangelist, will keynote at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that DataClear Inc. will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. The DataClear ‘BlackBox’ is the only solution that moves your PC, browsing and data out of the United States and away from prying (and spying) eyes. Its solution automatically builds you a clean, on-demand, virus free, new virtual cloud based PC outside of the United States, and wipes it clean...
SYS-CON Events announced today that Machkey International Company will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Machkey provides advanced connectivity solutions for just about everyone. Businesses or individuals, Machkey is dedicated to provide high-quality and cost-effective products to meet all your needs.
WebRTC converts the entire network into a ubiquitous communications cloud thereby connecting anytime, anywhere through any point. In his session at WebRTC Summit,, Mark Castleman, EIR at Bell Labs and Head of Future X Labs, will discuss how the transformational nature of communications is achieved through the democratizing force of WebRTC. WebRTC is doing for voice what HTML did for web content.
As a CIO, are your direct reports IT managers or are they IT leaders? The hard truth is that many IT managers have risen through the ranks based on their technical skills, not their leadership ability. Many are unable to effectively engage and inspire, creating forward momentum in the direction of desired change. Renowned for its approach to leadership and emphasis on their people, organizations increasingly look to our military for insight into these challenges.
The IoT is upon us, but today’s databases, built on 30-year-old math, require multiple platforms to create a single solution. Data demands of the IoT require Big Data systems that can handle ingest, transactions and analytics concurrently adapting to varied situations as they occur, with speed at scale. In his session at @ThingsExpo, Chad Jones, chief strategy officer at Deep Information Sciences, will look differently at IoT data so enterprises can fully leverage their IoT potential. He’ll sha...
The enterprise is being consumerized, and the consumer is being enterprised. Moore's Law does not matter anymore, the future belongs to business virtualization powered by invisible service architecture, powered by hyperscale and hyperconvergence, and facilitated by vertical streaming and horizontal scaling and consolidation. Both buyers and sellers want instant results, and from paperwork to paperless to mindless is the ultimate goal for any seamless transaction. The sweetest sweet spot in innov...
SYS-CON Events announced today that Key Information Systems, Inc. (KeyInfo), a leading cloud and infrastructure provider offering integrated solutions to enterprises, will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Key Information Systems is a leading regional systems integrator with world-class compute, storage and networking solutions and professional services for the most advanced softwa...