Fortunately, there's some evidence of companies proceeding with caution. One example is Atmos Energy, which is using Salesforce.com to speed its response time to customers and help the marketing department manage a growing pool of clients, according to CIO Rich Gius.
The endeavor is successful thus far, so Gius is investigating the viability of running company e-mail in the cloud. "It would help us address the growing challenge where e-mail-enabled mobile devices like BlackBerrys are proliferating widely among the workforce," he says. But he's not ready to take such a big step because the risks, including security, remain hard to pin down. One example of the disruption that cloud-dependent companies can experience came in May, when search giant Google--whose content accounts for 5 percent of all Internet traffic--suffered a massive outage. When it went down, many companies that have come to rely on its cloud-based business applications (such as e-mail) were dead in the water.
The outage wasn't caused by hackers, but there are signs that cybercriminals are exploring ways to exploit the cloud for malicious purposes. On the heels of the outage, attackers added insult to injury by flooding Google search results with malicious links, prompting the U.S. Computer Emergency Response Team (U.S. CERT) to issue a warning about potential dangers to cloud-based service sites.
The attack poisoned several thousand legitimate websites by exploiting known flaws in Adobe software to install a malicious program on victims' machines, U.S. CERT says. The program would then steal FTP login credentials from victims and use the information to spread itself further. It also hijacked the victim's browser, replacing Google search results with links chosen by the attackers. Although the victimized sites were not specifically those offering cloud-based services, similar schemes could be directed at cloud services providers.
IT organizations often make an attacker's job easier by configuring physical and cloud-based IT assets so poorly that easy-to-find-and-exploit flaws are left behind. Asked about the potential vulnerabilities in their virtualized environments, 36 percent cited misconfiguration and poor implementation, and 51 percent cited a lack of adequately trained IT staff (whose lack of knowledge leads to configuration glitches). In fact, 22 percent of respondents cited inadequate training, along with insufficient auditing (to uncover vulnerabilities) to be the greatest security risk to their company's cloud computing strategy.
It's this awareness that makes Atmos Energy's Gius proceed with caution. "We have no CSO. If we were a financial services firm it might be a different story, or if we had a huge head count," Gius says. "But we are a small-to-medium-sized company, and the staff limitations make these kinds of implementations more difficult."
Even with the right resources, security in the cloud is a matter of managing a variety of risks across multiple platforms. There's no single cloud. Rather, "there are many clouds, they're not federated, they don't natively interoperate at the application layer and they're all mostly proprietary in their platform and operation," Hoff says. "The notion that we're all running out to put our content and apps in some common [and secure] repository on someone else's infrastructure is unrealistic."
Lobel, with PricewaterhouseCoopers, says perfect security is not possible. "You have to actively focus on the security controls while you are leaping to these services," he says. It's difficult for companies to turn back once they have let their data and applications loose because they are often quick to rid themselves of the hardware and skills they would need to bring the services back in-house.
"If you dive down a well without a rope, you may find the water you wanted, but you're not going to get out of the well without the rope," he says. "What if you have a breach and you need to leave the cloud? Can you get out if you have to?"