Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Would you prefer a private cloud for your data or a public one?

Who takes care of financial liability in case of any breach?

Do companies still keep the most critical within their data centers, but would not mind hosting their other non-critical data on the cloud?

Is the strategy to wait and watch? Or would you take take the risk?

share|improve this question
up vote 5 down vote accepted

Your company takes on any and all risks associated with any breaches. You'll find that by signing up for public cloud environments, you'll have to sign a document accepting that provider's Terms of Service. Among those TOS will be something along the lines of a full waiver of any liability on the part of the provider.

Even in the "compliant" (as in PCI/FISMA/ETC) cloud environments, you'll see that same sort of language, even though in those cases the providers have gone through (hopefully) some pretty significant auditing of their policies, procedures, and security measures.

Nobody keeps critical data in a public cloud. Until hypervisors are guaranteed to be bulletproof (and they're not at this time), I would never trust a public cloud with any data that required any kind of compliance or regulatory oversight, like Personally Identifiable Information, financial data, medical records, etc.

With a private cloud, you are at least relatively assured that the other users (VMs) in the environment aren't trying to break through the hypervisor to get to your data. You have full control of the hardware (full stack, not just the servers), hypervisor, VM images, access controls, and auditing and logging.

One thing we're starting to see more of is hybrid environments. Where the critical data is maintained in a private environment, while portions of the stack that don't host critical data might be in the cloud.

For example, keep your SAN, and your DB servers in the private space, but keep your webservers in cloud, where you can use the elasticity of cloud computing to dynamically grow and shrink the number of servers running at any given time to accommodate changing work loads. Or maybe just the webservers that serve static, non-PII, content are in the cloud, but the servers people log into are in the private space.

There are a number of ways to leverage the benefits of cloud computing without compromising your security. People are doing it today. Cloud computing is arguably the fastest growing segment of IT, outside of IT Security.

share|improve this answer
Another additional point is data backup. If your cloud provider ceases to exist (for example bankruptcy) DR capability of a cloud provider is moot. It is often not viable to replicate data for backup. At this stage in the game cloud based services are ideal for top tier services and front-end but less so for data storage because of the above mentioned issues. – Bernie White Nov 7 '11 at 23:18
yeah. backups are a huge consideration. – Tim Kennedy Nov 8 '11 at 0:37
I don't really see the difficulty of using a 'back down' program to an in house private disk. – Tom Andersen Nov 10 '11 at 14:01
The resources an Amazon or Google can muster to deal with security are likely greater than that of any non IT based company. If you have critical data it should be encrypted before storage, no matter where its stored. – Tom Andersen Nov 10 '11 at 14:04

In the absence of standardized and interchangeable cloud vendors, it's at least as important to consider the durability of any particular cloud vendor. A business based on a particular vendor could be in deep trouble when that vendor decides to close up shop.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.