Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Would you prefer a private cloud for your data or a public one?
Who takes care of financial liability in case of any breach?
Do companies still keep the most critical within their data centers, but would not mind hosting their other non-critical data on the cloud?
Is the strategy to wait and watch? Or would you take take the risk?
Your company takes on any and all risks associated with any breaches. You'll find that by signing up for public cloud environments, you'll have to sign a document accepting that provider's Terms of Service. Among those TOS will be something along the lines of a full waiver of any liability on the part of the provider.
Even in the "compliant" (as in PCI/FISMA/ETC) cloud environments, you'll see that same sort of language, even though in those cases the providers have gone through (hopefully) some pretty significant auditing of their policies, procedures, and security measures.
Nobody keeps critical data in a public cloud. Until hypervisors are guaranteed to be bulletproof (and they're not at this time), I would never trust a public cloud with any data that required any kind of compliance or regulatory oversight, like Personally Identifiable Information, financial data, medical records, etc.
With a private cloud, you are at least relatively assured that the other users (VMs) in the environment aren't trying to break through the hypervisor to get to your data. You have full control of the hardware (full stack, not just the servers), hypervisor, VM images, access controls, and auditing and logging.
One thing we're starting to see more of is hybrid environments. Where the critical data is maintained in a private environment, while portions of the stack that don't host critical data might be in the cloud.
For example, keep your SAN, and your DB servers in the private space, but keep your webservers in cloud, where you can use the elasticity of cloud computing to dynamically grow and shrink the number of servers running at any given time to accommodate changing work loads. Or maybe just the webservers that serve static, non-PII, content are in the cloud, but the servers people log into are in the private space.
There are a number of ways to leverage the benefits of cloud computing without compromising your security. People are doing it today. Cloud computing is arguably the fastest growing segment of IT, outside of IT Security.
In the absence of standardized and interchangeable cloud vendors, it's at least as important to consider the durability of any particular cloud vendor. A business based on a particular vendor could be in deep trouble when that vendor decides to close up shop.
