Guidelines, awareness should address cloud security concerns

By eGov Innovation Editors | Sep 19, 2011

Thumbnail: 

A security framework is needed to clarify the level of risk exposure and provide guidance on the various security provisions of cloud service providers.

This was the message of  Khoong Hock Yun, Assistant Chief Executive, Infocomm Development Authority of Singapore, at the Cloud Security Alliance Summit 2011 held recently in Singapore.

Yun noted the proliferation of cloud services in the region and cited Singapore as one that has a good start in developing its cloud computing ecosystem.

"Over the past three years, cloud computing services have since seen considerable growth in Singapore. From just the three winning Cloud Service Providers or CSPs, the Singapore Cloud Computing ecosystem has grown to host over 10 cloud data centers. These CSPs include Amazon Web Services, Microsoft, IBM, Fujitsu, Savvis, and Tata Communications," he said.

A VMWare survey of nearly 7,000 respondents in Asia-Pacific also showed that almost 60 percent of regional companies are either using cloud or planning cloud initiatives now, he added.

"To make further progress in adoption of cloud computing, we will all need to make a concerted effort to address the users' concerns on cloud security," Yun stressed.

Part of this effort is establishing clear guidelines on mitigating the risks associated with cloud computing and promoting better understanding of the issues for both cloud users and service providers. There can be more awareness, he said, through  seminars, workshops and conferences.

"For regulated industries or sectors of economy, it may be necessary to establish relevant policies and regulatory framework to govern the use and provision of cloud services to ensure some minimum compliance," he said.

Some of these efforts that have been expanded globally include the European Network and Information Security Association (ENISA), Cloud Security Alliance, Statement of Auditing Standards by American Institute of Certified Public Accountants (SAS70), Federal Risk and Authorization Management Program (FedRAMP)  and ISO/IEC. However, these guidelines are still very much work-in-progress.