#cloudrisks

This morning, I read a view about cloud security in Computing.co.uk. The title - "We should replace cloud..." The objective of the writer is good; as always the intent is good, but the approach is questionable. In a way this borders scaremongering. 

Simply put, almost everyone in IT & Business, the first thing they would highlight with cloud is the security risk. So what's the use in magnifying the risk, without providing mitigations?

Yes cloud contracts are hazy, security risks within the organisations are high too, hackers are waiting to bring you down - yes all these issues exist irrespective of your choice. 

Keep it simple - If you run your own data-centres, one can assume that the organisation has an average capability (as a base case) in managing the security, but how well is that team in managing threats and risks- 24x7? If the answer is resoundingly positive, then chances are very high that you are running a high calibre IT team. You may argue that I am making some sweeping assumptions that an excelling info-security team is a good enough indicator for running the overall IT business.

In a way yes, because information security touches all realms from physical assets to user access through to social-media risk, hacking and what-not? So if this info-sec team is on top of its game, then I can safely say that the rest of the IT teams should be in the same performance levels  - that means probably your company is in the top 10% percentile and for such companies, cloud-computing may not a big value-add as they would be running a CMM level 5 IT function or in other words "IT is already run as a business".

So going back to my assumption that organisations have an average say level 2-3 capability, then the risks within the data centre or in the clouds are same.