As we begin this cloud security newsletter it's probably a good idea to define what a cloud is.

It's not a simple thing to do, given the way people name things. The term cloud comes from the old WAN diagrams that show the service provider's network as a puffy cloud that all the access lines run into. The point of the metaphor is that you plug into an entity whose inner workings are obscure, but you believe it will do what you want it to do. (The leap of faith for a transport service provider was scary enough, but with cloud computing, it's even scarier. Your data isn't just passing through, it lives there.)

So the cloud is a physical place, perhaps owned and controlled by some other entity, and it contains computing resources that are available pretty much on demand for a price.

Simple enough, but there are plenty of variations. At the recent VoiceCon conference, a discussion of cloud-based communications applications immediately veered into a discussion of types of clouds: public, private, enterprise, virtual, internal, external - the list went on and on.

These terms are supposed to be useful in that they are shorthand to describe real differences among cloud possibilities, but they can also cause confusion. (See Chris Hoff’s discussion)

The important thing to remember is that at least for now, you should not be satisfied with the cloud as a mysterious blob that you plug into for computing resources. You should find out what’s in there, how it works and how it is secured. You may be satisfied and you may not, but at least you’ll know what’s in there and what, if anything, you will entrust to it.

Tim Greene is senior editor at Network World.