* Be aware of security 'experts' vs. salesmen when it comes to cloud security solutions
There was an awkward moment during the keynote address for The Experts Conference last week. Conrad Bayer, Microsoft’s general manager for identity and access, was addressing the delegates of the Directory and Identity track and, while talking about enterprise and organization movement to cloud computing, put up a slide that compared the migration to the cloud of small, midsize and large organizations.
FAQ: Cloud computing, demystified
One of the bullet points read “Small business have less concern for privacy and security.”
What???
I questioned Bayer about the slide and he admitted that it was, perhaps, an inelegant way of making the point. As Bayer later explained, the typical small business is only moving one application or service to the cloud so there’s less opportunity for inadvertent cross-compromising of both corporate data and personal data. He also noted that the people running small businesses don’t read the technology press as much as their counterparts at larger organizations, so they’re less exposed to the scare stories about the supposed dangers of cloud computing.
This sentiment was reiterated by other vendor folk, from Microsoft as well as from partner organizations. It isn’t so much the actual security problems of the cloud that present a barrier to use, but the perception — unfortunately fostered by the press and those with an axe to grind — that there’s a security vulnerability in the cloud that’s greater than that within the firewall.
I don’t believe it.
Just as most retail theft is done by employees, not shoplifters; just as most “identity theft” is done by friends and relatives, not strangers; so too is most corporate data theft and most corporate privacy compromising done by those inside the firewall.
So-called “security experts” who are, in reality, salesmen for security solutions, are quick to fan the flames of any new (and possibly not well understood) technology as being somehow inherently insecure. Too often, we in the press turn to these people for a snappy quote to “punch up” a story without really wondering how factual that quote might be. Beleaguered IT managers read the stories and question vendors about the security of these new technologies. Vendors hoping to make a sale want to reassure the customer — but what if there’s even a scintilla of a chance that there might be a data breach in the vendor’s cloud-based solution? Better to sympathize with the customer, tell hoary stories of data breaches and — just maybe — sell the customer an additional product that helps secure the cloud platform.
The cloud, just like your enterprise, is as secure (or not) as we make it. No more, and certainly no less.
