Cloud security to focus on technologies
December 1, 2011
Security around cloud computing is likely to focus on accreditation for individual technologies rather than wide ranging guidelines, according a leading official from CESG.
Chris Ulliot, deputy technical director for CESG, the National Technical Authority for Information Assurance, told the Socitm conference in Birmingham that cloud services make the technical elements of information security easier to deal with, as services can be certified before they reach the market.
CESG is working on some of the relevant issues, including privileged user access to data in the cloud, the legal jurisdictions, the location of data and its aggregation, where the boundaries between different sets of data lie, and the recovery of lost data. Ulliot said the big challenges are around governance, who owns the risk, and who is going to sign off a service as reaching an appropriate standard. But there are no plans to provide official guidance for the public sector…
"We’re not working on specific guidance for the cloud, but we’re looking at different technologies and doing accreditation," Ulliott told GGC. "For example, how do you do virtualisation in a secure way."
He said his personal view of the G Cloud – the marketplace for cloud services being created by the government for the public sector – was that it would help to improve information security, as once a service was proven to do a job well and securely it could be re-used many times.
Ulliot also claimed that the cloud can improve information assurance by making it less likely that data will be compromised when employees want to work from home.
"Putting all your corporate data on a home PC is not a good thing," he said. "You’ve only got to look at the number of home PCs that are compromised to see that is a bad thing."