Private Clouds One way to balance security with the efficiency of the cloud is to deploy a private cloud. A private cloud is similar to the public cloud, except that it resides behind a corporate firewall to ensure that security and compliance needs are met. The Department of Defense, said Level 7's Morrison, uses one of the largest private clouds in the world."Do people really know what their requirements are?" asked Dan Kusnetzky, vice president of research operations for The 451 Group. "Have they looked at the regulations and the implications on the ground for their data center?" No matter where your data goes, said Kusnetzky, security can't be taken for granted. "Security is not a product that can be purchased," he said. "It's a way of life, an implementation of the proper architecture, and the proper selection of tools, programs and procedures. No product that I know of is either secure or insecure. The same is true of the cloud computing environment." More to Come Right now, it's unlikely that you can move your most critical information to the public cloud. However, that could soon change. "I think the horse is out of the barn," said Current Analysis' DeCarlo. "This is something that's going to go forward. We'll see some stumbling. We've seen this with Google outages and Amazon. We've seen plenty of issues there already. But the concept is so appealing, there's no reason this won't take off. But I don't think every application will be there or mission-critical applications will ever be there." Industry experts say providers will have to move quickly to satisfy customers' pent-up desire for cloud computing options-and security. "Hospitals are dying to put their data in the cloud," said Joel Smith, CTO of AppRiver, a provider of systems for cloud computing. "There needs to be some sort of meet-in-the-middle agreement. They're going to have to have providers who will allow auditors to visit the data center. Or the regulation folks will have to make some subset of rules for specific regulations." Kusnetzky suggests that companies will start with small steps toward the cloud. "There will be people who might take some ancillary operations of their systems and try them out," he said. Lovejoy thinks that, ultimately, cloud providers that want business from large companies will have no choice but to offer secure, compliant systems: "We're going to be evolving to the point where cloud providers aren't going to say, -I'm not going to do it.' They'll have to do it." Contributing Analyst Wayne Rash can be reached at firstname.lastname@example.org.
Of course, before you can make a decision on whether to use the public cloud, a private cloud or no cloud at all, you have to know what you have and how it needs to be secured.