Welcome to the world of Infosys Engineering! It is a half a billion plus organization that takes pride in shaping our engineering aspirations and dreams and bringing them to fruition. We provide engineering services and solutions across the lifecycle of our clients’ offerings, ranging from product ideation to realization and sustenance, that caters to a cross-section of industries - aerospace, automotive, medical devices, retail, telecommunications, hi tech, financial services, energy and utilities just to name a few major ones.

« Leveraging the power of Crowdsourcing for Localization | Main | Are you IPv6 ready? »

Privacy of Data in the Cloud

There is no executive meeting today in the software industry where the 'cloud' word is not used. As the industry gets more and more familiar with the intricacies of cloud computing and the accompanying economical benefits and risks, the concerns of data security remains to be one of the major hindrances towards wide scale adoption. However, to assuage such fears, companies are coming up with some innovative ideas (some technology-oriented, some process-oriented) to provide the necessary confidence towards cloud adoption.

Retail customers often need to handle peak hour traffic on only certain days of the year - sometimes only once a year. It is not economical for businesses to spend large amounts of capital on infrastructure in terms of hardware and licenses to handle this extremely rare demand peak. At the same time, in this era of extreme competition, not many businesses would dare to have unhappy customers, especially when it matters - like for example, a week before Christmas.

The elasticity that Cloud Computing offers is just 'what the doctor ordered'. One can just call up the cloud service provider, a week before the anticipated peak, and ask that the necessary resources needed to handle the peak be put in place.Cloud service providers also will need to be able to provide the necessary elasticity to business consumers without prior notification. Architecting solutions to automatically handle unknown surges in demand is challenging even today where architecting for scale-up and scale-out are common considerations. However, virtualization technologies, affordable blade servers with terabytes of main memory backed up by cheaper and larger hard-disks, multi-core processors looking for work to do - all provide the necessary technology support to service demands that are unique to cloud computing.

The biggest fear that companies have when thinking about operating out of the cloud - is with regard to the privacy of their data. Companies want to have control of their data. Over the years, as PCs got faster and less expensive, tasks were moved from the mainframe realm to the PC realm, because it gave a feel of things being under your control. Though the movement was slow initially, it picked up speed over the years and has now resulted in a lot of software running on desktop machines and server machines in-house. As more and more critical data resided on desktop machines, installation and execution of anti-virus software solutions provided that much needed confidence about data and applications being secure on the machines. With data out on the cloud, there needs to be something similar in place for customers to feel secure about solutions hosting their data.

Data security being one of the major hindrances towards leveraging the benefits of moving to the cloud, there is enough thought being put into how customers can be assuaged of such fears. According to Bret Hartman, CTO of RSA, the company is working on a SaaS based solution which provides a dashboard that allows enterprises to see how cloud service providers secure their data. Enterprises should be able to see that the sensitive content deployed by the provider is being protected and can also be used as an audit input.

Solutions that cloud service providers adopt have to be architected and implemented to protect data. To achieve data security, solutions need to achieve clear partitioning in storage, servers and network -achieved through use of virtualization technologies and management tools to monitor separation. There is a move towards getting vendors (whose solutions are commonly used in cloud computing solutions) on board to integrate and build security right into the cloud computing infrastructure. Virtualization solution providers, for example, need to think even harder towards what could possibly compromise data security when used as part of a cloud computing solution and plug those gaps. There seems a collaborative effort towards achieving such goals with RSA for example working with Cisco and VMware.

In addition, to provide potential cloud customers the necessary confidence, companies like McAfee will partner with leading Certification delivery vendors (KPMG for example) to provide Certification services tailored for SaaS and Cloud vendors. The certification services, which are provided on an annual basis, will include existing security controls, processes and certifications, as well as future Cloud security standards. In addition, there will be automatic and daily security audit and remediation of vulnerabilities. Cloud service providers who pass the daily scan and other checks will receive a `McAfee Secure' Trustmark which could serve as a certification of their strong security facilities.

The fear of data security as the one of the major hindrances towards cloud computing has indeed set off a scramble for solutions. It is interesting that the focus is not just at look at technical solutions, but there is intense innovation coming in from the process and standards side too. What is required is the hardening of the virtual environment, having access controls in place (so that consumers can determine control rather than providers), having strong authentication, strong interoperability and world-class standards in security. It is heartening that companies are working together in a cooperative mode towards a common purpose - that is to get more and more businesses to trust and embrace cloud computing solutions. 

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)

Please key in the two words you see in the box to validate your identity as an authentic user and reduce spam.

Subscribe to this blog's feed

Follow us on

Blogger Profiles

Infosys on Twitter