Storm clouds on the horizon

Cloud computing represents one of the most significant shifts in information technology that many of us are ever likely to see in our lifetimes. Customers are both excited and nervous at the prospects of cloud computing. They are hopeful that the opportunities will reduce capital costs and are excited for a chance to divest themselves off infrastructure management, and focus on core competencies. However, customers are also very concerned about the risks of cloud computing if not properly secured, and the loss of direct control over systems for which they are nonetheless accountable.

To aid both cloud customers and cloud providers, Cloud Security Alliance, a non-profit organization was formed to promote the use of best practices for providing security assurance within cloud computing, and offer education on the uses of cloud computing to help secure all other forms of computing. Recently, to address the Indian security market, Cloud Security Alliance launched the Mumbai Chapter, the world's largest Cloud Security Alliance Chapter, with over 250 members, which would offer a platform to various Indian-owned oversees cloud providers, as well as India-based cloud operators.

Nitin Khanapurkar, executive director-India, KPMG said, "The key issues of cloud computing are its globally incompatible legislation and policy, non-standard private and public clouds, lack of continuous risk management and compliance monitoring. Therefore, the objective of this alliance is to promote the use of best practices for providing security assurance within cloud computing, and provide education on the uses of cloud computing to help secure all other forms of computing."

The CSA members benefit through networking and knowledge sharing with guidance from subject matter experts from a wide variety of disciplines. One of the key functions of this alliance is to launch awareness campaigns and educational programs on the appropriate uses of cloud computing and cloud security solutions. "We are taking various means to educate partners including educational outreach via industry and online events, customized CSA educational events, and research of cloud computing security assurance issues. In addition, the maintenance of CSA website, blogs, newsletters, social networking sites and support of educational initiatives are other such means," said Khanapurkar.

"In just a short span of time, we have pulled together a diverse group of individuals from all corners of the technology industry to publish the first 'Security Guidance for Critical Areas in Cloud Computing.' CSA has not only identified major security threats, but also provided solutions to these threats including abuse and nefarious use of cloud computing, insecure application programming interfaces, malicious insiders, shared technology vulnerabilities, data loss/leakage, account, service and traffic hijacking," affirmed Khanapurkar.