Search

Brian Pennington

A blog about Cyber Security & Compliance

Tag

csa

Cloud maturity study reveals the top 10 issues eroding cloud confidence

Website: www.isaca.orgThe Cloud Security Alliance (CSA) and ISACA have issued the results of their survey of how organisations feel about the “cloud”.

The report provides detailed insight on the adoption of cloud services among all levels within today’s global enterprises and businesses. I have summarised the report below.

The study reveals that cloud users in 50 countries were least confident about the following issues (ranked from least confident to most confident):

  1. Government regulations keeping pace with the market (1.80)
  2. Exit strategies (1.88)
  3. International data privacy (1.90)
  4. Legal issues (2.15)
  5. Contract lock in (2.18)
  6. Data ownership and custodian responsibilities (2.18)
  7. Longevity of suppliers (2.20)
  8. Integration of cloud with internal systems (2.23)
  9. Credibility of suppliers (2.30)
  10. Testing and assurance (2.30)

While there are many positive indicators that support the planned adoption and perceived use and value of cloud services in the years ahead, there remains much progress to be made to engage and gain the buy-in among business leaders.

“As a first step, we as an industry must still work to provide a clearer definition of what cloud is and how the many innovative and secure services can help positively impact today’s businesses,” said J.R. Santos, global research director at CSA. “But, we need to start at the top and engage senior management. Cloud needs can no longer be thought of as a technical issue to address, but rather a business asset to embrace.”

“One of the most interesting findings is that governance issues recur repeatedly on the list of the top 10 concerns. Cloud users recognize the value of this model, but are wrestling with such questions as data ownership, legal issues, contract lock-in, international data privacy and government regulations,” said Greg Grocholski, CISA, international president of ISACA. “As cloud services continue to evolve, it is critical that we work together as an industry to provide insights and recommendations on these issues so that service and solution providers can look to innovate and deliver what the cloud services market needs to advance and what enterprises need to succeed.”

Survey Overview

Results of the study provide much insight on the progression of cloud adoption. For example,

  • Business enablers (score 4.08) rather than financial considerations (score 3.5) are the primary factors in making cloud decisions, with the least important factor being the ability to reduce the environmental footprint of the organization (score 2.67)
  • The business enablement factors that most influence cloud computing decision making are related to the reliability and availability of services (mean score 4.59) and quality of service (score 4.29)

Respondents feel there is room for improvement when it comes to innovation in the cloud.

  • 24% survey takers indicate that there is no or limited levels of innovation in the market
  • 43% of respondents believe there is a moderate level of innovation
  • 33% report that the level of innovation in terms of products, services and business use is significant

“Survey results show that CIOs and IT management understand cloud best and are most involved in driving cloud innovation in their organizations. This limits cloud maturity and innovation since cloud continues to be viewed as a technical solution and not as a business enabler,” said Yves Le Roux, a member of CSA and the ISACA Guidance and Practices Committee. “Cloud can provide business-building innovation, but to get to that point, there needs to be more buy-in and a better understanding among business leaders and C-level executives of the cloud’s value and risk.”

Nearly all respondents feel that cloud computing is far from reaching maturity, with only software as a service (SaaS) cautiously placed at the earliest state of growth level, with infrastructure and platform services still considered in the infancy stages.

Respondents remain moderately confident that cloud services are meeting service and strategy expectations and that problems are being addressed. Many rated cloud services as providing confidence in strategy and problem resolution (means score 3.47), indicating cautious optimism that cloud will advance in maturity and problems limiting its adoption will be addressed.

 

Security should not be viewed as an isolated activity

In IP EXPO’s 2011 security index survey which was conducted among IT professionals from businesses of all sizes and sectors on behalf of Imago Techmedia and the IP EXPO show organisers.

Respondents to our survey overwhelmingly agreed that IT security should not be viewed as an isolated activity, but would best be treated as an integrated part of businesses’ entire technology reviews and processes,”

said Mike England, Social Business & Content Director at IP EXPO event organiser Imago Techmedia

The key findings include:

  • 70% said they believed security would be best considered collaboratively and routinely across all aspects of ICT
  • 47% said they believed their own organisations needed more security-related collaboration between different ICT disciplines
  • 44% of respondents stated that at least a quarter of their jobs involved IT security.  For 23%, security took up more than half their time
  • 23% of respondents said that their approaches to compliance compromised their security
  • 26% said mobile devices such as smartphones and laptops posed the highest risk of data loss to their businesses.
  • 18% said memory sticks being used for data theft posed the highest risk to their businesses
  • 18% of IT pros say their businesses may not survive the consequences of a major security breach
  • Nearly one-fifth of IT professionals fear their businesses may never re-open for business or would fail shortly after a major security breach
  • 68% said they viewed IT security as “a necessary evil”

CSA UK & Ireland President Des Ward commented on the results of the survey:

Lack of collaboration and a perceived disconnect between security and business would explain the view of security being deemed ‘a necessary evil’, or even a cost of doing business online and consequently having little real business value. Businesses need to evolve beyond compliance risk management to information risk management in order to implement strategies that reduce the likelihood of breaches occurring, while at the same time affording a level of business agility fitting today’s interconnected society,” he suggested.

Of the main findings, Nigel Stanley, security practice leader at Bloor Research and IT Security Pathfinder at IP EXPO, said:

What’s clear is that even if someone’s job doesn’t directly involve security per se, everyone needs to be actively engaged in dealing with the problem.  And the way that businesses are going about it is encouraging, because security management needs to be a two-way process with the users actively engaged in the process.  Generally, taking compliance steps should enhance an organisation’s security – unless of course it is doing just enough to tick the boxes but failing to see the broader benefits of building a compliant business.  However, reducing security posture to achieve compliance is bonkers.

The IT security industry has been left wanting in respect of the consumerisation of IT that’s been fuelled by smartphone adoption.  Only now are we starting to see management tools for these devices, so it’s no surprise that these have been identified by respondents as the biggest risk area,” he commented.

IP Expo will be in london on the 19th and 20th October 2011.

.

Create a free website or blog at WordPress.com.

Up ↑

%d bloggers like this: