[infoworld.com] The dangers of cloud computing

Extrait de l'article du site par en date du :

« ''Info World By Ephraim Schwartz July 07, 2008'' http://www.infoworld.com/article/08/07/07/28NF-cloud-computing-security_...
The idea of cloud computing -- designed around an architecture whose natural state is a shared pool outside the enterprise -- has gained momentum in recent months as a way to reduce cost and improve IT flexibility. But the use of cloud computing also carries with it security risks, including perils related to compliance, availability, and data integrity.
Yet many companies don't think through those risks upfront. For example, having proper failover technology in place is a component of securing the cloud that is often overlooked, notes Josh Greenbaum, principal at Enterprise Applications Consulting. Yet these same companies make sure they have failover for established services, like electricity. 'If you look around, go to any major facility, what is sitting in a box outside is an alternative power supply. They don't rely on just the grid,' says Greenbaum. He argues that cloud computing should be no different.
[ For more news on developments in cloud computing, see InfoWorld's special report ]
In some cases, the risk is too great to rely on the cloud. And where the decision is made to put some services and applications in the cloud, the business must ask how that risk should be managed.
David Cearley, a vice president and fellow at Gartner, says placing limits on the use of cloud technology is a subtle issue that companies have to examine closely, measuring the risk against when and where cloud computing can be effective. For example, by giving up some control over the data, companies get in exchange cost economies. IT, along with other C-level executives, must decide if that trade-off is worthwhile. Cearley says that everything will eventually be available as a cloud service -- but at any individual business, not everything will be accessed from the cloud.
'In a shared pool outside the enterprise, you don't have any knowledge or control of where the resources run. So if you have a concern over data location, as an example, that may be a reason for not using it,' Cearley says.
Security standardization has not come to the cloud
There is a huge body of standards, including services like SAS Interaction Management, for example, that apply for IT security and compliance, governing most business interactions that will, over time, have to be translated to the cloud, notes consultant Greenbaum.
But in the meantime, until security models and standards emerge for cloud computing architecture, most of the risk and blame if something goes wrong will fall directly on the shoulders of IT -- and not on the cloud computing service providers. 'The Salesforce.coms and NetSuites of the world don't offer the kind of governance, risk, and compliance [mechanisms] mandated by regulatory regimes,' Greenbaum says. »

Lien vers l'article original :

Cette revue de presse sur Internet fait partie du travail de veille mené par l'April dans le cadre de son action de défense et de promotion du logiciel libre. Les positions exposées dans les articles sont celles de leurs auteurs et ne rejoignent pas forcément celles de l'April.

Les articles de presse utilisent souvent le terme « Open Source » au lieu de Logiciel Libre. Le terme Logiciel Libre étant plus précis et renforçant l'importance des libertés, il est utilisé par l'April dans sa communication et ses actions. Cependant, dans la revue de presse nous avons choisi de ne pas modifier les termes employés par l'auteur de l'article original. Même chose concernant l'emploi du terme « Linux » qui est généralement utilisé dans les articles pour parler du système d'exploitation libre GNU/Linux.

Retour à la page des revues de presse.