Clouds and their discontents

Abstract

Cloud computing has become increasingly popular and important. Many companies have policy initiatives encouraging or even mandating the use of "cloud" computing. The popularity of cloud computing stems primarily from the hope for significant cost savings but also from the ability to scale quickly without large capital expenditures and efficient sharing and curation of very large data sets (for example, search indexes). Clouds, like distributed computing generally, also offers the ability to access data and resources from any connected device (increasingly mobile devices like smart phones and lightweight tablets like iPads). However, cloud computing in all its incarnations (Infrastructure as a Service, Software as a Service, Platform as a Service) raises a number of security questions that current providers have not addressed (or remain ominously silent about): increased susceptibility to insider attacks due to concentration of valuable data, "fate-sharing" and other vulnerabilities due to multi-tenancy, policy issues arising from multi-jurisdictional siting, vulnerabilities arising from scale operations, the opacity of cloud operators security practices and disclosure of interruption of operations or attacks. Despite these potential issues, cloud computing can be beneficial with judicial and transparent application of some simple security principles. We discuss cloud infrastructure, economics, operations and security infrastructure desiderata.