New Report: Security Benefits - Yes Benefits! - And Risks Assessed By Leading Industry Experts

A group of leading industry experts has lent their time and knowledge to create a detailed document covering the "benefits, risks and recommendations for information security" with regards to cloud computing. Published by the European Network and Information Security Agency (ENISA), which works under the auspices of the European Union, the report is a must-read for any business or IT professional with an interest in cloud computing, especially those tasked with evaluation or implemeting cloud-based services.

The report starts with a clear agenda and purpose:

"The key conclusion of this paper is that the cloud’s economies of scale and flexibility are both a friend and a foe from a security point of view. The massive concentrations of resources and data present a more attractive target to attackers, but cloud-based defences can be more robust, scalable and cost-effective [my emphasis]. This paper allows an informed assessment of the security risks and benefits of using cloud computing - providing security guidance for potential and existing users of cloud computing".

The report was written by experts from British Telecom, Cloudsecurity.org, IBM, Google, Microsoft, RSA and Symantec, among others. It takes a fairly complex subject and manages to make it readable from beginning to end. Concepts, terms and recommendations are explained well and with relevancy. A good deal of information and facts are provided to make the case for the security benefits of cloud computing. (This section alone should be required reading for everybody.) Use-case scenarios are used to analyze risk assessment for enterprise customers, service resilience, and a government agency. Finally, ENISA ends the paper with a host of recommendations across the full spectrum of cloud-based offerings (i.e. software, platform and infrastructure) and it includes recommendations on legal and governance issues.

You can download the free report directly from the ENISA web site.