Cloud Computing Has Silver Lining for Government, Security Expert Says

16 February 2011 | 02:35 PM ET | Matt Liebowitz, SecurityNewsDaily Staff Writer

The White House’s decision this week to move most of the federal government’s data to cloud servers is ultimately a smart choice, one that will ensure the protection of that sensitive information, a security expert said.

On Monday (Feb. 14), U.S. Chief Information Officer Vivek Kundra told the audience at the Cloud Security Alliance Summit in San Francisco that the government’s Federal Cloud Computing Strategy plans to shut down 800 data-storage centers by 2015, and move the data in them to the cloud — the vast network of Internet-based processing and storage servers.

Catalin Cosoi, head of online threat labs at the Romanian security firm BitDefender, supports the move.

Safety in the cloud.

"One advantage [of storing government data in the cloud] would be that if information is kept in a single centralized place, different security experts can take all security measures to keep it safe, and eliminate the risks posed by employees with less technical skill,” Cosoi told SecurityNewsDaily.

Although there are inherent risks to storing sensitive information anywhere — whether in physical data centers or cloud servers — Cosoi suggested government information technology officials can mitigate those dangers by using encrypted connections and different levels of security clearances and encryptions for different types of information.

As an added security measure, he suggested, government agencies could “reject all outdoor connections” and enable access to cloud servers only from within a specific agency.

Redundancy, redundancy, redundancy

Another reason, Cosoi said, is that “no matter what happens to your computer, you know that there is an up-to-date copy somewhere in the cloud. You also get to access your data from anywhere in the world, without being tied down to just a few computers.”

The cloud is a suitable home for U.S. government data because agencies can consolidate and share large amounts of information.

In order to avoid the trap of keeping all your eggs in one basket, Cosoi said it will be crucial for the government to distribute data on multiple machines and cloud servers, and to encrypt all of it.

The only foreseeable problem, Cosoi said, is that cloud infrastructures are susceptible to denial-of-service attacks, whereas traditional data centers are not. Preventing such attacks against high-risk data in the cloud will again come down to how tightly the government controls access to its cloud servers.

In the case of the government, Cosoi said “these issues will be addressed thoroughly right from the beginning.”

Chris Palmer, technical director for the Electronic Frontier Foundation, added a point that, despite its simplicity, addresses the heart of any discussion about sensitive data.

“Super-sensitive stuff should be off the Internet completely,” Palmer told SecurityNewsDaily. “This basic network security fact is often forgotten.”

Would you like to subscribe to our weekly newsletters?