|
|
iTWire: So, when it comes to Cloud Computing - do we have enough security?
Callas: No, we don't have enough security.
Do I think that we're going to get enough security eventually? Yes, but it's going to be not as quick as we would like.
I'm one of the people who started the Cloud Security Alliance. Where when Cloud Computing started getting trendy a few years ago we said let's have a lot of us get together and start talking about what Cloud security needs now. Because we built the Internet and then said, "oh look at that, isn't it pretty, gosh I think we need to secure it."
So, we have been discussing the sorts of security that Cloud systems need now, before it gets built and we end up with a completely unreliable system than before. There are lots of successes in Cloud security from the simple fact that nobody says, "I would never use
So the basics are there and they're pretty good from the infrastructure standpoint. There are other things that we just haven't gotten around to. For example one of the goals of Cloud Computing is that you ought be able to take a virtual machine that is running in one part of the world and just pick it up and move it to another part of the world where power is cheaper, the network is a little faster etc.
Nobody has really been discussing what you do about the virtual machine image that you deleted. And this is one of the things that I've been talking about from the very start and said that well, what you really want to do is you want to encrypt that disk image and then just throw away the key when you move it and then you don't have to worry about it any more. And nobody is addressing that. None of the Infrastructure as a Service / Platform as a Service people are looking at that. That's a problem that somebody needs to solve because it's a big glaring thing.
