Identifying the security risks associated with governmental use of cloud computing

Abstract

Cloud computing, which refers to an emerging computing model where machines in large data centers can be used to deliver services in a scalable manner, has become popular for corporations in need of inexpensive, large scale computing. Recently, the United States government has begun to utilize cloud computing architectures, platforms, and applications to deliver services and meet the needs of their constituents. Surrounding the use of cloud computing are many risks that can have major impacts on the information and services supported by this technology. This paper discusses the current use of cloud computing in government, and the risks–tangible and intangible–associated with its use. Examining specific cases of government cloud computing, this paper explores the level of understanding of the risks by the departments and agencies that implement this technology. This paper argues that a defined risk management program focused on cloud computing is an essential part of the government IT environment.

Introduction

Cloud computing, which allows for highly scalable computing applications, storage, and platforms, is increasing in importance throughout government information technology (IT) strategy. Cloud computing providers offer a variety of services to individuals, companies, and government agencies, with users employing cloud computing for storing and sharing information, database management and mining, and deploying web services, which can range from processing vast datasets for complicated scientific problems to using clouds to manage and provide access to medical records (Hand, 2007). Recently, President Barack Obama and Chief Technology Officer (CTO) Vivek Kundra have both expressed the vision to explore the cloud as a key component in the federal IT transformation, and therefore agency use of cloud computing capabilities has increased (Jackson, 2009, Miller, 2009b).

Although many benefits are reported in cloud computing use, a great deal of risk is associated with the implementation, management, and use of cloud computing technologies. In a government context, both tangible risks (such as the risk of unauthorized access, infrastructure failure, or unavailability) and intangible risks (such as confidence in the technologies capabilities, and public access) are introduced along with the functionality and benefits provided by cloud applications. The government's ability to manage these risks will be a key determinant in the success of cloud computing.

This paper discusses the nature of cloud computing and risk management in a governmental context. The risks associated with cloud computing are identified, focusing on both the tangible and intangible risks which can present challenges for IT management. We argue that much evidence exists that cloud computing has become a strategic direction for many government agencies and is already employed in critical areas of the government's IT infrastructure. However, a prudent and in-depth risk management program must accompany the use of this new technology in order to prevent unwanted technical consequences, and even greater problems from a government information management perspective.