Cloud Computing: Risk and Value are Two Sides of the Same Coin

For every report that comes out with research pointing to cloud computing as the new IT panacea for enterprises, is a report with an opposing point of view.

The "he said, she said" nature of some of these reports is reminiscent of the early days of "SNL" and the "Point-Counterpoint" parody made famous by Danny Akyroyd and Jane Curtin. "Jane, you ignorant, misguided ...." .."Dan, you pompous ...."

Ok, perhaps the landscape isn't that contentious -- at least, not yet.

The latest report highlighting the unease many senior IT execs have with cloud computing comes out of ISACA, a U.S.-based organization for information governance, control, security and audit pros. It boasts 86,000 members in 160 countries, so its influence is far and wide. The ISACA tackles the cloud computing question in its first annual ISACA IT Risk/Reward Barometer survey and examines the results in a white paper it collaborated on with the Cloud Security Alliance. Of the 1,809 U.S.-based IT survey pros who took part in the survey, many work for Fortune 500 companies across engineering, financial services, education and health care. And most, apparently, are far from ready to take the cloud computing plunge.

Two key findings:

• only 10% of respondents' organizations plan to use cloud computing solutions for mission-critical IT services, and


• one in four respondents said their organizations have no plans to use cloud computing for any IT services at all.

So even during this extended period of lean IT budgets, a period when CIOs are stretching their IT imaginations and IT staffs, a solution that is battled-tested in many areas is still in the proving phase for many organizations.

In the view of so many IT pros, cloud computing "just ain't there yet." On the other hand, market research firm IDC is saying that spending on cloud computing services will represent more than $44B in IT spending within three years and will outpace spending on traditional IT solutions through 2015.

"The bottom line is people are scared. Companies have failed spectacularly at this model," said Brian Barnier, a member of the ISACA risk IT development team.

Although nearly half of the IT pros participating in the survey are not sold on cloud computing for mission critical data, Robert Stroud, who doubles as international VP at ISACA and head of the service management business unit at CA, Inc., says IT pros need to remember that "risk and value are two sides of the same coin.

"If cloud computing is treated as a major governance initiative involving a broad set of stakeholders, it has the potential to yield benefits that can equal or outweigh the risks," added Stroud.

In a related side note, many of the IT pros said employees put their company at risk levels that exceed the risk of using cloud computing services. Fifty percent of the respondents said their organization's employees do not protect confidential data appropriately, for example.

I think the cloud could do better than that.