Security as an Inhibitor to Cloud Adoption

"50% of executives stated that security concerns were the key inhibitors of cloud services usage" says a recent report by IDC.

Taking on this central concern brought Dominik Brugger, Erik Rüger, Marcus Breuer, Thorsten Mühge, Itzack Goldberg and Matthias Seul together - working cross-team, cross-division and even cross-geography. As Cloud is one of IBM's central business plays it was obvious that creating trust in the safety of data wherever it may be was the key to solving the issue.

No Easy Task

There was a lot to take care of:

- How do we protect confidential data from being stored off-site unencrypted?

- How do we secure content not only during transport but also at rest? - How do we give back control over cloud data to customers?

And first and foremost:

- How do we solve all these issues without requiring large changes to the existing infrastructure?

Thankfully the individual team members had very diverse backgrounds in Security, Cloud Operations, Encryption, Content Intelligence and Software Architecture. We first started by examining how users interact with the Cloud Systems and where data is located at a given point in time. We also examined which party can influence which part of the interactions.

Discoveries

The first and most important discovery was that all of the actions necessary had to happen transparently. The involved systems should not know additional security had been introduced.

The second discovery was that power needs to be located with the customers, not the service offering. This for example meant that we needed to find a way to establish secure key management.

The third discovery was that security has to begin at the origin, meaning with the customer. It's not enough for a service to care about security after receipt of the data. This caused us to implement auditing while establishing data transport.

Outcomes

Combining our knowledge, talent and passion for Cloud and Security we were able to file patents for both a Transparent En-/Decryption Gateway for Cloud Storage Services and a System for Automated Classification, Management and Control of Confidential Information in Cloud Environments.

This was just another example of IBMers coming together to make the world a little bit better - and safer. :)