News

U.S. IT Pros Concerned About Cloud Security

• By Jabulani Leffall
• April 7, 2010

Nearly half of U.S. IT professionals canvassed in a survey released today believe that the operational and security risks of cloud computing outweigh its benefits.

That finding comes from the first annual "IT Risk/Reward Barometer" report by ISACA, or Information Systems Audit and Control Association. The ISACA is a trade group consisting of enterprise IT administrators and IT audit specialists.

Despite the hype and enthusiasm surrounding cloud computing, many working in the enterprise space are still wary of adopting the technology, according to the March ISACA survey, which tapped into the opinions of more than 1,800 IT pros.

About 45 percent of respondents said that the security risks of a cloud scenario, at least in the short term, exceed the operational benefits. Only 17 percent were bullish on cloud computing. The remaining 38 percent indicated that they thought the risks were appropriately balanced. 

But the report dug deeper. Only 10 percent of respondent organizations plan to use cloud computing for mission-critical IT services. Moreover, one-fourth of the respondents, or 26 percent, do not plan to use the cloud at all.

"The cloud represents a major change in how computing resources will be utilized, so it's not surprising that IT professionals have concerns about risk vs. reward trade-offs," said Robert Stroud, vice president of IT service management and governance for the service management business unit at CA Inc.  

Money concerns may also serve as a check. The cloud represents a new untested venture for many IT shops amidst a general economic downturn. The survey backed up this assertion. Budget limits were considered to be the greatest hurdle to addressing security and business process risks according to 44 percent of respondents.

Cloud computing was one theme of the ISACA's survey, but there were other notable results. For instance, the report found that 50 percent of respondents think their employees do not protect confidential work data appropriately.