The Cloud allows the procurement of IT services from both internal and external suppliers to be opti-mized because the services are delivered through the Internet in a standard way. The Cloud is not a single model but covers a wide spectrum from applications shared between multiple tenants to virtual servers used by one customer and hosted internally. The information security risks associated with Cloud computing depend upon both the service model and the delivery model adopted. The common security concerns across this spectrum are ensuring the confidentiality, integrity and availability of the services and data delivered through the Cloud environment. For an overview of Cloud Computing see Kuppinger Cole Research Note #70140 “Cloud Computing Overview”.
The approach to managing risks from the perspective of the Cloud service user is one of due diligence – ensuring that the requirements are clearly understood, the risks are assessed, the right questions are asked and the appropriate controls are included in the service level agreements...
