The Security Advantages of Cloud Computing Revisited

Over seven years ago, we co-authored a little-noticed article about the “Security Advantages of Cloud Computing.” We said then that “the benefits of the cloud can be affordably attained in a way that does not jeopardize an organization’s security.”

At the time, we thought this was boldly radical, but it landed with a big thud. Many cybersecurity pros, and especially those in the government, were skeptical of our conclusions.

Since then, as cloud security has become much more widely appreciated, we have occasionally mentioned this opinion piece with great pride, noting that we were ahead of the curve in promoting the security of the cloud—even if few read it or believed us. Looking back, we realize we actually understated the case for cloud security.

Our article focused on how the cloud could be more secure for small to mid-sized companies, implying by omission that maybe the cloud isn’t secure enough for big, complex companies, much less federal agencies. Nothing could be further from the truth. More importantly, events have clearly proven that we failed to predict how organizations with extremely sensitive data could and would rely on the security of the cloud.

Admittedly, predicting business and especially technology trends can often be very difficult. This is particularly true with respect to developments in cybersecurity, where both threats and solutions are in a constant state of evolution. Cloud security and, equally important, acceptance of cloud security, rapidly evolved in the years after we wrote that article.

Changing Opinions on Cloud Security

For example, in 2015 cloud expert David Linthicum suggested that cloud providers had done a better job with security than on-premises systems “both because they have to and because their newer technology makes it easier for them to do so. IT should be taking advantage of that cloud security focus, not ignoring it.”

Subsequently, a survey conducted in June 2017 showed that confidence in cloud security among IT decision-makers had grown by 74 percent since 2015. The following spring, Gartner projected that public cloud infrastructure-as-a-service workloads would experience at least 60 percent fewer security incidents through 2020 than those in traditional data centers.

Today it is clear that the cloud can be secure for large enterprises—even for those who operate with sensitive or classified information. The watershed moment for this awareness in the public sector occurred in 2013 when the CIA chose Amazon Web Services to stand up an isolated AWS region dedicated to the intelligence community.

This was an earth-shaking event for those of us in the cybersecurity field. Here was the CIA, quite possibly the most security-conscious organization in the world, both recognizing that it needed help from the private sector, which had taken the risks to develop innovative secure solutions, and trusting those commercial solutions with its highly sensitive data.

The IC not only migrated its systems and data to the cloud, it embraced the results. Speaking June 20, 2018 at the AWS Public Sector Summit in Washington, D.C., Sean Roche, associate deputy director of the CIA’s Digital Innovation Directorate, summed up the agency’s view of cloud security when he said that “the cloud on its weakest day is more secure than a client service solution.” 

No Doubts About Cloud Security

This really raises the question: Why would any federal agency, particularly one entrusted with intelligence or national security, cling to a less secure solution?

The IC very pleased with the results of this partnership and with the C2S environment and other agencies have taken notice of its success. Secretary of Defense James Mattis told the House Armed Services Committee April 12, 2018 that Defense Department has “examined what CIA achieved in terms of … security of their systems, and it’s very impressive.”

This really was a game changer for the IC, and it is having reverberations throughout the federal space. Many government IT leaders now understand the greater security of cloud and its ability to improve services. President Trump has given strong direction to agencies to move to the cloud wherever possible. Through his 2017 cybersecurity executive order, the December 2017 “Report to the President on IT Modernization,” the Office of Management and Budget’s 2018 Federal Cloud Computing Strategy (Cloud Smart), and other actions, the White House has clearly indicated that it is serious about getting the best value and the most secure cloud solutions possible, and doing so without delay.

In 2018, we are seeing agencies migrate to the cloud in ever-greater numbers, consistent with the Trump administration’s direction that agencies “improve contract vehicles to enable agencies to acquire commercial cloud products that meet government standards.” While it’s gratifying that our original premise from 2011 has been borne out well beyond our modest projections, it’s even more important that enterprises of all sizes in government and in all commercial sectors are now realizing the security, efficiency and productivity advantages of moving to the cloud.

John B. Wood is the chief executive officer and Rick Tracy is the chief security officer of Telos Corp.