Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Government IT's Move to Cloud Slowed by Security Concerns, Misconceptions

High among the barriers to the adoption of cloud computing in the government sector, right alongside concerns over security and cross-border issues, is a general confusion about what, exactly, the cloud means, according to a group of panelists speaking here at the annual State of the Net technology policy conference.

"Cloud is well-defined," says Robert Holleyman, president and CEO of the software trade group BSA. "But cloud is not well understood among policymakers."

Cloud computing has been a hot topic among federal CIOs and their staffers in recent years, and the Obama administration has promulgated a so-called cloud-first policy, directing agencies to prioritize cloud-based solutions as they roll out new IT initiatives.

But for the cloud to be broadly understood as more than a buzzword outside of IT circles, advocates of the technology should focus on the benefits that cloud computing can provide, particularly for cash-strapped government agencies working under shrinking budgets.

"It's important that we start with mission areas that are affected by cloud, as opposed to technology, because at the end of the day it's how cloud can ... be more efficient to help in different types of mission areas both for the government and for society," says Dan Chenok, executive director of IBM's Center for the Business of Government.

Healthcare Particularly Leery of the Cloud

Other panelists described the lingering reservations about shifting to the cloud that many industry leaders continue to harbor. In healthcare, for instance, there is a "high degree of misinformation about what cloud is and what it isn't," according to Deven McGraw, director of the Health Privacy Project at the Center for Democracy and Technology, a Washington digital rights group.

Slideshow: Top Challenges Facing Healthcare CIOs

McGraw explains that healthcare providers, generally, are behind the curve when it comes to adoption of cloud computing, in part because of a widespread confusion about what information under law is permitted to reside in off-site data centers.

"Healthcare also has an issue of uncertainty and this issue of control," McGraw says. "I think it's a very scary proposition for a lot of healthcare providers to think about having their data management functions not within their four walls. They're responsible for that data, they know that, and the idea that they would cede that, some portion of that, to somebody else and yet still be liable for those decisions is very scary."

Slideshow: 13 Healthcare IT Trends and Predictions for 2013

The information that health providers maintain is, of course, particularly sensitive, but concerns with cloud computing over privacy and security are common across industries and in government. At the federal level, CIOs have developed a uniform set of standards for certifying cloud providers.

The Federal Risk and Authorization Management Program, or FedRAMP, is intended as a repeatable certification process, so once a vendor has been awarded the credential, CIOs across the government would have the confidence to deploy its technology within their departments and agencies.

Security Concerns Overrated

The security concerns surrounding the cloud are also to some degree a problem of perception, according to Chenok, who counsels federal CIOs that the real issue of security turns on the implementation of a cloud deployment.

"The cloud itself isn't inherently more or less secure, at least in my view ... than other forms of computing. You can implement a mainframe really well or really badly and create lots of holes. And you can implement a cloud scenario really well with lots of continuous monitoring points and real-time response and patching that's done in real time, et cetera, or you can do it poorly," Chenok says. "The cloud has properties that can lend great security to any transaction--health, education, consumer transaction, government transaction."

Additionally, there is an ongoing effort in Congress to rewrite a 1986 privacy law to provide additional legal protections to documents and communications such as Web-based email that are stored in the cloud.

Earlier this month, Sen. Patrick Leahy (D-Vt.) said that he intends to reintroduce legislation to revise the Electronic Communications Privacy Act (ECPA) to require law-enforcement authorities to obtain a warrant from a judge before they can compel a cloud-service provider to release remotely stored emails that are more than six months old, among other reforms.

Kenneth Corbin is a Washington, D.C.-based writer who covers government and regulatory issues for CIO.com.

Follow everything from CIO.com on Twitter @CIOonline, on Facebook, and on Google +.

Read more about government in CIO's Government Drilldown.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: BSA, Facebook, Google, IBM, Technology
Comments are now closed.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: IBM, federal IT, cloud security, business, Management Topics | Government, internet, Federal CIO, cloud computing, government, Management Topics, BSA, Cloud, security
Latest Blog Posts
Whitepapers
  • Why you should be re-thinking your approach to data protection
    Organisations of all shapes and sizes need a new approach to data protection that addresses the challenges of data growth, but IT budgets are not keeping pace with the escalating costs of supporting storage requirements. This whitepaper explores how securing and retrieving organisational data will need to be done more efficiently.
    Learn more »
  • Information Management
    Valuable data can be a needle in a haystack, but by leveraging the value in existing information assets, organisations can generate real and achievable gains in revenue generation, IT investments and productivity gains. This whitepaper discusses how Information Management (IM) is a multi-faceted discipline that can be employed to meet or exceed your business objectives.
    Learn more »
  • The F5 DDoS Protection Reference Architecture part 1 of 3
    Distributed denial of service attacks (DDoS) attempt to make a machine or network resource unavailable to its intended users, with a wave of crippling attacks on enterprises since 2012. This whitepaper offers guidance to security and network architects in designing, deploying, and managing architecture to protect against increasingly sophisticated, application-layer DDoS attacks.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Latest Jobs
Salary Calculator

Supplied by

View the full Peoplebank ICT Salary & Employment Index

Recent comments