Government IT's Move to Cloud Slowed by Security Concerns, Misconceptions
- 25 January, 2013 22:44
High among the barriers to the adoption of cloud computing in the government sector, right alongside concerns over security and cross-border issues, is a general confusion about what, exactly, the cloud means, according to a group of panelists speaking here at the annual State of the Net technology policy conference.
"Cloud is well-defined," says Robert Holleyman, president and CEO of the software trade group BSA. "But cloud is not well understood among policymakers."
Cloud computing has been a hot topic among federal CIOs and their staffers in recent years, and the Obama administration has promulgated a so-called cloud-first policy, directing agencies to prioritize cloud-based solutions as they roll out new IT initiatives.
But for the cloud to be broadly understood as more than a buzzword outside of IT circles, advocates of the technology should focus on the benefits that cloud computing can provide, particularly for cash-strapped government agencies working under shrinking budgets.
"It's important that we start with mission areas that are affected by cloud, as opposed to technology, because at the end of the day it's how cloud can ... be more efficient to help in different types of mission areas both for the government and for society," says Dan Chenok, executive director of IBM's Center for the Business of Government.
Healthcare Particularly Leery of the Cloud
Other panelists described the lingering reservations about shifting to the cloud that many industry leaders continue to harbor. In healthcare, for instance, there is a "high degree of misinformation about what cloud is and what it isn't," according to Deven McGraw, director of the Health Privacy Project at the Center for Democracy and Technology, a Washington digital rights group.
Slideshow: Top Challenges Facing Healthcare CIOs
McGraw explains that healthcare providers, generally, are behind the curve when it comes to adoption of cloud computing, in part because of a widespread confusion about what information under law is permitted to reside in off-site data centers.
"Healthcare also has an issue of uncertainty and this issue of control," McGraw says. "I think it's a very scary proposition for a lot of healthcare providers to think about having their data management functions not within their four walls. They're responsible for that data, they know that, and the idea that they would cede that, some portion of that, to somebody else and yet still be liable for those decisions is very scary."
The information that health providers maintain is, of course, particularly sensitive, but concerns with cloud computing over privacy and security are common across industries and in government. At the federal level, CIOs have developed a uniform set of standards for certifying cloud providers.
The Federal Risk and Authorization Management Program, or FedRAMP, is intended as a repeatable certification process, so once a vendor has been awarded the credential, CIOs across the government would have the confidence to deploy its technology within their departments and agencies.
Security Concerns Overrated
The security concerns surrounding the cloud are also to some degree a problem of perception, according to Chenok, who counsels federal CIOs that the real issue of security turns on the implementation of a cloud deployment.
"The cloud itself isn't inherently more or less secure, at least in my view ... than other forms of computing. You can implement a mainframe really well or really badly and create lots of holes. And you can implement a cloud scenario really well with lots of continuous monitoring points and real-time response and patching that's done in real time, et cetera, or you can do it poorly," Chenok says. "The cloud has properties that can lend great security to any transaction--health, education, consumer transaction, government transaction."
Additionally, there is an ongoing effort in Congress to rewrite a 1986 privacy law to provide additional legal protections to documents and communications such as Web-based email that are stored in the cloud.
Earlier this month, Sen. Patrick Leahy (D-Vt.) said that he intends to reintroduce legislation to revise the Electronic Communications Privacy Act (ECPA) to require law-enforcement authorities to obtain a warrant from a judge before they can compel a cloud-service provider to release remotely stored emails that are more than six months old, among other reforms.
Kenneth Corbin is a Washington, D.C.-based writer who covers government and regulatory issues for CIO.com.
Read more about government in CIO's Government Drilldown.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
Queensland government to provide 200 services online by 2015
Call Centers Suffer From Big Data Overload
CIO 100: Carsales wins top gong for innovation
How to secure passwords and other critical numbers
Australian National University streamlines IT
Protect 500 VMs in 17 Minutes
Modern trends in IT are changing how data centres are being designed and managed. Data centres continue to evolve from an environment based on physical servers and storage to one based on virtualization platforms. Data management solutions need to evolve and adapt to these shifts. This white paper discusses how new software can provide unprecedented scale and server consolidation capabilities in evolving a cloud based data centres, providing the automation, flexibility and scale needed to meet increasingly challenging business needs.
Leadership and technology: Mobility and BYOD insights for midmarket enterprises
BYOD trends are putting pressure on IT departments to support all personal mobile devices in all work spaces, while Analysys Mason forecasts that revenue from mobility for mid-market enterprises will grow to US$79 billion by 2018. This white paper looks at the power of mobility as part of a unified communications (UC) platform; the competing interests of IT departments, and why vendors supplying these solutions are well prepared to meet the needs of mid-market enterprise technology and business challenges.
The Critical Need for Edge Data Protection
Many firms are acutely aware of the risks associated with lost or unrecoverable data on employee devices, including desktops, laptops and mobile devices. Companies simply cannot overlook the consequences of public exposure that would likely result if sensitive data is lost, stolen, compromised or cannot be located. This white paper explores the challenges associated with safeguarding data and opening up universal access for distributed desktop and laptop systems residing at the edge of an organization's IT infrastructure.