The Open Group Enters Cloud Security Debate

Software as a Service (SaaS) seems to be gaining some momentum and popularity over traditional methods of network services and security. But there remains an inherent concern around the security of services in the cloud. Network World reported this week that the Open Group has formed a subgroup to develop standards that promote effective and secure use of cloud computing technology and services.

From the article:

There are already several other industry efforts toward addressing identifiable issues with cloud deployments and services, but this latest is trying to make a unique contribution.

While other efforts look at cloud architecture and try to address technology concerns, Open Group’s Cloud Work Group is looking first at what businesses need from cloud providers, then creating standards that can help meet those needs.
With such standards established, it will become easier for businesses to sort out cloud services by finding those that do and do not meet those standards.

For example the group is looking at cloud security. First it sets the business implications of security breaches – misuse of confidential data and the loss of customer good will.

Then it looks at how cloud services might help alleviate those pain points. Transferring responsibility of security to a provider frees up corporate resources and may result in more secure infrastructure because providers have more expertise and resources to focus on the problem than a business might.

The requirement is for providers to secure their services and guarantee performance via service level agreements.
The group will work on standards that address these requirements and others such as risk management, cost and business agility. Its goal is to write a document called a Business Scenario for Enterprise Cloud Computing that will sum up its findings and recommendations. Because of the approach The Open Group is taking with this initiative, it could produce a sharply focused set of recommendations.