In which I am convinced that Cloud computing is evil

I have been to the a couple of sessions at CSI over the last two days. The conference is good overall, it appears to be well organized and the speakers have been engaging. Today, I attended a session called The Fate of the Secure OS. There was discussion about many topics including arcane, outdated and poorly supported operating systems. Some discussion about maintaining configuration and keeping your users informed. But there was also a presentation on ... Cloud Computing and Virtualization.

Up until this afternoon, I didn't think that it was more than a hassle that had to be dealt with. I knew the obvious drawbacks when it came to incident handling or things like “where is my data actually stored”. I saw a presentation by Dennis Murrow of ConfigureSoft and things got really scary.

I wish I had the slide deck to make all the points, the short version of a series of questions posed to a fictional SOA/SaaS provider:

Where is my data and how are you managing it (backups, access controls, auditing, etc)?

If I choose to leave you as customer, can I get my data back and what condition will it be in?

How is the underlying hardware, hypervisor, operating systems and applications maintained and operated?

What are your policy baselines and vulnerability remediation procedures?

The list went on. To many, this is most likely old news. Judging by the way that oxygen left the room, many people seemed to be just realizing these issues. The speaker was also able to present this information in a way that didn't appear to be coming across as FUD. It just seemed like a logical progression of things to consider before ... you know ... sending your confidential, proprietary data into the ether.

After the session, many had sworn off the idea of putting their data in a cloud computing environment. There may have been a few management types that still clung to the idea that outsourced data processing and storage was a good idea.

My end takeaway is this there is no risk that anyone in their right mind can accept here, there is no assurance evidence that could make me believe that in 2008 (and probably into 2009) that cloud computing is a good idea. I could almost see that you could sell “auditor me” on virtualizing a couple servers. But the jury is still out on that one. For now, I'm with Hoff. Cloud computing needs to come along further before I can get on board, anyone considering it ... should wait until some improvements come along.