1) Threats and risks to cloud computing include malicious insiders abusing resources, resource shortages if demand isn't accurately predicted, and loss of direct control over systems which are restricted by the cloud provider's specifications. 2) Data loss or leakage is a risk if important customer data may travel worldwide without knowledge of where it is physically located or consent for international data placement. 3) Additional unknowable risks exist since customers may not be aware of technical issues like complex architectures or business risks such as new laws until problems occur. Thorough due diligence is required to select the best cloud provider and determine if cloud computing is actually needed.

1. Threats and Risks to Cloud Computing
April, 2011

2. Threats and Risk #1 Malicious Insiders
Abuse and nefarious users may be next to you
For Could Customer For Could Provider
Many other users in same cloud More difficult to identify the CC
Spammer Increase personal users
Cracker Auto application on WEB
Botnet Commander With no credit, no validation process
Normal users with low security literacy Separate each resources for each CCs in virtual
Be affected from malicious users How does CC resources be separating?
Confiscation of resources due to neighbor How does each CCs keep independency?
activities How is it proven?
Hardware resources Need to prepare for incident
Network resources (A range of IP , Traffic) How do malicious users keep out?
Damage to business reputation How does CP detect the incident?
Direct attacking by malicious cloud customer How does CP make response to incident?
Steal secret data within shared storage
Malware spreading
Virus chain infection
Page 1

3. Threats and Risk #2 Resource Shortage
“Prediction of demand“ and “planning Cloud Service expantion“
For Could Customer For Could Provider
Controlling resources is up to CP How do you predict demand?
How does CC verify stock of cloud resources? When do you decide to expand cloud resources?
That’s impossible Surplus stock is nightmare
Cloud is invisible market demand is changing very rapidly
Unpredictable demand
Have you conceived ever?
CP may say “No” when you order new resources Does CP’s infrastructure expand permanently?
CP may say “Too much traffic” How about design of infrastructure?
How about capacity of traffic?
Page 3

4. Threats and Risk #3 Loss of direct control over systems
System design is ristricted by cloud‘s specification
For Could Customer For Could Provider
Need to know what is restricted by CP How does CP make response to CC request?
Network Design Requirement to SLA
Hardware spec Guarantee to MTBF , MTTR
Capacity of storage (NAS, DAS, SAN …etc.)
Connectivity between office and cloud One cloud One regulation
Difficult to commit Special accord with CC
CC can not adjust corporate governance to Cloud
SLA , SLO Does CP’s infrastructure expand permanently?
MTBF , MTTR How about design of infrastructure?
How about capacity of traffic?
Page 4

5. Threats and Risk #4 Data Loss or Leakage
Your important data may be traveling around the world
For Could Customer For Could Provider
Security connection with Cloud CC data is depend on CP
Encrypt and protect data In the case of termination or failure
Strong API access control CP has to know how to protect CC data
CP has to know how to restore CC data
Backup and replicate data
No tape drive on Cloud, Of course ! What does CP do when CC data leak or lost?
Disk to disk data backup is mainly method Responsibility of data protection
Backup data is on same cloud space? Contract sentence about data
Cloud to Cloud backup
CP should not know what data is
Recent Cloud has location free architecture Its data placement worldwide is legality?
Can’t specify the physical location of data Patent information
In US , Europe , Asia or … ? Personal information
In China ? It’s not impossible Government information
Secret data may travel around the world Can CP do data placement without consent?
Page 5

6. Threats and Risk #5 Unknowable Risks
You don‘t know what you don‘t know
For Could Customer For Could Provider
Which Cloud is the best to adapt your requirement? Technical risks
No efficient guideline to select CP Various third party product in Cloud
Service continuity Insufficient validation
Administration stability Complex architecture
Cost performance effectiveness
No methods to compare Clouds Business Risks
Virtual resources performance New law to affect CPs
Seamless connectivity USA PATRIOT Act …etc
Sufficient scalability Price competition
Cloud scale competition
To begin with, do you really need Cloud?
Utilizing Cloud is not one way but one of many
Judge calmly without swaying by trend
Page 6

7. If you do not know where you are going ,
every road will get you nowhere
Henry Alfred Kissinger
Page 7