Cloud Computing Risks, Benefits, and Risk Management Strategies

Introduction and Situational Analysis

The world of information technology (IT) has experienced rapid evolution over the last one and a half decades (Denning & Frailey, 2011). Cloud computing is an innovation that has taken internet-based computing to a level unimagined a few decades ago. As of 2012, the cloud computing market was worth approximately $150 billion — an increase of more than 160% compared to 2009 (Budriene & Zalieckaite, 2012). In today's world, cloud computing provides an unprecedented solution for data storage, data access, data processing, and information sharing. Organizations are increasingly turning to scalable, pay-per-service cloud-based applications such as Amazon Web Services (AWS) and Google Cloud Services to process data efficiently while achieving cost savings (Srinivasan, 2012). With cloud computing, organizations may not need to invest in expensive IT infrastructure (Alijani et al., 2014), which has substantially reduced the cost of acquiring and maintaining IT systems. In addition to cost savings, cloud computing provides flexibility and convenience (Srinivasan, 2013). With the emergence of powerful web-enabled mobile devices such as smartphones and tablets, data can now be accessed at the user's preferred time and location (Markovic et al., 2014).

The use of cloud computing has gained popularity not only among organizations, but also among individuals (Markovic et al., 2014). Today, individuals increasingly rely on cloud-based services to store photos and other personal data such as documents, bill payments, and financial information. Popular cloud storage platforms include Google Drive, Google Docs, Dropbox, iCloud, and Amazon Drive. These platforms enable users to access their data from any geographical location with an internet connection, reducing or eliminating the need for conventional storage media such as compact disks and flash drives.

Whereas cloud computing offers cheaper and more convenient data storage and access, it presents significant security concerns. Privacy breaches, data loss, hacking, identity theft, and other forms of cybercrime have become major concerns in the wake of increased cloud computing adoption and usage (Budriene & Zalieckaite, 2012; Gold, 2012; Abiodun, 2013; Srinivasan, 2013; Neumann, 2014; Ismail, Golamdin & Shahzad, 2016; Rittle, Czerwinski & Sullivan, 2016). Without robust security measures, malicious individuals can access crucial and confidential information, resulting in disastrous consequences for both users and providers.

On its part, the Department of Defense (DOD) acknowledges the risks and security concerns posed by cloud computing. As per the department's Risk Management Strategy (RMS), cloud computing activities must be conducted in accordance with department-wide and federal-level IT security requirements, notably the Federal Risk and Authorization Management Program (FedRAMP) and the Cloud Computing Security Requirements Guide (SRG). Adherence to these guidelines is crucial for safeguarding sensitive information and guaranteeing operational efficiency and mission success.

Though cloud computing offers a powerful tool for DOD, commercial, and public use, it carries substantial security risks that all users must understand and address through a comprehensive risk management strategy. This paper identifies the benefits and risks associated with cloud computing for government (particularly the DOD), commercial entities, and individuals, and examines strategies that can be used to manage those risks.

Key Definitions and Cloud Computing Models

Whereas there is no universally agreed-upon definition, the term cloud computing generally refers to IT infrastructure and services that enable on-demand access to computing resources such as servers, networks, operating systems, and applications (Srinivasan, 2013). Typically, the provider owns and controls the computing infrastructure and services. Customers can access these resources via the internet at a time and location of their convenience, based on a pay-per-use or pay-as-you-go model (Jiang & Wu, 2016). This eliminates the need to own and maintain costly computing infrastructure or host data and applications on the user's own hardware and servers (Markovic et al., 2014). Customers in this context include both individuals and organizations (Johnston, Loot & Esterhuyse, 2016).

On-demand access and resource pooling are the two main features that distinguish cloud computing from traditional computing (Alijani et al., 2014). On-demand access means that users pay for the service based on their demand, much as they pay for ordinary utilities such as gas and electricity (Jolfaie et al., 2007). Resource pooling means that a pool of computing resources owned and controlled by the provider is shared among multiple tenants. These two features ensure a more efficient and cost-effective utilization of computing resources. In simpler terms, cloud computing entails outsourcing IT services (Budriene & Zalieckaite, 2012; Gonzalez & Smith, 2014). It "is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources" (Mitchell & Meggison, 2014, p. 1).

Although cloud computing became popular at the beginning of the 21st century, it is not an entirely new practice. Discourses and practices relating to cloud computing date as far back as the mid-20th century (Budriene & Zalieckaite, 2012). Organizations have hosted software and hardware externally and outsourced IT services for decades. Nevertheless, with the emergence of broadband internet, virtual solutions, and other powerful supporting technologies in the 1990s and 2000s, the concept of cloud computing advanced considerably (Budriene & Zalieckaite, 2012; Alali & Yeh, 2012).

Service and Deployment Models

Cloud computing services are offered in three basic forms: Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) (Srinivasan, 2013). SaaS is the least complicated and most common of the three (Budriene & Zalieckaite, 2012). It offers hardware and software to the user without the complexities of running an IT system. The cloud provider fully controls the computing infrastructure, including servers, networks, and operating systems. Based on economies of scale, the provider is able to offer shared computing resources to a large number of users, most of whom are small and medium enterprises (SMEs) (Srinivasan, 2013). Users sign up for their desired computing resources — data storage, memory volume, CPU capacity, and so forth (Budriene & Zalieckaite, 2012). A company email system is an ideal example of SaaS; popular SaaS products include Amazon AWS, IBM's Cloudburst, Apple's iCloud, and Google's Gmail and Google Docs. In spite of its simplicity, SaaS may not be appropriate for applications that require exceptionally fast data processing (Markovic et al., 2014).

PaaS provides the user with a platform and the basic capacity to run their own applications (Srinivasan, 2013). The platform may involve an operating system, for instance, and is mostly utilized by programmers and system developers. It provides all the tools and resources for developing, testing, deploying, and hosting applications (Markovic et al., 2014). PaaS has built-in flexibility: although the cloud provider controls the underlying computing system, the user can control deployed applications as well as configuration settings (Srinivasan, 2013). Accordingly, the user is responsible for addressing security concerns presented by the deployed applications. Whenever a hardware or software change is needed, provisioning takes just a few days rather than weeks. Nonetheless, PaaS is mainly limited to applications without high portability requirements (Markovic et al., 2014). Popular PaaS platforms include Google App Engine, Microsoft Azure, and Rackspace Cloud.

IaaS, the highest service level in cloud computing, is broadly similar to PaaS in terms of features (Srinivasan, 2013). The key difference is that the user has full control over not only deployed applications, but also the underlying computing infrastructure — though they do not own it. This extended control means the user must contend with more security challenges, as the user is responsible for all aspects of security relating to both the infrastructure and deployed applications. This model tends to suit situations characterized by volatile demand and new organizations without sufficient capital to acquire hardware (Markovic et al., 2014). Popular IaaS platforms include Amazon EC2 and S3, IBM's Blue Cloud, and EMC's Atmos.

In addition to the three service models, cloud computing services fall under four deployment models: public cloud (customers share the computing infrastructure with other customers); private cloud (the computing system is used by only one customer); hybrid cloud (a combination of public and private cloud); and community cloud (utilized by organizations in the same industry or with a shared focus, such as financial services and healthcare) (Srinivasan, 2013). The public cloud is the most common deployment model, with approximately two-thirds of cloud computing customers using it (Srinivasan, 2013). Nonetheless, the public cloud offers less security compared to the private cloud, which is widespread among large organizations (Budriene & Zalieckaite, 2012). Each deployment model addresses the needs of customers at varying levels (Rawal, 2011). SMEs generally prefer the public cloud, while large organizations prefer the private cloud. A community cloud enables organizations in the same industry to share computing resources in a more cost-effective manner.

Benefits of Cloud Computing

The core purpose of cloud computing is to exploit economies of scale in the provision of IT services by offering them on demand in a decentralized manner (Srinivasan, 2013). As technology has evolved, organizations — whether large or small — now require more computing resources to carry out their everyday activities efficiently. It is expected that computing demands will be even greater in the future as technology advances and as organizations seek to fully digitize their operations (Budriene & Zalieckaite, 2012; Gonzalez & Smith, 2014; Ismail, Golamdin & Shahzad, 2016).

Keeping up with the elastic nature of computing demands can be a daunting challenge for most organizations. An organization typically requires a substantial amount of resources to acquire and maintain IT infrastructure as well as the associated human resources. With cloud computing, IT resources can be shared and accessed on an on-demand basis (Srinivasan, 2013), eliminating or reducing the burden of hardware and software acquisition and maintenance. Cloud computing also provides virtually unlimited space for storage, which can be a major challenge in today's data-intensive environment. Organizations now process, generate, and handle increasingly large amounts of data. Cloud computing therefore delivers significant cost savings — estimated to be three to five times less than traditional computing costs (Alijani et al., 2014). Cost savings are particularly meaningful for SMEs, which tend to be financially constrained (Budriene & Zalieckaite, 2012; Gonzalez & Smith, 2014).

Cost savings can also be particularly valuable for public sector organizations (Rawal, 2011), and specifically for the DOD. According to Research Information Limited (2010b), modernizing IT functions at the agency can deliver substantial cost savings — especially given reduced government spending on defense following the withdrawal of the military from Iraq and Afghanistan, which brought about smaller budget allocations. Since the DOD is the largest employer in the U.S. and worldwide, with over 2.5 million employees — a significant proportion of whom engage in activities requiring extensive domestic and international movement to gather intelligence — cloud computing can offer substantial cost advantages for such a mobile workforce.

Another benefit of cloud computing is that it enables organizations to more easily overcome fluctuations in demand for computing resources (Srinivasan, 2013). At times, demand for computing resources may be much greater than at others — particularly for organizations with peak or seasonal demand, such as those in the sports, entertainment, or tax services industries. With cloud computing, an organization can keep up with demand elasticity without bearing substantial costs (Gonzalez & Smith, 2014).

Cloud computing also offers a valuable way of backing up data and planning for disaster recovery (Srinivasan, 2013). The loss of data due to hardware and software failures or natural disasters can be extremely costly for an organization. With cloud computing, recovery from such disasters can be much easier, as the recurring burden of traditional recovery processes is avoided. Cloud computing makes data backup a less costly, time-consuming, and labor-intensive undertaking. Whereas backup in the conventional environment is usually done daily or weekly, cloud computing allows data to be backed up automatically, eliminating periodic manual backups, minimizing duplication, and saving time and effort. Other important benefits include the facilitation of technological agility and the acceleration of organizational growth (Mitchell & Meggison, 2014; Johnston, Loot & Esterhuyse, 2016; Ismail, Golamdin & Shahzad, 2016).

Overall, as noted by Schmidt, Wood & Grabski (2016), cloud computing can be a crucial source of competitive advantage for organizations in an increasingly competitive and dynamic environment. Organizations are constantly under pressure to deliver more with less. In addition, the global economy has increasingly become knowledge-based, compelling organizations to rely on large amounts of diverse information in their decision-making. Cloud computing provides a convenient and valuable way for organizations to take advantage of modern computing technologies without substantial investments in IT infrastructure and personnel. Cloud computing has even been termed not only a computing platform, but also a business model (Budriene & Zalieckaite, 2012; Markovic et al., 2014), enabling new business models, driving value and revenue, offering strategic support, and enhancing operational efficiency.

For individuals, cloud computing offers flexibility, convenient data storage and access, and cost savings (Rawal, 2011). With data stored in a cloud service such as Dropbox, an individual can access their data wherever they are and whenever they want, as long as they have internet access. This reduces the need to carry flash drives and other forms of traditional storage, which are often vulnerable to loss, theft, and failure. Storing data in the cloud also means a reduced need to purchase conventional storage media, as well as more secure automatic backup. As Neumann (2014) explains, most individuals do not back up their data frequently or at all; for such individuals, cheap and automatic backup enabled by cloud platforms is a significant convenience. Cloud computing also enables individual users to easily share information and content online, offering limitless possibilities for users in both the public and private sectors.

Conclusion and Recommendations

Advances in computing have presented significant opportunities for individuals and organizations. Cloud computing provides a level of flexibility and convenience not present in the traditional computing environment, along with substantial cost savings by eliminating the need to acquire and maintain costly hardware and software. In the cloud computing environment, users generally do not have to worry about software updates, licenses, user agreements, and other aspects that characterize the conventional computing environment. Cloud computing also offers automated data backup, a more efficient approach to disaster recovery planning, and greater resilience against fluctuations in computing demand. These benefits make cloud computing an arguably unavoidable undertaking in today's world, enabling organizations to meet increased computing demands while operating within resource constraints.

Nonetheless, like any other technology, cloud computing has its fair share of challenges. It raises significant concerns regarding storage, access, reliability, trust, physical security, virtualization, and legal compliance. Users are often concerned about unauthorized access to their information, malicious attacks, government surveillance, and legal compliance, as well as the capacity and reliability of the provider in guaranteeing information and infrastructure security. These concerns center fundamentally on privacy, confidentiality, integrity, trust, and availability. Security concerns can lead to data leakage and data loss, resulting in disastrous consequences for users and cloud providers alike. It is important for the government, organizations, and individuals to understand the risks associated with cloud computing and to put strong measures in place to manage them.

Comprehensive vendor evaluation and centralized governance of information are useful strategies for managing cloud computing risks. Users must extensively assess the ability of the provider to guarantee information security by examining the provider's security policies, practices, and performance history. Responsibility for managing confidential information should be assigned to a central authority rather than distributed across several individuals or functions. It is also important to train employees, raise awareness of cloud computing risks, and establish an internal audit function for regularly inspecting risk management procedures. With proper management of the associated risks, cloud computing can undoubtedly deliver significant benefits to users.

Cloud computing is certainly an important evolution in the world of computing, affecting enterprises and applications of all sizes. As the demand for computing grows, more users are likely to adopt cloud computing to meet their resource needs while avoiding substantial capital investments. However, this shift must be undertaken with the necessary level of caution due to the associated risks. More importantly, there is a need for more comprehensive standards for the implementation of cloud computing. Key stakeholders — especially cloud providers and standards organizations such as ISO — should work together to develop universally acceptable guidelines for identifying cloud vendors, developing SLAs, and implementing and monitoring cloud computing. Greater attention should also be paid to the legal framework, particularly clarifying contentious issues such as vendor liability. Addressing these issues would be vital in boosting the adoption and responsible use of cloud computing.