Cloud Security: A Comprehensive Guide to Secure Cloud Computing

Foreword

Whenever we come upon something new, we try to understand it. A good way of understanding new things is to look for something from our experience that can serve as a metaphor. Sometimes this process works well, sometimes not.

Computer security has long labored under the metaphor of physical security. It stands to reason that we would assume that millennia of experience with keeping physical assets safe would serve us in keeping digital assets safe as well.

Much of our thinking in computer security has therefore been concerned with putting important things someplace "safe" and then controlling access to it. I distinctly recall a conversation with a security analyst at the beginning of the PC network era. When asked how to ensure the security of data on a PC, he said, "Simple. Put the data on the PC. Put the PC in a safe. Put the safe at the bottom of the ocean."

We have been challenged over the years with coming up with safe places that allowed access. We have been challenged with even figuring out what "safe" might mean in a world where risks could come from anywhere, including inside our own organizations.

In today's world, the physical security metaphor continues to deteriorate. We've all seen a movie or TV show where some critical piece of data becomes key to the plot. The location of the next terrorist attack is kept on a single USB that is subject to theft, deterioration, or any other number of physical ills designed to increase the drama. That is simply not the nature ...