Atlantic International University,

Honolulu, Hawaii 96813

SECURITY AND PRIVACY ISSUES IN THE CLOUD COMPUTING SYSTEMS

By MBANZABUGABO Jean Baptiste, ID# UD30956SCO39530

School: Science and Engineering

Program: Doctorate
Major: Computer Science

Kigali - RWANDA

TABLE OF CONTENTS
ABSTRACT....................................................................................................................... 2
1. INTRODUCTION........................................................................................................... 2
2. HI-TECH AND RECOGNIZED ENVIRONMENT IN FRONT OF THE CLOUD.....................4
2.1. TECHNOLOGICAL ENVIRONMENT.......................................................................6
3. DISCUSSION.............................................................................................................. 13
3.1. MANAGERIAL AND POLICY IMPLICATIONS............................................................14
3.2. FUTURE RESEARCH............................................................................................. 17
4. CONCLUSION AND COMMENDATIONS.......................................................................17
END NOTES................................................................................................................... 18
REFERENCES................................................................................................................. 20

ABSTRACT
Cloud computing is a double-edged sword from the privacy and security standpoints. Despite its
potential to provide a low cost security, organizations may increase risks by storing sensitive data in
the cloud. In this paper, I analyze how the clouds characteristics such as newness, nature of the
architecture, and attractiveness and vulnerability as a cybercrime target are tightly linked to privacy
and security. I also tried to investigate how the contexts provided by formal and informal institutions
affect privacy and security issues in the cloud.
KEYWORDS: Privacy and security, cloud computing, formal institutions, informal institutions,
security costs, Security vulnerability.
1. INTRODUCTION
Cloud computing is one of the latest innovations of IT which claims to be all capable of driving the
future world of IT within minimum costs. This concept of cloud computing being one side widely
accepted by normal users while on the other hand majority of the Organizations have some serious
security concerns before moving to this form of IT evolution.
Organizations are moving to cloud computing technologies (hereinafter: the cloud) to perform
increasingly strategic and mission critical functions. At the same time, companies are facing
2

pressures and challenges to protect information assets belonging to their customers and other
sensitive data McCafferty, 2010). Unsurprisingly security, privacy and availability are among the
topmost concerns in their cloud adoption decisions rather than the total cost of ownership (Brodkin
2010). The cloud is a double-edged sword from the security standpoint. For organizations that lack
technological and human resources to focus on security third parties in the cloud can provide lowcost security (Kshetri 2010a). Cloud computing users, on the other hand, face several separate but
related security risks (Talbot 2010).
The cloud poses various technological as well as institutional challenges. The cloud-related legal
system and enforcement mechanisms are evolving more slowly compared to the technology
development. Privacy, security and ownership issues related to data stored on cloud currently fall
into legally gray areas (Bradley 2010). Some argue that an organization, rather than the cloud
provider, is likely legally responsible if customer data stored in the cloud are compromised
(Zielinski 2009). A second criticism is that there has been arguably a disturbing lack of respect for
essential privacy among major cloud providers (Larkin 2010, p. 44). For instance, in a complaint
filed with the Federal Trade Commission (FTC), the Electronic Privacy Information Center (EPIC)
argued that Google misrepresented the privacy and security of its users data (Wittow & Buller
2010). Cloud providers are also criticized on the ground that they do not conduct adequate
background security investigations for their employees (Wilshusen 2010). This issue is rather
important since significant proportions of cybercrimes are associated with malicious insiders.
Likewise, new bugs and vulnerabilities targeting the cloud are proliferating (Brynjolfsson et al.
2010).
Critics have raised concerns about privacy and security associated with unauthorized access and use
of information stored in the cloud for malicious purposes (McCreary 2008). A commonplace
observation is that while cloud providers offer sophisticated services, their performances have been
weak in policies and practices related to privacy and security (Wittow & Buller 2010; Greengard &
Kshetri 2010).
Businesses and consumers have expressed distrust in the cloud and are cautious in using it to store
high-value data or sensitive information. Due to weak security, the cloud arguably remains a
largely nascent technology (Stewart 2010) and critics have argued that its costs may outweigh the
benefits (Tillery 2010)2. According to an IDC report released by the research firm, International
Data Corporation (IDC) in October 2008, security concern was the most serious barrier to cloud
adoption for organizations. Organizations rightfully worry about hidden costs associated with
security breaches or lawsuits tied to data privacy restrictions (Zielinski 2009).
3

This paper, would argue that issues related to security and privacy in the cloud, while well
documented, are only partially understood. The factors related to privacy and security issues of the
cloud focused in the paper can be described by considering a broad approach to institutions, which
defines the concept in terms of a games equilibrium. Three factors that determine equilibrium
include:
i.

Technologically determined external constraints;

ii.

Humanly devised external constraints

iii.

Constraints developed within the pillars through patterns of behavior and the creation of
expectations

Cloud computing involves hosting applications on servers and delivering software and services via
the Internet. In the cloud computing model, companies can access computing power and resources
on the cloud and pay for services based on usage. Institutions are the rules of the game and
include formal constraints (rules, laws, constitutions), informal constraints (norms of behavior,
conventions, and self-imposed codes of conduct), and their enforcement characteristics.
2. HI-TECH AND RECOGNIZED ENVIRONMENT IN FRONT OF THE CLOUD
Issues revolving around privacy, and ownership and access to data raise interesting questions in the
cloud. As a visual aid, Figure 1 schematically represents how privacy and security issues in the
cloud are tightly linked to the institutional and technological environments.
We discuss the building blocks of the model in this section.
Various characteristics of the cloud affect organizations perceptions of confidentiality, integrity, and
availability of the cloud (Left part of Figure 1). Formal and informal institutions, on the other hand,
affect perception of legitimacy and trustworthiness of the cloud (Right part of Figure 1). Assessment
of institutional and technological facilitators and inhibitors affect organizations adoption decisions
(Figure 1).
Figure 1. Cloud Computing Model - Open Secure Architecture
Institutional actors responses lag behind the technological changes (Katyal 2001; Brenner 2004).
Moreover, institutional actors vary in their timing of responses. For instance, whereas trade and
professional associations and industry standard organizations are taking measures to respond to
security and privacy issues in the cloud, government agencies have been slow to adopt necessary
legislative, regulatory and other measures to monitor users and providers of the cloud.
4

2.1. TECHNOLOGICAL ENVIRONMENT

2.1.1. THE CLOUDS NEWNESS AND UNIQUE VULNERABILITIES
The clouds newness and uniqueness present special problems. With the evolution and popularity of
virtualization technology, new bugs, vulnerabilities and security issues are being found
(Brynjolfsson et al. 2010). The cloud, however, is not a familiar terrain for most IT security
companies. A lack of mechanisms to guarantee security and privacy has been an uncomfortable
reality for many cloud providers.
Virtualization as one of the implementational model of Cloud Technology, it has found that a user
may be able to access to the providers sensitive portions of infrastructure as well as resources of
other client environments that are managed by the same cloud provider
Figure 2. Cloud computing Layers according to Gartner, 2009.
Experts argue that such vulnerabilities could have more adverse impacts in the cloud than in an onpremise computing (Owens 2010).
The cloud is also forensically challenging in the case of a data breach. For instance, some public
cloud systems may store and process data in different jurisdictions, which vary in terms of laws
related to security, privacy, data theft, data loss and intellectual property theft (McCafferty 2010).
Some organizations may encrypt their data before storing in the cloud.

2.1.2. NATURE OF THE ARCHITECTURE

Virtual and dynamic
The virtual and dynamic nature of the cloud computing architecture deserves mention. For one
thing, the shared and dynamic resources of the cloud such as CPU and networking reduce control
for the user and tend to pose new security issues not faced by on-premise computing. A related point
is that these characteristics of the cloud allow data and information to distribute widely across many
jurisdictions. The locations where data are stored may vary in laws regarding security, privacy, data
theft, and protection of intellectual property (McCafferty 2010).
Virtualization is the primary security mechanism in the cloud, despite their insulation from the
customer, run on physical systems; virtualization environments are not necessarily bug-free.
Sophistication and complexity
5

The clouds security related problems can also be linked to its sophisticated and complex
architecture. In April 2010, U.S. and Canada-based researchers published a report on a sophisticated
cyber-espionage network, which they referred as Shadow network. The targets included the Indian
Ministry of Defense, the United Nations, and the Office of the Dalai Lama. The report noted:
Clouds provide criminals and espionage networks with convenient cover, tiered defenses,
redundancy, cheap hosting and conveniently distributed command and control architectures
(IWMSF 2010).
Another problem concerns the clouds complexity. An important trend facilitated by the cloud is
social media, which are arguably corporate security nightmare (BBW 2010). In the Shadow case
noted above, the cyber-espionage network combined social networking and cloud platforms,
including those of Google, Baidu, Yahoo!, Twitter, Blogspot and blog.com with traditional
command and control servers (IWMSF 2010).
2.1.3. ATTRACTIVENESS AND VULNERABILITIES OF THE CLOUD AS A
CYBERCRIME BULL
Earlier we mentioned that the cloud can provide a low cost security due to economies of scales.
However, an unintended downside of cheap services is more security issues.

Value of data in the cloud

Target attractiveness depends on offenders perceptions of victims. Prior research indicates that
crime opportunity is a function of target attractiveness, which is measured in monetary or symbolic
value and portability (Clarke 1995). Target attractiveness is also related to accessibility, visibility,
ease of physical access, and lack of surveillance (Bottoms & Wiles 2002). Large companies
networks offer more targets to hackers. Cloud suppliers, which often are bigger than their clients,
are attractive targets. The cloud thus offers a high surface area of attack (Talbot 2010). That is,
information stored in clouds is a potential goldmine for cyber-criminals (Kshetri 2010a). In late
2009, Google explained that the company discovered a China-originated attack on its
infrastructures. The company further noted that the attack was part of a larger operation, which
infiltrated infrastructures of at least 20 other large companies.
Criminal-controlled clouds

The cloud is potentially most vulnerable, especially when viewed against the backdrop of criminal
owned-clouds operating in parallel. Just like diamond is the only material hard enough to cut
diamond effectively, criminal-owned clouds may be employed to effectively steal data stored in
clouds. The cloud may provide many of the same benefits to criminals as for legitimate businesses.
The well-known Conficker virus, which reportedly controls 7 million computer systems at 230
regional and country top-level domains and has a bandwidth capacity of 28 terabits/second, is
arguably the worlds biggest cloud and probably the most visible example of a criminal-owned
cloud. Just like legitimate clouds, Conficker is available for rent. Cybercriminals can choose a
location they want to rent Conficker and pay according to the bandwidth they want and choose an
operating system (Mullins 2010).
2.2. INSTITUTIONAL ENVIRONMENT
Institutional theory is described as a theory of legitimacy seeking (Dickson et al., 2004, p. 81). To
gain legitimacy, organizations adopt behaviors irrespective of the effect on organizational efficiency
(Campbell 2004). Institutional influence on adoption decisions related to the cloud becomes an
admittedly complex process when providers and users of the cloud have to derive legitimacy from
multiple sources such as employees, clients, client customers, professional and trade associations
and governments.
Scott (2001) proposed three institutional pillars:
(i)

Regulative;

(ii)

Normative

(iii)

Cognitive.

These pillars relate to legally sanctioned, morally governed and recognizable, taken-forgranted behaviors respectively.
The cloud industry is undergoing a major technological upheaval. In such situations, for various
actors, the institutional context may not provide organizing templates, models for action, and
sources of legitimacy (Greenwood & Hinings 1993). In most cases, such changes create confusion
and uncertainty and produce an environment that lacks norms, templates, and models about
appropriate strategies and structures (Newman 2000). Existing institutions are hopelessly inadequate
and obsolete to deal with the security and privacy problems facing the cloud industry. For instance,

cloud computing has challenged traditional institutional arrangements and notions about auditing
and security.
2.2.1. THE NATURE OF REGULATIVE INSTITUTIONS RELATED TO THE CLOUD
INDUSTRY
Regulative institutions consist of explicit regulative processes: rule setting, monitoring, and
sanctioning activities, regulative institutions consist of regulatory bodies adhere to the rules so that
they would not suffer the penalty for noncompliance of the system.
Laws to deal with data on the cloud
The importance of regulative institutions such as laws, contracts and courts in the cloud industry
should be obvious if this industry is viewed against the backdrop of the current state of security
standards. In the absence of radical improvements in security technology, such institutions become
even more important.
The cloud-related legal system and enforcement mechanisms are evolving more slowly compared to
the cloud technology development. Compliance frameworks such as SOX, HIPAA and PCI-DSS
(Payment Card Industry Data Security Standard) do not clearly define the guidelines and
requirements for data stored on the cloud (Bradley 2010). Cloud computing thus poses various
challenges and constraints for companies that have responsibilities to meet stringent compliance
related to these frameworks and reporting requirements for their data (McCafferty 2010; NW 2010).
The cloud has several important new and unique features, which create problems in writing
contracts. For instance, an analysis of the contracts between Google and Computer Sciences
Corporation (CSC) with the City of Los Angeles indicated several problems related to data breach
and indemnification of damages. Google was a CSC subcontractor in the arrangement. An attorney
analyzing the case noted that some of the complexity in the case would have been avoided if the
term "lost data" was defined more clearly in the contracts (NW 2010).
While some experts understandably argue that it would not be practical to hold cloud providers
liable for everything, current regulations are heavily biased in favor of cloud providers. For instance,
in the event of a data breach in the cloud, the client, not the vendor, may be legally responsible
(Zielinski 2009). However, cloud providers are required to keep sensitive data belonging to a federal
agency within the country. While Google Apps are FISMA certified for its government cloud, which
is not necessarily the case for the private industry (Brodkin 2010).
Regulatory overreach
8

There have been concerns about possible overreach by law enforcement agencies. The FBI's audits
indicated the possibility of overreach by the agency in accessing Internet users information
(Zittrain 2009).
For some analysts, the biggest concern has been the governments increased ability to access
business and consumer data and censor and a lack of constitutional protections against these actions
(Talbot 2010). The cloud is likely to make it easier for governments to spy on citizens. Governments
worldwide, however, differ in their approach to and scale of web censorship and surveillance.
Especially, the cloud is likely to provide authoritarian regimes a fertile ground for cyber-control
activities.
2.2.2. THE NATURE OF NORMATIVE INSTITUTIONS RELATED TO THE CLOUD
INDUSTRY
Normative components introduce a prescriptive, evaluative, and obligatory dimension into social
life (Scott 1995, p. 37). This component focuses on the values and norms held by individuals and
organizations that influence the functioning of the cloud industry. Practices that are consistent with
and take into account the different assumptions and value systems are likely to be successful
(Schneider 1999).
Professional associations measures
Compared to established industrial sectors, in nascent and formative sectors such as cloud
computing, there is no developed network of regulatory agencies. For instance, there are few, if any,
national or international legal precedents for the cloud industry (McCafferty 2010). As a
consequence, there is no stipulated template for organizing, and thus pressures for conformity are
less pronounced (Greenwood & Hinings 1996). In such settings, professional and trade associations
may emerge to play unique and important roles in shaping the industry (Kshetri & Dholakia 2009).
These associations norms, informal rules, and codes of behavior can create order, without the laws
coercive power, by relying on a decentralized enforcement process where noncompliance is
penalized with social and economic sanctions (North 1990).
Various professional and trade associations are also constantly emerging and influencing security
and privacy issues in the cloud in new ways as a result of their expertise and interests in this issue. A
visible example is the Cloud Security Alliance (CSA) (www.cloudsecurityalliance.org), a group of
information security professionals. The CSA is working on a set of best practices as well as
information security standards for cloud providers (Crosman 2010).
Industry standards and certification programs
9

Some argue that industry standards organizations may address most of the user concerns related to
privacy and security in the cloud industry (Object Management Group 2009). Organizations such as
Object Management Group (OMG), the Distributed Management Task Force (DMTF), the Open
Grid Forum (OGF), and the Storage Networking Industry Association (SNIA) have made efforts to
address security and privacy concerns in the cloud industry (Wittow & Buller 2010).
There are no formal processes for auditing cloud platforms. Analysts argue that auditing standards to
assess a service providers control over data (e.g., SAS 70) or other information security
specifications (e.g., the International Organization for Standardizations ISO 27001) are insufficient
to deal with and address the unique security issues facing the cloud (Brodkin 2010). Note that these
standards and specifications were not developed specifically for the cloud computing.
2.2.3. THE NATURE OF COGNITIVE INSTITUTIONS RELATED TO THE CLOUD
INDUSTRY
Cognitive institutions are closely associated with culture (Jepperson, 1991). These components
represent culturally supported habits that influence cloud providers and
users behaviors. In most cases, they are based on subconsciously accepted rules and customs as
well as some taken-for-granted cultural account of cloud use (Berger & Luckmann 1967). Scott
(1995, p. 40) suggests that cognitive elements constitute the nature of reality and the frames
through which meaning is made. Cognitive programs are built on the mental maps of individual
cloud users and thus function primarily at the individual level (Huff 1990). Compliance in cognitive
legitimacy concerns is due to habits. Organizations and individuals may not even be aware that they
are complying.
Perception of vendors integrity and capability
In particular concern is the users dependency on cloud vendors security assurances and practices.
Cloud providers must guard against theft or denial-of-service attacks by users. Users need to be
protected from one another (Armbrust et al. 2010). After several readings, Inspections have shown
that potential cloud adopters are concerned about the possibility that service providers security
might have ineffective or noncompliant controls, which may lead to vulnerabilities affecting the
confidentiality, integrity, and availability of data (Wilshusen 2010). Organizations are also
concerned that cloud providers may use insecure ways to delete data once services have been
provided (Wilshusen 2010).
Admittedly, data theft, denial-of-service attacks by users, threats from other users, and bugs are not
the only-and not the biggest-problem associated with the cloud. There is also a high degree of
10

temptation for the cloud providers or their employees to engage in opportunistic behavior (Armbrust
et al. 2010). The cloud thus may also increase exposure to organizational vulnerabilities to insider
risks. Indeed, malicious insider risks are among the most important risks that the cyberspace faces.
According to a report released by the FBI in 2006, over 40% of attacks originate inside an
organization (Regan 2006). Some have raised concerns that service providers do not conduct
adequate background security investigations of their employees (Wilshusen 2010).
One fear has been that intellectual property and other sensitive information stored in the cloud
could be stolen. Worse still, cloud providers may not notify their clients about security breaches.
Evidence indicates that many businesses tend to underreport cybercrimes due to embarrassment,
concerns related to credibility and reputation damages and fears of stock price drops. Many of the
cyber-attacks go unnoticed or may go unnoticed for long periods of time. An organizations data in
the cloud may be stolen but it may not ever be aware that such incidents had happened.
Cloud users inertia effects
It is quite possible that organizational inertia1 may affect the lens through which users view security
and privacy issues in the cloud. Organizational inertia may constraint a firm's ability to exploit
emerging opportunities such as cloud computing. An inertia effect is likely to adversely influence an
organizations assessment of the cloud from the security and privacy standpoints.
Reduction in control is an obvious concern. Cloud users dont have access to the hardware and other
resources that store and process their data. There is no physical control over data and information in
the cloud (Wilshusen, 2010). A case in point is Google. The company provides security and privacy
assurances to its Google Docs users unless the users publish them online or invite collaborators.
However, Google service agreements explicitly make it clear that the company provides no warranty
or bears no liability for harm in case of Googles negligence to protect the privacy and security.
Just as vital is preference for localness. From the standpoint of security, most users prefer computing
to be local. Organizations arguably ask: who would trust their essential data out there somewhere?
.
3. DISCUSSION
It is important to emphasize that the model presented by figure 1 is dynamic in nature. We anticipate
that the salience of each component of institutional and technological factors will vary across
organizations as well as over time. For instance, barriers associated with newness and inertia effects

11

are likely to decline over time. On the other hand, as the penetration level, width and depth of cloud
increases, it is likely to be a more attractive cybercrime target.
One implication of the dynamic aspects of the model is that institutions change over time in the
cloud industry. The idea of institutional field can be helpful in understanding this dynamic. A field is
formed around the issues that become important to the interests and objectives of specific
collectives of organizations. For a field formed around privacy and security in the cloud, these
organizations include regulatory authorities, providers and users of the cloud as well as professional
and trade association. The content, rhetoric, and dialogue among these constituents influence the
nature of field formed around the security and privacy issues associated with the cloud.
An understanding of arbiters would provide important insight into the sources of institutional
change in the cloud industry. It has identified three categories of arbiters social, legal, and
economic. Much of the early evidence indicates that institutions in the cloud industry should
rebalance towards a higher power of the users. Experts argue that courts (legal arbiters) are likely to
take a middle ground and make providers liable for breach. The Electronic Privacy Information
Center (EPIC) (a social arbiter) filed a complaint with the Federal Trade Commission (FTC) against
Googles cloud services. EPIC made the point that Google
does not adequately safeguard users confidential information. It requested the FTC to open an
investigation into Googles Cloud services18 (Wittow & Buller 2010). Likewise, experts argue that
market forces and consumer demands (economic arbiters) are likely to drive a lot of privacy changes
in cloud computing (TR 2010).
3.1. MANAGERIAL AND POLICY IMPLICATIONS
The model presented in this paper also has implications for management practice and public policy.
Most cloud providers services come with no assurance or promise of a given level of security and
privacy. Cloud providers lack policies and practices related to privacy and security. Nor is that their
only problem. Cloud providers have also demonstrated a tendency to reduce their liability by
proposing contracts with the service provided as is with no warranty (McCafferty 2010).
Perception of ineffectiveness or noncompliance of cloud providers may thus act as a roadblock to
organizations cloud adoption decisions. In this regard, above analysis indicates that security and
privacy measures designed to reduce perceived risk as well as transparency and clear
communication processes would create a competitive advantage for cloud providers.
The newness and uniqueness of the cloud often mean that clients would not know what to ask for in
investment decisions. An understanding of model would also help organizations take technological,
12

behavioral and perceptual/attitudinal measures. The users of the cloud are functioning on the
assumption that cloud providers take privacy and security issues seriously (Wittow & Buller 2010).
However, against the backdrop of the institutional contexts, this may well be a convenient but
possibly false assumption.
The model also leads to useful questions that need to be asked before making cloud related
investments. Given the institutional and technological environment, potential adopters should ask
tough questions to the vendor regarding certification from auditing and professional organizations
(e.g., AICPA), locations of the vendors data centers, and background check of the vendors
employees, etc.
The above analysis suggest that a one size fits all' approach to the cloud cannot work. The model
presented in Figure 1 would also help in making strategic decisions. For instance, organizations may
have to make decisions concerning combinations of public and private clouds. For instance, the
public cloud is effective for an organization handling high-transaction/low-security or low data
value (e.g., sales force automation). Private cloud model, on the other hand, may be appropriate for
enterprises that face significant risk from information exposure such as financial institutions and
health care provider or federal agency. For instance, for medical-practice companies dealing with
sensitive patient data, which are required to comply with the HIPAA rules, private cloud may be
appropriate.
In general, legal systems take long time to change (Dempsey 2008). Regulative institutions related
to liability and other issues in the cloud are not well developed. Cloud providers may feel pressures
to obtain endorsements from professional societies.
AICPAs endorsements have driven the diffusion of cloud applications among some CPA firms.
Today, accurately or not, businesses are concerned about issues such as privacy, availability, data
loss (e.g., shutting down of online storage sites), data mobility and ownership (e.g., availability of
data in usable form if the user discontinues the services). Cloud providers are criticized on the
ground that they do not answer questions and fail to give enough evidence to trust them. In this
regard, many of the user concerns can be addressed by becoming more transparent.
Since geographic dispersion of data is an important factor associated with cost and performance of
the cloud, an issue that deserves mention relates to regulatory arbitrage. Experts expect that
countries update their laws individually rather than to act in a multilateral fashion (TR 2010).
Economies worldwide vary greatly in terms of the legal systems related to the cloud. Due to the
13

newness, jurisdictional arbitrage is higher for the cloud compared to the IT industry in general. In
this regard critics are concerned that cloud providers may store sensitive information in jurisdictions
that have weak laws related to privacy, protection and availability of data (Edwards 2009).
Anecdotal evidence suggests that due to increasingly important roles in national security, many high
technology sectors are characterized by a high degree of protectionism. The atmosphere of suspicion
and distrust among states can lead to such protectionism. To capture the feelings that accompany
intergovernmental distrust, consider the U.S.China trade and investment policy relationship.
Chinese leaders are suspicious about possible cyber-attacks from the U.S. There has been a deep
rooted perception among Chinese policy-makers that Microsoft and the U.S. government spy on
Chinese computer users through secret back doors in Microsoft product. Chinese leaders thus may
be uncomfortable with the idea of storing data on clouds provided by foreign multinationals. U.S.
policy makers are equally concerned about Chinese technology firms internationalization. The
above analysis indicates that such concerns are likely to be even more prominent in cloud
computing.
Cyber-espionage has been an obvious application of the cloud. If there is any lesson that recent
major cyber-espionage activities teach, it is that countries with strong cyber-spying and cyberwarfare capabilities such as China will be in a good position to exploit the clouds weaknesses for
such activities.
In view of the technological capabilities of extra-legal and illegal organizations, one area that
deserves attention is the escalation of economic and industrial espionage activities such as
intellectual property theft. There have been reports that U.S. government agencies such as the
Defense Department as well as private companies have been targets and victims of such activities24.
It is thus reasonable to expect that the cloud may enable an upgrade of these activities to industrial
espionage.
Nonetheless, security and privacy issues in the developing world need to be viewed in the context of
weak defense mechanisms of organizations. Information technologys follow diffusion concept can
be helpful in understanding a weak defense. Many companies in developing countries lack
technological and human resources to focus on security. Hollow diffusion can be human-related
(lack of skill and experience) or technology-related (inability and failure to use security products)
(Otis & Evans 2003). Especially for developing-based organizations that do not deal with highvalue and sensitive data the cloud may provide low-cost security to address some of the securityrelated human and technological issues.
14

Providers and users of the cloud face additional challenges in developing economies. Various
aspects of the institutional environment may weaken the clouds value proposition and discourage
investors. In many developing countries, factors such as corruption, the lack of transparency, and a
weak legal system can exacerbate security risks. The high-profile attacks on Google cloud allegedly
by China-based hackers in 2009 were an eye opener for the cloud industry.
A final issue that deserves mention relates to the impacts of clouds controlled by the developing
world players on security issues of industrialized countries. It is tempting for global cloud players to
use cheaper hosting services in developing countries. Cyber-criminals, however, find it more
attractive to target rich economies.
3.2. FUTURE RESEARCH
Before concluding, I suggest several potentially fruitful avenues for future research. Cloud-related
institutions are currently thin and dysfunctional. For instance, as noted above, privacy and security
issues of data stored on the cloud currently fall into a legally gray area. Future research might
examine how political, ethical, social and cultural factors are associated with security issues in cloud
computing.
Next, an empirical examination of core premises and propositions of the model presented by Figure
1 would be useful to advance the model's utility as a viable framework for studying the
technological and institutional drivers of the cloud industry. Such a study would shack light on the
relative importance of various components of the model in organizations cloud adoption decision.
Finally, future research might also explore antecedents of organizations cloud computing decisions
in terms of various technological dimensions such of the country that motivate to run on cloud
despite inerrant of data control.
4. CONCLUSION AND COMMENDATIONS
CONCLUSION
It has been sorely defined cloud computing as management and provision of different resources,
such as, software, applications and information as services over the cloud (internet) on demand.
Cloud computing is based on the assumption that the information can be quickly and easily accessed
via the net. With its ability to provide dynamically scalable access for users, and the ability to share
resources over the Internet, cloud computing has recently emerged as a promising hosting platform
that performs an intelligent usage of a collection of services, applications, information and
infrastructure comprised of pools of computers, networks, information and storage resources. Cloud
15

computing is a multi-tenant resource sharing platform, which allows different service providers to
deliver software as services in an economical way. Cloud computing is the latest technology
revolution in terms of usage and management of IT resources and services driven largely by
marketing and service offerings from the largest IT vendors including Google, IBM, Microsoft, and
HP along with Amazon and VMware.
However along with these advantages, storing a large amount of data including critical information
on the cloud motivates highly skilled hackers, thus creating a need for the security is considered as
one of the top issues while considering Cloud Computing. The paper clarified the security model of
cloud computing, and then analyzed the feasibility, threats, and security pillars in cloud computing
in terms of extensive existing methods to control them along with their pros and cons. Furthermore,
the related open research problems and challenges were explored to promote the development of
cloud computing.

COMMENDATIONS
Virtualized resources in the cloud lower upfront investment and product development costs.
However, the low cost comes with a trade-off. The above analysis suggests that it is too simplistic to
view the cloud as a low-cost security. Legitimate as well as illegitimate organizations and entities
are gaining access to data on the cloud through illegal, extralegal, and quasi-legal means. The
clouds diffusion and that of social media have superimposed onto organizations rapid digitization
in a complex manner that allows cyber-criminals and cyber-espionage networks to exploit the
clouds weaknesses. The above analysis thus indicates that ensuring that both technological and
behavioral/perceptual factors are given equal consideration in the design and implementation of a
cloud network is thus crucial.
Existing institutions are subject to powerful environmental selection mechanisms (Gilson 2001).
Existing institutions are likely to be exposed and restructured to support a new set of beliefs and
actions and the rules are likely to be revised. New institutions and the redesign of existing
institutions are needed to confront emerging security and privacy problems in the cloud industry.
There is an indication that existing institutions related to the cloud are thickening. In this regard, the
war for the future of security and privacy issues in the cloud is just beginning. Tough analysts of
cloud security are gaining new credibility. For instance, a new way of auditing specifically designed
for the cloud industry is evolving. Overall, it is fair to say that privacy and security issues related to
the cloud industry are undergoing political, social, and psychological metamorphosis.
16

END NOTES:
1. Unsurprisingly the response of the cloud industry has been: Clouds are more secure than
whatever youre using now (Talbot 2010).
2. John Chambers, the Cisco Systems chairman, called the cloud a Security nightmare that
cant be handled in traditional ways (Talbot 2010).
3. IDCs another survey conducted in the early 2010 also ranked security concerns as the No. 1
barrier to cloud adoption (Del Nibletto 2010).
4. For instance, an analyst of Gartner noted that it is difficult to know whether cloud providers
practice of "Hiding the data in a million places" ensures a good security as there is no way to
evaluate such practice (Messmer 2010)
5. A leader of the cloud security team at the National Institute of Standards and Technology
(NIST) was quoted as saying: Every customer has access to every knob and widget in that
application. If they have a single weakness, [an attacker may] have access to all the data
(Talbot 2010).
6. Customers also have a range of options for the type of services to put in the Conficker such
as a denial-of-service attack, spreading malware, sending spam or data exfiltration
7. The formation of regulative pillar is characterized by the establishment of legal and
regulatory infrastructures to deal with the cloud industry (Hoffman, 1999). A normative
institutional pillar is said to be established if rich and well developed ethical codes,
guidelines and traditions develop in the cloud industry. Likewise, a cognitive pillar related to
the cloud industry is established if cloud culture is developed that is considered as normal
practices.
8. Norths formal constraints can be mapped with Scotts (1995, 2001) regulative pillar while
informal constraints can be mapped with normative and cognitive pillars.
9. These institutions focus on the pragmatic legitimacy concerns in managing the demands of
regulators and governments (Kelman 1987).

17

10. While companies have used the cloud for applications such as payroll and email services,
and other MIS, security has been the most often-cited barrier to cloud adoption for
applications involving sensitive information (Armbrust et al. 2010).

REFERENCES
Cloud Computing Explained: Implementation Handbook for Enterprises, Recursive Press, ISBN
0956355609, 2009
Hadoop, the Definitive Guide, OReilly Media, ISBN: 978-0-596-52197-4, 2010
Distributed and Cloud Computing, 1st edition, Morgan Kaufmann, 2011.
Clarke, R. V. (1995). Situational crime prevention. In M. Tonry & D. P. Farrington (Eds.), Building
a safer society. Strategic approaches to crime (pp. 91150). University of Chicago Press.
Crosman, P. (2009). Securing The Clouds, Wall Street & Technology, December 1, pp.23.
Dean, T. J., & Meyer, G. D. (1996). Industry Environments and New Venture Formations in U.S.
Manufacturing: a Conceptual and Empirical Analysis of Demand Determinations. Journal of
Business Venturing, 11, 107-132.
Del Nibletto, P. (2010). The seven deadly sins of cloud computing, March 19, 2010, available at
http://www.itbusiness.ca/it/client/en/home/News.asp?id=56870. Accessed July 24, 2010.
Dempsey,

P. J.

(2008).

Unprepared

to

fight

worldwide

cyber

crime,

available

at

http://www.internetevolution.com/author.asp?section_id=593&doc_id=147027&piddl
_msgid=154774#msg_154774.
Edwards, J. (2009). Cutting Through the Fog of Cloud Security. Computerworld, 43(8), 26-29.
ENSIA. (2009). Cloud Computing: Benefits, risks and recommendations for information security.
European

Network

and

Information

Security

Agency,

November,

available

at

http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-riskassessment/at_download/fullReport.
Guillen, M. F. & Suarez, S. L. (2005). Explaining the Global Digital Divide: Economic, Political
and Sociological Drivers of Cross-National Internet Use, Social Forces, 84(2): 681708.
Hoffman, A. J. (1999). Institutional evolution and change: Environmentalism and the US chemical
industry. Academy of Management Journal, 42(4), 351371.
18

Huff, A. S. (1990). Mapping strategic thought. In A. S. Huff (eds.). Mapping strategic thought
(pp.1149). Chichester, England: Wiley.
IWMSF (Information Warfare Monitor/Shadowserver Foundation), Shadows In The Cloud:
Investigating Cyber Espionage 2.0, Joint Report: Information Warfare Monitor Shadowserver
Foundation, JR03-2010, April 6, 2010, available at http://www.utoronto.ca/mcis/pdf/shadows-inthe-cloud-web.pdf. Accessed July 24, 2010.
Jepperson, R. (1991). Institutions, institutional effects, and institutionalism. In W. W. Powell & P. J.
DiMaggio (eds.). The new institutionalism in organizational analysis (pp. 143163). Chicago:
University of Chicago Press.
Katyal, N. K. (2001). Criminal law in cyberspace. University of Pennsylvania Law Review, 149(4),
10031114.
Kshetri, N. (2007). The Adoption of E-Business by Organizations in China: An Institutional
Perspective, Electronic Markets, 17(2), 113-125
Kshetri, N. (2010a). Cloud Computing in Developing Economies. IEEE Computer, October, 43(10),
47-55.
Kshetri, N. (2010b). The Global Cyber-crime Industry: Economic, Institutional and Strategic
Perspectives. New York, Berlin and Heidelberg: Springer-Verlag.
Larsen, E., & Lomi, A. (2002). Representing change: A system Model of organizational inertia and
capabilities as dynamic accumulation processes. Simulation Model Practice and Theory, 10(5), 271296. Martin, J. A. (2010). Should You Move Your Business to the Cloud?. PC World, Apr 2010,
28(4), 29-30. Martnez-Cabrera, A. (2010). Security in the computing cloud a top concern, March 6,
2010, available at http://articles.sfgate.com/2010-03-06/business/18378297_1_cyber-security-czarhoward-schmidt-qualys-rsa.
Messmer, E. (2010). Cloud computing providers working in secret. Network World, July
12, 2010, 27(13), 10-11. Messmer, E. (2010). Secrecy of cloud computing providers raises IT
security risks, available at http://www.mis-asia.com/news/articles/secrecy-of-cloud-computingproviders-raises-it-security-risks.

19

Mullins, R. (2010). The biggest cloud on the planet is owned by ... the crooks: Security expert says
the

biggest

cloud

providers

are

botnets,

March

22,

2010,

available

at

http://www.networkworld.com/community/node/58829?t51hb. Accessed July 24, 2010.

NW (Network World). (2010). Inside the cloud security risk, 27(13), p. 11. Newman, K. L. (2000).
Organizational transformation during institutional upheaval.
Rogers, E. M. (1995). Diffusion of innovations. Fourth edition. New York: Free Press.
Schneider, A. (1999). US neo-conservatism: Cohort and cross-cultural perspective. The
International Journal of Sociology and Social Policy, 19(12), 5686.
Scott, R. (1995). Institutions and organizations. Thousand Oaks, CA: Sage.
Scott, R. (2001). Institutions and organizations. Thousand Oaks, CA: Sage.
Scott, W. R., Ruef, M., Mendel, P. J., & Caronna, C. A. (2000). Institutional change and
healthcare organizations: From professional dominance to managed care. Chicago, IL: University of
Chicago Press.
Snidal, D. (1996). Political economy and international institutions. International Review of Law and
Economics, 16(1), 121137.
Stewart, B. (2010). Apple Keeps iTunes Out of the Cloud. Information Today, Oct 2010, 27(9), 4646.
Sturdevant, C. (2010). Seeding security into the cloud. eWeek, March 15, 2010, 27(6), 38-38.
Talbot, D. (2010). Security in the Ether. Technology Review, 113(1), 36-42.
Taylor, M., Haggerty, J., Gresty, D., & Hegarty, R. (2010). Digital evidence in cloud computing
systems. Computer Law & Security Review, May 2010, 26(3), 304-308.
TR (Telecommunications Reports). (2010). Microsoft Urges Policymakers To Help Secure Cloud
Computing, 76(3), 18-19.
Tillery,

S.

(2010).

How

Safe

Is

the

Cloud?,

http://www.baselinemag.com/c/a/Security/How-Safe-Is-the-Cloud-273226.

20

available

at

Vizard, M. (2010). Assessing the Risks of Cloud Computing, Oct 11, 2010, available at
http://www.itbusinessedge.com/cm/blogs/vizard/assessing-the-risks-of-cloud-computing/?cs=43712.
Wilshusen, G. C. (2010). Information Security Federal Guidance Needed to Address Control Issues
with Implementing Cloud Computing. GAO Reports, July 1, 2010, preceding pp. 1-48.
Wittow, M. H., & Buller, D. J. (2010). Cloud Computing: Emerging Legal Issues for Access to Data,
Anywhere, Anytime. Journal of Internet Law, Jul 2010, 14(1), 1-10.
Zielinski, D. (2009). Be Clear on Cloud Computing Contracts. HRMagazine, Nov, 54(11), 63-65.

21