Security or Assurance?
Can systems (and more importantly, information) ever be truly secure? The term “security” does imply that something is either secure or not.
However, in reality, there are degrees of security and lots of assumptions around this. Some people prefer the term “assurance” as this implies instead a certain level of protection which can be verified (to some degree).
In the Cloud world, we may always fall short of attaining bullet-proof security; however we can aspire to levels of assurance similar to those we would aim for in the non-Cloud world.
Security or Stewardship?
With the advent of the Cloud, some have started using the term “stewardship” with respect to securing Cloud usage, rather than "security". The former has connotations of responsibility, accountability and trade-offs.
I guess most people would recognise that the first two of these are desirable – but ‘trade-offs’? With limits on resources available and aspirations for increased business agility (e.g. collaborative ventures, consumerisation), many organisations are considering how trade-offs between “ideal security” and cost, for example, can be achieved – in a clear and controlled way. It’s based on the assumption that some information is more valuable than others.
There are, of course, many complications when operating in the Cloud.
- · Ownership and valuation of information assets;
- · Accountability.
Most of all, achieving good stewardship in the Cloud requires openness.
